@azure/msal-browser 5.6.3 → 5.8.0

package/src/controllers/StandardController.ts

@@ -29,6 +29,8 @@ import {
     Constants,
     AuthToken,
     enforceResourceParameter,
+    CacheHelpers,
+    TimeUtils,
 } from "@azure/msal-common/browser";
 import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import * as BrowserRootPerformanceEvents from "../telemetry/BrowserRootPerformanceEvents.js";
@@ -36,6 +38,7 @@ import {
     BrowserCacheManager,
     DEFAULT_BROWSER_CACHE_MANAGER,
 } from "../cache/BrowserCacheManager.js";
+import * as CacheKeys from "../cache/CacheKeys.js";
 import * as AccountManager from "../cache/AccountManager.js";
 import { BrowserConfiguration, CacheOptions } from "../config/Configuration.js";
 import {
@@ -59,6 +62,7 @@ import { EndSessionRequest } from "../request/EndSessionRequest.js";
 import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { EventHandler } from "../event/EventHandler.js";
+import { base64Decode } from "../encode/Base64Decode.js";
 import { PopupClient } from "../interaction_client/PopupClient.js";
 import { RedirectClient } from "../interaction_client/RedirectClient.js";
 import { SilentIframeClient } from "../interaction_client/SilentIframeClient.js";
@@ -466,14 +470,12 @@ export class StandardController implements IController {
         const loggedInAccounts = this.getAllAccounts();
         const platformBrokerRequest: PlatformAuthRequest | null =
             this.browserStorage.getCachedNativeRequest();
-        const useNative =
-            platformBrokerRequest &&
-            this.platformAuthProvider &&
-            !options?.hash;
+        const useNative = platformBrokerRequest && !options?.hash;
 
         let rootMeasurement: InProgressPerformanceEvent;
 
         let redirectResponse: Promise<AuthenticationResult | null>;
+        let cachedRedirectRequest: SsoSilentRequest | undefined;
         try {
             if (useNative && this.platformAuthProvider) {
                 const correlationId =
@@ -491,6 +493,9 @@ export class StandardController implements IController {
                     "handleRedirectPromise - acquiring token from native platform",
                     correlationId
                 );
+                rootMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 const nativeClient = new PlatformAuthInteractionClient(
                     this.config,
                     this.browserStorage,
@@ -512,10 +517,11 @@ export class StandardController implements IController {
                     this.logger,
                     this.performanceClient,
                     rootMeasurement.event.correlationId
-                )(this.performanceClient, rootMeasurement.event.correlationId);
+                )();
             } else {
                 const [standardRequest, codeVerifier] =
                     this.browserStorage.getCachedRequest("");
+                cachedRedirectRequest = standardRequest;
                 const correlationId = standardRequest.correlationId;
                 this.eventHandler.emitEvent(
                     EventType.HANDLE_REDIRECT_START,
@@ -581,6 +587,12 @@ export class StandardController implements IController {
                         undefined,
                         result.account
                     );
+
+                    // Fire-and-forget SSO capability verification in background
+                    this.verifySsoCapability(
+                        cachedRedirectRequest,
+                        InteractionType.Redirect
+                    );
                 } else {
                     /*
                      * Instrument an event only if an error code is set. Otherwise, discard it when the redirect response
@@ -705,28 +717,36 @@ export class StandardController implements IController {
                     this.nativeInternalStorage,
                     correlationId
                 );
-                result = nativeClient
-                    .acquireTokenRedirect(request, atrMeasurement)
-                    .catch((e: AuthError) => {
-                        if (
-                            e instanceof NativeAuthError &&
-                            isFatalNativeAuthError(e)
-                        ) {
-                            this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                            const redirectClient =
-                                this.createRedirectClient(correlationId);
-                            return redirectClient.acquireToken(request);
-                        } else if (e instanceof InteractionRequiredAuthError) {
-                            this.logger.verbose(
-                                "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow",
-                                correlationId
-                            );
-                            const redirectClient =
-                                this.createRedirectClient(correlationId);
-                            return redirectClient.acquireToken(request);
-                        }
-                        throw e;
+                result = invokeAsync(
+                    nativeClient.acquireTokenRedirect.bind(nativeClient),
+                    BrowserPerformanceEvents.NativeInteractionClientAcquireTokenRedirect,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(request, atrMeasurement).catch((e: AuthError) => {
+                    atrMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
                     });
+                    if (
+                        e instanceof NativeAuthError &&
+                        isFatalNativeAuthError(e)
+                    ) {
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
+                        return redirectClient.acquireToken(request);
+                    } else if (e instanceof InteractionRequiredAuthError) {
+                        this.logger.verbose(
+                            "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow",
+                            correlationId
+                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
+                        return redirectClient.acquireToken(request);
+                    }
+                    throw e;
+                });
             } else {
                 const redirectClient = this.createRedirectClient(correlationId);
                 result = redirectClient.acquireToken(request);
@@ -815,6 +835,9 @@ export class StandardController implements IController {
         const pkce = this.getPreGeneratedPkceCodes(correlationId);
 
