@azure/msal-common 14.1.0 → 14.2.0-alpha.0

package/src/authority/Authority.ts

@@ -23,7 +23,8 @@ import {
 } from "../utils/Constants";
 import {
     EndpointMetadata,
-    InstanceDiscoveryMetadata,
+    getCloudDiscoveryMetadataFromHardcodedValues,
+    getCloudDiscoveryMetadataFromNetworkResponse,
     InstanceDiscoveryMetadataAliases,
 } from "./AuthorityMetadata";
 import {
@@ -33,7 +34,11 @@ import {
 import { ProtocolMode } from "./ProtocolMode";
 import { ICacheManager } from "../cache/interface/ICacheManager";
 import { AuthorityMetadataEntity } from "../cache/entities/AuthorityMetadataEntity";
-import { AuthorityOptions, AzureCloudInstance } from "./AuthorityOptions";
+import {
+    AuthorityOptions,
+    AzureCloudInstance,
+    StaticAuthorityOptions,
+} from "./AuthorityOptions";
 import {
     CloudInstanceDiscoveryResponse,
     isCloudInstanceDiscoveryResponse,
@@ -81,6 +86,8 @@ export class Authority {
     protected performanceClient: IPerformanceClient | undefined;
     // Correlation Id
     protected correlationId: string | undefined;
+    // Indicates if the authority is fake, for the purpose of a Managed Identity Application
+    private managedIdentity: boolean;
     // Reserved tenant domain names that will not be replaced with tenant id
     private static reservedTenantDomains: Set<string> = new Set([
         "{tenant}",
@@ -97,7 +104,8 @@ export class Authority {
         authorityOptions: AuthorityOptions,
         logger: Logger,
         performanceClient?: IPerformanceClient,
-        correlationId?: string
+        correlationId?: string,
+        managedIdentity?: boolean
     ) {
         this.canonicalAuthority = authority;
         this._canonicalAuthority.validateAsUri();
@@ -112,6 +120,7 @@ export class Authority {
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.correlationId = correlationId;
+        this.managedIdentity = managedIdentity || false;
         this.regionDiscovery = new RegionDiscovery(
             networkInterface,
             this.logger,
@@ -377,7 +386,7 @@ export class Authority {
     }
 
     /**
-     * Boolean that returns whethr or not tenant discovery has been completed.
+     * Boolean that returns whether or not tenant discovery has been completed.
      */
     discoveryComplete(): boolean {
         return !!this.metadata;
@@ -393,14 +402,7 @@ export class Authority {
             this.correlationId
         );
 
-        let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(
-            this.hostnameAndPort
-        );
-
-        if (!metadataEntity) {
-            metadataEntity = new AuthorityMetadataEntity();
-            metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);
-        }
+        const metadataEntity = this.getCurrentMetadataEntity();
 
         const cloudDiscoverySource = await invokeAsync(
             this.updateCloudDiscoveryMetadata.bind(this),
@@ -420,10 +422,46 @@ export class Authority {
             this.performanceClient,
             this.correlationId
         )(metadataEntity);
+        this.updateCachedMetadata(metadataEntity, cloudDiscoverySource, {
+            source: endpointSource,
+        });
+    }
+
+    /**
+     * Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
+     * from the configured canonical authority
+     * @returns
+     */
+    private getCurrentMetadataEntity(): AuthorityMetadataEntity {
+        let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(
+            this.hostnameAndPort
+        );
+
+        if (!metadataEntity) {
+            metadataEntity = new AuthorityMetadataEntity();
+            metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);
+        }
+        return metadataEntity;
+    }
 
