@azure/msal-common 15.13.0 → 16.0.0-alpha.0

package/src/cache/utils/AccountEntityUtils.ts

@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import * as Constants from "../../utils/Constants.js";
+import { Authority } from "../../authority/Authority.js";
+import { ICrypto } from "../../crypto/ICrypto.js";
+import { ClientInfo, buildClientInfo } from "../../account/ClientInfo.js";
+import {
+    AccountInfo,
+    TenantProfile,
+    buildTenantProfile,
+} from "../../account/AccountInfo.js";
+import {
+    createClientAuthError,
+    ClientAuthErrorCodes,
+} from "../../error/ClientAuthError.js";
+import { AuthorityType } from "../../authority/AuthorityType.js";
+import { Logger } from "../../logger/Logger.js";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../../account/TokenClaims.js";
+import { ProtocolMode } from "../../authority/ProtocolMode.js";
+import { AccountEntity } from "../entities/AccountEntity.js";
+
+/**
+ * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ */
+export function generateAccountId(accountEntity: AccountEntity): string {
+    const accountId: Array<string> = [
+        accountEntity.homeAccountId,
+        accountEntity.environment,
+    ];
+    return accountId.join(Constants.CACHE_KEY_SEPARATOR).toLowerCase();
+}
+
+/**
+ * Returns the AccountInfo interface for this account.
+ */
+export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
+    return {
+        homeAccountId: accountEntity.homeAccountId,
+        environment: accountEntity.environment,
+        tenantId: accountEntity.realm,
+        username: accountEntity.username,
+        localAccountId: accountEntity.localAccountId,
+        loginHint: accountEntity.loginHint,
+        name: accountEntity.name,
+        nativeAccountId: accountEntity.nativeAccountId,
+        authorityType: accountEntity.authorityType,
+        // Deserialize tenant profiles array into a Map
+        tenantProfiles: new Map(
+            (accountEntity.tenantProfiles || []).map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })
+        ),
+    };
+}
+
+/**
+ * Returns true if the account entity is in single tenant format (outdated), false otherwise
+ */
+export function isSingleTenant(accountEntity: AccountEntity): boolean {
+    return !accountEntity.tenantProfiles;
+}
+
+/**
+ * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+ * @param accountDetails
+ */
+export function createAccountEntity(
+    accountDetails: {
+        homeAccountId: string;
+        idTokenClaims?: TokenClaims;
+        clientInfo?: string;
+        cloudGraphHostName?: string;
+        msGraphHost?: string;
+        environment?: string;
+        nativeAccountId?: string;
+        tenantProfiles?: Array<TenantProfile>;
+    },
+    authority: Authority,
+    base64Decode?: (input: string) => string
+): AccountEntity {
+    let authorityType;
+    if (authority.authorityType === AuthorityType.Adfs) {
+        authorityType = Constants.CACHE_ACCOUNT_TYPE_ADFS;
+    } else if (authority.protocolMode === ProtocolMode.OIDC) {
+        authorityType = Constants.CACHE_ACCOUNT_TYPE_GENERIC;
+    } else {
+        authorityType = Constants.CACHE_ACCOUNT_TYPE_MSSTS;
+    }
+
+    let clientInfo: ClientInfo | undefined;
+
+    if (accountDetails.clientInfo && base64Decode) {
+        clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+    }
+
+    const env =
+        accountDetails.environment ||
+        (authority && authority.getPreferredCache());
+
+    if (!env) {
+        throw createClientAuthError(
+            ClientAuthErrorCodes.invalidCacheEnvironment
+        );
+    }
+
+    /*
+     * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+     * In most cases it will contain a single email. This field should not be relied upon if a custom
+     * policy is configured to return more than 1 email.
+     */
+    const preferredUsername =
+        accountDetails.idTokenClaims?.preferred_username ||
+        accountDetails.idTokenClaims?.upn;
+    const email = accountDetails.idTokenClaims?.emails
+        ? accountDetails.idTokenClaims.emails[0]
+        : null;
+
+    const username = preferredUsername || email || "";
+
+    const loginHint = accountDetails.idTokenClaims?.login_hint;
+
+    const realm =
+        clientInfo?.utid ||
+        getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+        ""; // non-AAD scenarios can have empty realm
+    // How do you account for MSA CID here?
+    const localAccountId =
+        clientInfo?.uid ||
+        accountDetails.idTokenClaims?.oid ||
+        accountDetails.idTokenClaims?.sub ||
+        "";
+    let tenantProfiles;
+    if (accountDetails.tenantProfiles) {
+        tenantProfiles = accountDetails.tenantProfiles;
+    } else {
+        const tenantProfile = buildTenantProfile(
+            accountDetails.homeAccountId,
+            localAccountId,
+            realm,
+            accountDetails.idTokenClaims
+        );
+        tenantProfiles = [tenantProfile];
+    }
+
+    return {
+        homeAccountId: accountDetails.homeAccountId,
+        environment: env,
+        realm: realm,
+        localAccountId: localAccountId,
+        username: username,
+        authorityType: authorityType,
+        loginHint: loginHint,
+        clientInfo: accountDetails.clientInfo,
+        name: accountDetails.idTokenClaims?.name || "",
+        lastModificationTime: undefined,
+        lastModificationApp: undefined,
+        cloudGraphHostName: accountDetails.cloudGraphHostName,
+        msGraphHost: accountDetails.msGraphHost,
+        nativeAccountId: accountDetails.nativeAccountId,
+        tenantProfiles: tenantProfiles,
+    } as AccountEntity;
+}
+
+/**
+ * Creates an AccountEntity object from AccountInfo
+ * @param accountInfo
+ * @param cloudGraphHostName
+ * @param msGraphHost
+ * @returns
+ */
+export function createAccountEntityFromAccountInfo(
+    accountInfo: AccountInfo,
+    cloudGraphHostName?: string,
+    msGraphHost?: string
+): AccountEntity {
+    return {
+        authorityType:
+            accountInfo.authorityType || Constants.CACHE_ACCOUNT_TYPE_GENERIC,
+        homeAccountId: accountInfo.homeAccountId,
+        localAccountId: accountInfo.localAccountId,
+        nativeAccountId: accountInfo.nativeAccountId,
+        realm: accountInfo.tenantId,
+        environment: accountInfo.environment,
+        username: accountInfo.username,
+        loginHint: accountInfo.loginHint,
+        name: accountInfo.name,
+        cloudGraphHostName: cloudGraphHostName,
+        msGraphHost: msGraphHost,
+        tenantProfiles: Array.from(accountInfo.tenantProfiles?.values() || []),
+    } as AccountEntity;
+}
+
+/**
+ * Generate HomeAccountId from server response
+ * @param serverClientInfo
+ * @param authType
+ */
+export function generateHomeAccountId(
+    serverClientInfo: string,
+    authType: AuthorityType,
+    logger: Logger,
+    cryptoObj: ICrypto,
+    correlationId: string,
+    idTokenClaims?: TokenClaims
+): string {
+    // since ADFS/DSTS do not have tid and does not set client_info
+    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
+        // for cases where there is clientInfo
+        if (serverClientInfo) {
+            try {
+                const clientInfo = buildClientInfo(
+                    serverClientInfo,
+                    cryptoObj.base64Decode
+                );
+                if (clientInfo.uid && clientInfo.utid) {
+                    return `${clientInfo.uid}.${clientInfo.utid}`;
+                }
+            } catch (e) {}
+        }
+        logger.warning("No client info in response", correlationId);
+    }
+
+    // default to "sub" claim
+    return idTokenClaims?.sub || "";
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isAccountEntity(entity: object): entity is AccountEntity {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("localAccountId") &&
+        entity.hasOwnProperty("username") &&
+        entity.hasOwnProperty("authorityType")
+    );
+}
+
+/**
+ * Helper function to determine whether 2 accountInfo objects represent the same account
+ * @param accountA
+ * @param accountB
+ * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+ */
+export function accountInfoIsEqual(
+    accountA: AccountInfo | null,
+    accountB: AccountInfo | null,
+    compareClaims?: boolean
+): boolean {
+    if (!accountA || !accountB) {
+        return false;
+    }
+
+    let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
+    if (compareClaims) {
+        const accountAClaims = (accountA.idTokenClaims || {}) as TokenClaims;
+        const accountBClaims = (accountB.idTokenClaims || {}) as TokenClaims;
+
+        // issued at timestamp and nonce are expected to change each time a new id token is acquired
+        claimsMatch =
+            accountAClaims.iat === accountBClaims.iat &&
+            accountAClaims.nonce === accountBClaims.nonce;
+    }
+
+    return (
+        accountA.homeAccountId === accountB.homeAccountId &&
+        accountA.localAccountId === accountB.localAccountId &&
+        accountA.username === accountB.username &&
+        accountA.tenantId === accountB.tenantId &&
+        accountA.environment === accountB.environment &&
+        accountA.nativeAccountId === accountB.nativeAccountId &&
+        claimsMatch
+    );
+}