         if (this.canUsePlatformBroker(request)) {
+            atPopupMeasurement.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative(
                 {
                     ...request,
@@ -834,11 +857,15 @@ export class StandardController implements IController {
                     return response;
                 })
                 .catch((e: AuthError) => {
+                    atPopupMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (
                         e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)
                     ) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const popupClient =
                             this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request, pkce);
@@ -889,6 +916,10 @@ export class StandardController implements IController {
                     undefined,
                     result.account
                 );
+
+                // SSO capability verification in background
+                this.verifySsoCapability(request, InteractionType.Popup);
+
                 return result;
             })
             .catch((e: Error) => {
@@ -964,6 +995,145 @@ export class StandardController implements IController {
         window.removeEventListener("online", listener);
         window.removeEventListener("offline", listener);
     }
+
+    /**
+     * Reads the cached ssoCapable value from localStorage.
+     * @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
+     */
+    private getCachedSsoCapable(): boolean | undefined {
+        try {
+            const cachedValue = window.localStorage.getItem(
+                CacheKeys.SSO_CAPABLE
+            );
+            if (cachedValue) {
+                const parsed = JSON.parse(cachedValue);
+                if (
+                    parsed &&
+                    typeof parsed.ssoCapable === "boolean" &&
+                    parsed.expiresOn &&
+                    Date.now() < parsed.expiresOn
+                ) {
+                    return parsed.ssoCapable;
+                }
+            }
+        } catch {
+            // If parsing fails, return undefined
+        }
+        return undefined;
+    }
+
+    /**
+     * SSO capability verification in the background.
+     * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+     * This method does not block the caller and tracks telemetry for success/failure.
+     * This method only executes if verifySSO is set to true in the auth configuration.
+     * The result is cached in localStorage with a 24-hour TTL; the SSO verification call
+     * is only attempted when the cached value is absent or expired.
+     * @param request - The original request used for the authentication flow
+     * @param interactionType - The interactionType of the AT operation for logging purposes
+     */
+    private verifySsoCapability(
+        request: SsoSilentRequest | undefined,
+        interactionType: InteractionType
+    ): void {
+        // Check if SSO capability verification is enabled
+        if (!this.config.auth.verifySSO) {
+            return;
+        }
+
+        // Check TTL: derive ssoCapable state from localStorage and skip if not expired
+        const ssoCacheKey = CacheKeys.SSO_CAPABLE;
+        const SSO_CAPABLE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+        const cachedSsoCapable = this.getCachedSsoCapable();
+        if (cachedSsoCapable !== undefined) {
+            this.logger.verbose(
+                `SSO capability verification skipped - cached value has not expired (interactionType: '${interactionType}')`,
+                ""
+            );
+            return;
+        }
+
+        const correlationId = createNewGuid();
+        const ssoCapableMeasurement = this.performanceClient.startMeasurement(
+            BrowserRootPerformanceEvents.SsoCapable,
+            correlationId
+        );
+        ssoCapableMeasurement.add({
+            "ext.interactionType": interactionType,
+        });
+
+        this.logger.verbose(
+            `SSO capability verification initiated after '${interactionType}'`,
+            correlationId
+        );
+
+        /*
+         * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+         * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+         */
+        setTimeout(() => {
+            const ssoVerificationRequest: SsoSilentRequest = {
+                ...request,
+                correlationId: correlationId,
+            };
+
+            const silentIframeClient =
+                this.createSilentIframeClient(correlationId);
+            silentIframeClient
+                .verifySso(ssoVerificationRequest)
+                .then((result: boolean) => {
+                    this.logger.verbose(
+                        `SSO capability verification completed after '${interactionType}', result: '${result}'`,
+                        correlationId
+                    );
+
+                    // TBD to add profileTelemetry later in localStorage with 24h TTL
+                    try {
+                        const cacheEntry = JSON.stringify({
+                            ssoCapable: result,
+                            expiresOn: Date.now() + SSO_CAPABLE_TTL_MS,
+                        });
+                        window.localStorage.setItem(ssoCacheKey, cacheEntry);
+                    } catch {
+                        this.logger.warning(
+                            `Failed to cache SSO capability verification result (interactionType: '${interactionType}')`,
+                            correlationId
+                        );
+                    }
+
+                    ssoCapableMeasurement.end(
+                        {
+                            fromCache: false,
+                            success: result,
+                        },
+                        undefined
+                    );
+                })
+                .catch((error: Error) => {
+                    this.logger.warning(
+                        `SSO capability verification failed after '${interactionType}': '${error.message}'`,
+                        correlationId
+                    );
+                    // reset the cache
+                    try {
+                        window.localStorage.removeItem(ssoCacheKey);
+                    } catch {
+                        this.logger.warning(
+                            `Failed to reset cached SSO capability verification result (interactionType: '${interactionType}')`,
+                            correlationId
+                        );
+                    }
+                    ssoCapableMeasurement.end(
+                        {
+                            fromCache: false,
+                            success: false,
+                        },
+                        error
+                    );
+                });
+        }, 0);
+    }
+
     // #endregion
 