+    /**
+     * Updates cached metadata based on metadata source and sets the instance's metadata
+     * property to the same value
+     * @param metadataEntity
+     * @param cloudDiscoverySource
+     * @param endpointMetadataResult
+     */
+    private updateCachedMetadata(
+        metadataEntity: AuthorityMetadataEntity,
+        cloudDiscoverySource: AuthorityMetadataSource | null,
+        endpointMetadataResult: {
+            source: AuthorityMetadataSource;
+            metadata?: OpenIdConfigResponse;
+        } | null
+    ): void {
         if (
             cloudDiscoverySource !== AuthorityMetadataSource.CACHE &&
-            endpointSource !== AuthorityMetadataSource.CACHE
+            endpointMetadataResult?.source !== AuthorityMetadataSource.CACHE
         ) {
             // Reset the expiration time unless both values came from a successful cache lookup
             metadataEntity.resetExpiresAt();
@@ -448,16 +486,95 @@ export class Authority {
             PerformanceEvents.AuthorityUpdateEndpointMetadata,
             this.correlationId
         );
+
+        const localMetadata =
+            this.updateEndpointMetadataFromLocalSources(metadataEntity);
+
+        // Further update may be required for hardcoded metadata if regional metadata is preferred
+        if (localMetadata) {
+            if (
+                localMetadata.source ===
+                AuthorityMetadataSource.HARDCODED_VALUES
+            ) {
+                // If the user prefers to use an azure region replace the global endpoints with regional information.
+                if (
+                    this.authorityOptions.azureRegionConfiguration?.azureRegion
+                ) {
+                    if (localMetadata.metadata) {
+                        const hardcodedMetadata = await invokeAsync(
+                            this.updateMetadataWithRegionalInformation.bind(
+                                this
+                            ),
+                            PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation,
+                            this.logger,
+                            this.performanceClient,
+                            this.correlationId
+                        )(localMetadata.metadata);
+                        metadataEntity.updateEndpointMetadata(
+                            hardcodedMetadata,
+                            false
+                        );
+                    }
+                }
+            }
+            return localMetadata.source;
+        }
+
+        // Get metadata from network if local sources aren't available
+        let metadata = await invokeAsync(
+            this.getEndpointMetadataFromNetwork.bind(this),
+            PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )();
+        if (metadata) {
+            // If the user prefers to use an azure region replace the global endpoints with regional information.
+            if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
+                metadata = await invokeAsync(
+                    this.updateMetadataWithRegionalInformation.bind(this),
+                    PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation,
+                    this.logger,
+                    this.performanceClient,
+                    this.correlationId
+                )(metadata);
+            }
+
+            metadataEntity.updateEndpointMetadata(metadata, true);
+            return AuthorityMetadataSource.NETWORK;
+        } else {
+            // Metadata could not be obtained from the config, cache, network or hardcoded values
+            throw createClientAuthError(
+                ClientAuthErrorCodes.openIdConfigError,
+                this.defaultOpenIdConfigurationEndpoint
+            );
+        }
+    }
+
+    /**
+     * Updates endpoint metadata from local sources and returns where the information was retrieved from and the metadata config
+     * response if the source is hardcoded metadata
+     * @param metadataEntity
+     * @returns
+     */
+    private updateEndpointMetadataFromLocalSources(
+        metadataEntity: AuthorityMetadataEntity
+    ): {
+        source: AuthorityMetadataSource;
+        metadata?: OpenIdConfigResponse;
+    } | null {
         this.logger.verbose(
             "Attempting to get endpoint metadata from authority configuration"
         );
-        let metadata = this.getEndpointMetadataFromConfig();
-        if (metadata) {
+        const configMetadata = this.getEndpointMetadataFromConfig();
+        if (configMetadata) {
             this.logger.verbose(
                 "Found endpoint metadata in authority configuration"
             );
-            metadataEntity.updateEndpointMetadata(metadata, false);
-            return AuthorityMetadataSource.CONFIG;
+            metadataEntity.updateEndpointMetadata(configMetadata, false);
+            return {
+                source: AuthorityMetadataSource.CONFIG,
+            };
         }
 
         this.logger.verbose(
@@ -470,27 +587,14 @@ export class Authority {
                 "Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache."
             );
         } else {
-            let hardcodedMetadata =
+            const hardcodedMetadata =
                 this.getEndpointMetadataFromHardcodedValues();
             if (hardcodedMetadata) {
-                this.logger.verbose(
-                    "Found endpoint metadata from hardcoded values."
-                );
-                // If the user prefers to use an azure region replace the global endpoints with regional information.
-                if (
-                    this.authorityOptions.azureRegionConfiguration?.azureRegion
-                ) {
-                    hardcodedMetadata = await invokeAsync(
-                        this.updateMetadataWithRegionalInformation.bind(this),
-                        PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation,
-                        this.logger,
-                        this.performanceClient,
-                        this.correlationId
-                    )(hardcodedMetadata);
-                }
-
                 metadataEntity.updateEndpointMetadata(hardcodedMetadata, false);
-                return AuthorityMetadataSource.HARDCODED_VALUES;
+                return {
+                    source: AuthorityMetadataSource.HARDCODED_VALUES,
+                    metadata: hardcodedMetadata,
+                };
             } else {
                 this.logger.verbose(
                     "Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache."
@@ -507,39 +611,12 @@ export class Authority {
         ) {
             // No need to update
             this.logger.verbose("Found endpoint metadata in the cache.");
-            return AuthorityMetadataSource.CACHE;
+            return { source: AuthorityMetadataSource.CACHE };
         } else if (metadataEntityExpired) {
             this.logger.verbose("The metadata entity is expired.");
         }
 