     // #region Silent Flow
@@ -987,8 +1157,6 @@ export class StandardController implements IController {
         const correlationId = this.getRequestCorrelationId(request);
         const validRequest = {
             ...request,
-            // will be PromptValue.NONE or PromptValue.NO_SESSION
-            prompt: request.prompt,
             correlationId: correlationId,
         };
         this.ssoSilentMeasurement = this.performanceClient.startMeasurement(
@@ -997,6 +1165,7 @@ export class StandardController implements IController {
         );
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(
             this.initialized,
@@ -1023,13 +1192,20 @@ export class StandardController implements IController {
         let result: Promise<AuthenticationResult>;
 
         if (this.canUsePlatformBroker(validRequest)) {
+            this.ssoSilentMeasurement?.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative(
                 validRequest,
                 ApiId.ssoSilent
             ).catch((e: AuthError) => {
+                this.ssoSilentMeasurement?.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const silentIframeClient = this.createSilentIframeClient(
                         validRequest.correlationId
                     );
@@ -1155,7 +1331,6 @@ export class StandardController implements IController {
                             atbcMeasurement.end(
                                 {
                                     success: true,
-                                    isNativeBroker: result.fromPlatformBroker,
                                     accessTokenSize: result.accessToken.length,
                                     idTokenSize: result.idToken.length,
                                 },
@@ -1194,6 +1369,9 @@ export class StandardController implements IController {
                 if (
                     this.canUsePlatformBroker(request, request.nativeAccountId)
                 ) {
+                    atbcMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const result = await this.acquireTokenNative(
                         {
                             ...request,
@@ -1202,6 +1380,10 @@ export class StandardController implements IController {
                         ApiId.acquireTokenByCode,
                         request.nativeAccountId
                     ).catch((e: AuthError) => {
+                        atbcMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         // If native token acquisition fails for availability reasons fallback to standard flow
                         if (
                             e instanceof NativeAuthError &&
@@ -1275,7 +1457,6 @@ export class StandardController implements IController {
                 this.acquireTokenByCodeAsyncMeasurement?.end({
                     success: true,
                     fromCache: response.fromCache,
-                    isNativeBroker: response.fromPlatformBroker,
                 });
                 return response;
             })
@@ -1528,11 +1709,59 @@ export class StandardController implements IController {
 
         if (result.fromPlatformBroker) {
             this.logger.verbose(
-                "Response was from native broker, storing in-memory",
+                "Response was from native broker, storing ID Token in browser storage and Access Token in-memory",
                 result.correlationId
             );
-            // Tokens from native broker are stored in-memory
-            return this.nativeInternalStorage.hydrateCache(result, request);
+
+            // Create idToken entity and store in browser storage
+            const idTokenEntity = CacheHelpers.createIdTokenEntity(
+                result.account.homeAccountId,
+                result.account.environment,
+                result.idToken,
+                this.config.auth.clientId,
+                result.tenantId
+            );
+
+            // Create accessToken entity and store in native internal storage
+            const accessTokenEntity = CacheHelpers.createAccessTokenEntity(
+                result.account.homeAccountId,
+                result.account.environment,
+                result.accessToken,
+                this.config.auth.clientId,
+                result.tenantId,
+                result.scopes.join(" "),
+                result.expiresOn
+                    ? TimeUtils.toSecondsFromDate(result.expiresOn)
+                    : 0,
+                result.extExpiresOn
+                    ? TimeUtils.toSecondsFromDate(result.extExpiresOn)
+                    : 0,
+                base64Decode,
+                undefined, // refreshOn
+                result.tokenType as Constants.AuthenticationScheme,
+                undefined, // userAssertionHash
+                request.sshKid
+            );
+
+            if (request.resource) {
+                accessTokenEntity.resource = request.resource;
+            }
+
+            const kmsi = AuthToken.isKmsi(result.idTokenClaims);
+
+            // Store idToken in browser storage
+            await this.browserStorage.setIdTokenCredential(
+                idTokenEntity,
+                result.correlationId,
+                kmsi
+            );
+
+            // Store accessToken in native internal storage
+            await this.nativeInternalStorage.setAccessTokenCredential(
+                accessTokenEntity,
+                result.correlationId,
+                kmsi
+            );
         } else {
             return this.browserStorage.hydrateCache(result, request);
         }
@@ -1573,7 +1802,13 @@ export class StandardController implements IController {
             correlationId
         );
 
-        return nativeClient.acquireToken(request, cacheLookupPolicy);
+        return invokeAsync(
+            nativeClient.acquireToken.bind(nativeClient),
+            BrowserPerformanceEvents.NativeInteractionClientAcquireToken,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(request, cacheLookupPolicy);
     }
 
     /**
@@ -1604,7 +1839,7 @@ export class StandardController implements IController {
             )
         ) {
             this.logger.trace(
-                "canUsePlatformBroker: isBrokerAvailable returned false, returning false",
+                "canUsePlatformBroker: isPlatformAuthAllowed returned false, returning false",
                 correlationId
             );
             return false;
@@ -1654,7 +1889,9 @@ export class StandardController implements IController {
                 loginHint: request.loginHint,
                 sid: request.sid,
             }) ||
-            this.getActiveAccount();
+            (!request.loginHint && !request.sid
+                ? this.getActiveAccount()
+                : null);
 
         return (account && account.nativeAccountId) || "";
     }
@@ -1947,6 +2184,7 @@ export class StandardController implements IController {
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
 
         preflightCheck(this.initialized, atsMeasurement, this.config, request);
@@ -1963,7 +2201,6 @@ export class StandardController implements IController {
                     {
                         success: true,
                         fromCache: result.fromCache,
-                        isNativeBroker: result.fromPlatformBroker,
                         accessTokenSize: result.accessToken.length,
                         idTokenSize: result.idToken.length,
                     },
@@ -2261,12 +2498,26 @@ export class StandardController implements IController {
                 "acquireTokenSilent - attempting to acquire token from native platform",
                 silentRequest.correlationId
             );
+
+            this.performanceClient.addFields(
+                { isPlatformBrokerRequest: true },
+                silentRequest.correlationId
+            );
+
             return this.acquireTokenNative(
                 silentRequest,
                 ApiId.acquireTokenSilent_silentFlow,
                 silentRequest.account.nativeAccountId,
                 cacheLookupPolicy
             ).catch(async (e: AuthError) => {
+                this.performanceClient.addFields(
+                    {
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    },
+                    silentRequest.correlationId
+                );
+
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose(

package/src/custom_auth/UserAccountAttributes.ts

@@ -7,6 +7,7 @@ export type UserAccountAttributes = Record<string, string> & {
     city?: string;
     country?: string;
     displayName?: string;
+    flatusername?: string;
     givenName?: string;
     jobTitle?: string;
     postalCode?: string;

package/src/error/NativeAuthError.ts

@@ -48,8 +48,7 @@ export function isFatalNativeAuthError(error: NativeAuthError): boolean {
     if (
         error.ext &&
         error.ext.status &&
-        (error.ext.status === NativeStatusCodes.PERSISTENT_ERROR ||
-            error.ext.status === NativeStatusCodes.DISABLED)
+        error.ext.status === NativeStatusCodes.DISABLED
     ) {
         return true;
     }