-        metadata = await invokeAsync(
-            this.getEndpointMetadataFromNetwork.bind(this),
-            PerformanceEvents.AuthorityGetEndpointMetadataFromNetwork,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )();
-        if (metadata) {
-            // If the user prefers to use an azure region replace the global endpoints with regional information.
-            if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
-                metadata = await invokeAsync(
-                    this.updateMetadataWithRegionalInformation.bind(this),
-                    PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation,
-                    this.logger,
-                    this.performanceClient,
-                    this.correlationId
-                )(metadata);
-            }
-
-            metadataEntity.updateEndpointMetadata(metadata, true);
-            return AuthorityMetadataSource.NETWORK;
-        } else {
-            // Metadata could not be obtained from the config, cache, network or hardcoded values
-            throw createClientAuthError(
-                ClientAuthErrorCodes.openIdConfigError,
-                this.defaultOpenIdConfigurationEndpoint
-            );
-        }
+        return null;
     }
 
     /**
@@ -712,6 +789,35 @@ export class Authority {
             PerformanceEvents.AuthorityUpdateCloudDiscoveryMetadata,
             this.correlationId
         );
+        const localMetadataSource =
+            this.updateCloudDiscoveryMetadataFromLocalSources(metadataEntity);
+        if (localMetadataSource) {
+            return localMetadataSource;
+        }
+
+        // Fallback to network as metadata source
+        const metadata = await invokeAsync(
+            this.getCloudDiscoveryMetadataFromNetwork.bind(this),
+            PerformanceEvents.AuthorityGetCloudDiscoveryMetadataFromNetwork,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )();
+
+        if (metadata) {
+            metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
+            return AuthorityMetadataSource.NETWORK;
+        }
+
+        // Metadata could not be obtained from the config, cache, network or hardcoded values
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.untrustedAuthority
+        );
+    }
+
+    private updateCloudDiscoveryMetadataFromLocalSources(
+        metadataEntity: AuthorityMetadataEntity
+    ): AuthorityMetadataSource | null {
         this.logger.verbose(
             "Attempting to get cloud discovery metadata  from authority configuration"
         );
@@ -732,7 +838,7 @@ export class Authority {
                 metadataEntity.canonical_authority || Constants.NOT_APPLICABLE
             }`
         );
-        let metadata = this.getCloudDiscoveryMetadataFromConfig();
+        const metadata = this.getCloudDiscoveryMetadataFromConfig();
         if (metadata) {
             this.logger.verbose(
                 "Found cloud discovery metadata in authority configuration"
@@ -752,7 +858,9 @@ export class Authority {
             );
         } else {
             const hardcodedMetadata =
-                this.getCloudDiscoveryMetadataFromHardcodedValues();
+                getCloudDiscoveryMetadataFromHardcodedValues(
+                    this.canonicalAuthority
+                );
             if (hardcodedMetadata) {
                 this.logger.verbose(
                     "Found cloud discovery metadata from hardcoded values."
@@ -782,23 +890,7 @@ export class Authority {
             this.logger.verbose("The metadata entity is expired.");
         }
 
-        metadata = await invokeAsync(
-            this.getCloudDiscoveryMetadataFromNetwork.bind(this),
-            PerformanceEvents.AuthorityGetCloudDiscoveryMetadataFromNetwork,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )();
-
-        if (metadata) {
-            metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
-            return AuthorityMetadataSource.NETWORK;
-        }
-
-        // Metadata could not be obtained from the config, cache, network or hardcoded values
-        throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.untrustedAuthority
-        );
+        return null;
     }
 
     /**
@@ -827,11 +919,10 @@ export class Authority {
                 const parsedResponse = JSON.parse(
                     this.authorityOptions.cloudDiscoveryMetadata
                 ) as CloudInstanceDiscoveryResponse;
-                const metadata =
-                    Authority.getCloudDiscoveryMetadataFromNetworkResponse(
-                        parsedResponse.metadata,
-                        this.hostnameAndPort
-                    );
+                const metadata = getCloudDiscoveryMetadataFromNetworkResponse(
+                    parsedResponse.metadata,
+                    this.hostnameAndPort
+                );
                 this.logger.verbose("Parsed the cloud discovery metadata.");
                 if (metadata) {
                     this.logger.verbose(
@@ -937,7 +1028,7 @@ export class Authority {
             this.logger.verbose(
                 "Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request."
             );
-            match = Authority.getCloudDiscoveryMetadataFromNetworkResponse(
+            match = getCloudDiscoveryMetadataFromNetworkResponse(
                 metadata,
                 this.hostnameAndPort
             );
@@ -972,24 +1063,6 @@ export class Authority {
         return match;
     }
 
-    /**
-     * Get cloud discovery metadata for common authorities
-     */
-    private getCloudDiscoveryMetadataFromHardcodedValues(): CloudDiscoveryMetadata | null {
-        if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
-            const hardcodedMetadataResponse =
-                InstanceDiscoveryMetadata[this.canonicalAuthority];
-            const metadata =
-                Authority.getCloudDiscoveryMetadataFromNetworkResponse(
-                    hardcodedMetadataResponse.metadata,
-                    this.hostnameAndPort
-                );
-            return metadata;
-        }
-
-        return null;
-    }
-
     /**
      * Helper function to determine if this host is included in the knownAuthorities config option
      */
@@ -1046,30 +1119,13 @@ export class Authority {
         };
     }
 
-    /**
-     * Searches instance discovery network response for the entry that contains the host in the aliases list
-     * @param response
-     * @param authority
-     */
-    static getCloudDiscoveryMetadataFromNetworkResponse(
-        response: CloudDiscoveryMetadata[],
-        authority: string
-    ): CloudDiscoveryMetadata | null {
-        for (let i = 0; i < response.length; i++) {
-            const metadata = response[i];
-            if (metadata.aliases.indexOf(authority) > -1) {
-                return metadata;
-            }
-        }
-
-        return null;
-    }
-
     /**
      * helper function to generate environment from authority object
      */
     getPreferredCache(): string {
-        if (this.discoveryComplete()) {
+        if (this.managedIdentity) {
+            return Constants.DEFAULT_AUTHORITY_HOST;
+        } else if (this.discoveryComplete()) {
             return this.metadata.preferred_cache;
         } else {
             throw createClientAuthError(
@@ -1184,9 +1240,7 @@ export class Authority {
      * @param authority
      */
     static transformCIAMAuthority(authority: string): string {
-        let ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH)
-            ? authority
-            : `${authority}${Constants.FORWARD_SLASH}`;
+        let ciamAuthority = authority;
         const authorityUrl = new UrlString(authority);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
 
@@ -1205,3 +1259,35 @@ export class Authority {
         return ciamAuthority;
     }
 }
+
+export function formatAuthorityUri(authorityUri: string): string {
+    return authorityUri.endsWith(Constants.FORWARD_SLASH)
+        ? authorityUri
+        : `${authorityUri}${Constants.FORWARD_SLASH}`;
+}
+
+export function buildStaticAuthorityOptions(
+    authOptions: Partial<AuthorityOptions>
+): StaticAuthorityOptions {
+    const rawCloudDiscoveryMetadata = authOptions.cloudDiscoveryMetadata;
+    let cloudDiscoveryMetadata: CloudDiscoveryMetadata[] | undefined =
+        undefined;
+    if (rawCloudDiscoveryMetadata) {
+        try {
+            cloudDiscoveryMetadata = JSON.parse(
+                rawCloudDiscoveryMetadata
+            ).metadata;
+        } catch (e) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.invalidCloudDiscoveryMetadata
+            );
+        }
+    }
+    return {
+        canonicalAuthority: authOptions.authority
+            ? formatAuthorityUri(authOptions.authority)
+            : undefined,
+        knownAuthorities: authOptions.knownAuthorities,
+        cloudDiscoveryMetadata: cloudDiscoveryMetadata,
+    };
+}

package/src/authority/AuthorityFactory.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { Authority } from "./Authority";
+import { Authority, formatAuthorityUri } from "./Authority";
 import {
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
@@ -45,9 +45,9 @@ export class AuthorityFactory {
             PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance,
             correlationId
         );
-
-        const authorityUriFinal =
-            Authority.transformCIAMAuthority(authorityUri);
+        const authorityUriFinal = Authority.transformCIAMAuthority(
+            formatAuthorityUri(authorityUri)
+        );
 
         // Initialize authority and perform discovery endpoint check.
         const acquireTokenAuthority: Authority =

package/src/authority/AuthorityMetadata.ts

@@ -3,6 +3,9 @@
  * Licensed under the MIT License.
  */
 
+import { UrlString } from "../url/UrlString";
+import { CloudDiscoveryMetadata } from "./CloudDiscoveryMetadata";
+
 export const rawMetdataJSON = {
     endpointMetadata: {
         "https://login.microsoftonline.com/common/": {
@@ -951,3 +954,87 @@ for (const key in InstanceDiscoveryMetadata) {
         }
     }
 }
+
+/**
+ * Returns aliases for the given canonical authority if found in hardcoded Instance Discovery Metadata or null if not found
+ * @param canonicalAuthority
+ * @returns
+ */
+export function getHardcodedAliasesForCanonicalAuthority(
+    canonicalAuthority?: string
+): string[] | null {
+    if (canonicalAuthority) {
+        const instanceDiscoveryMetadata =
+            getCloudDiscoveryMetadataFromHardcodedValues(canonicalAuthority);
+        if (instanceDiscoveryMetadata) {
+            return instanceDiscoveryMetadata.aliases;
+        }
+    }
+    return null;
+}
+
+/**
+ * Returns aliases for from the raw cloud discovery metadata given in configuration or null if no configuration was provided
+ * @param rawCloudDiscoveryMetadata
+ * @returns
+ */
+export function getAliasesFromConfigMetadata(
+    canonicalAuthority?: string,
+    cloudDiscoveryMetadata?: CloudDiscoveryMetadata[]
+): string[] | null {
+    if (canonicalAuthority && cloudDiscoveryMetadata) {
+        const canonicalAuthorityUrlComponents = new UrlString(
+            canonicalAuthority
+        ).getUrlComponents();
+        const metadata = getCloudDiscoveryMetadataFromNetworkResponse(
+            cloudDiscoveryMetadata,
+            canonicalAuthorityUrlComponents.HostNameAndPort
+        );
+
+        if (metadata) {
+            return metadata.aliases;
+        }
+    }
+
+    return null;
+}
+
+/**
+ * Searches instance discovery network response for the entry that contains the host in the aliases list
+ * @param response
+ * @param authority
+ */
+export function getCloudDiscoveryMetadataFromNetworkResponse(
+    response: CloudDiscoveryMetadata[],
+    authority: string
+): CloudDiscoveryMetadata | null {
+    for (let i = 0; i < response.length; i++) {
+        const metadata = response[i];
+        if (metadata.aliases.includes(authority)) {
+            return metadata;
+        }
+    }
+
+    return null;
+}
+
+/**
+ * Get cloud discovery metadata for common authorities
+ */
+export function getCloudDiscoveryMetadataFromHardcodedValues(
+    canonicalAuthority: string
+): CloudDiscoveryMetadata | null {
+    const canonicalAuthorityUrlComponents = new UrlString(
+        canonicalAuthority
+    ).getUrlComponents();
+
+    if (canonicalAuthority in InstanceDiscoveryMetadata) {
+        const metadata = getCloudDiscoveryMetadataFromNetworkResponse(
+            InstanceDiscoveryMetadata[canonicalAuthority].metadata,
+            canonicalAuthorityUrlComponents.HostNameAndPort
+        );
+        return metadata;
+    }
+
+    return null;
+}

package/src/authority/AuthorityOptions.ts

@@ -6,6 +6,7 @@
 import { ProtocolMode } from "./ProtocolMode";
 import { OIDCOptions } from "./OIDCOptions";
 import { AzureRegionConfiguration } from "./AzureRegionConfiguration";
+import { CloudDiscoveryMetadata } from "./CloudDiscoveryMetadata";
 
 export type AuthorityOptions = {
     protocolMode: ProtocolMode;
@@ -15,6 +16,14 @@ export type AuthorityOptions = {
     authorityMetadata: string;
     skipAuthorityMetadataCache?: boolean;
     azureRegionConfiguration?: AzureRegionConfiguration;
+    authority?: string;
+};
+
+export type StaticAuthorityOptions = Partial<
+    Pick<AuthorityOptions, "knownAuthorities">
+> & {
+    canonicalAuthority?: string;
+    cloudDiscoveryMetadata?: CloudDiscoveryMetadata[];
 };
 
 export const AzureCloudInstance = {