package/src/cache/utils/CacheHelpers.ts

@@ -11,15 +11,7 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../../error/ClientAuthError.js";
-import {
-    APP_METADATA,
-    AUTHORITY_METADATA_CONSTANTS,
-    AuthenticationScheme,
-    CredentialType,
-    SERVER_TELEM_CONSTANTS,
-    Separators,
-    ThrottlingConstants,
-} from "../../utils/Constants.js";
+import * as Constants from "../../utils/Constants.js";
 import * as TimeUtils from "../../utils/TimeUtils.js";
 import { AccessTokenEntity } from "../entities/AccessTokenEntity.js";
 import { AppMetadataEntity } from "../entities/AppMetadataEntity.js";
@@ -43,7 +35,7 @@ export function createIdTokenEntity(
     tenantId: string
 ): IdTokenEntity {
     const idTokenEntity: IdTokenEntity = {
-        credentialType: CredentialType.ID_TOKEN,
+        credentialType: Constants.CredentialType.ID_TOKEN,
         homeAccountId: homeAccountId,
         environment: environment,
         clientId: clientId,
@@ -77,15 +69,13 @@ export function createAccessTokenEntity(
     extExpiresOn: number,
     base64Decode: (input: string) => string,
     refreshOn?: number,
-    tokenType?: AuthenticationScheme,
+    tokenType?: Constants.AuthenticationScheme,
     userAssertionHash?: string,
-    keyId?: string,
-    requestedClaims?: string,
-    requestedClaimsHash?: string
+    keyId?: string
 ): AccessTokenEntity {
     const atEntity: AccessTokenEntity = {
         homeAccountId: homeAccountId,
-        credentialType: CredentialType.ACCESS_TOKEN,
+        credentialType: Constants.CredentialType.ACCESS_TOKEN,
         secret: accessToken,
         cachedAt: TimeUtils.nowSeconds().toString(),
         expiresOn: expiresOn.toString(),
@@ -94,7 +84,7 @@ export function createAccessTokenEntity(
         clientId: clientId,
         realm: tenantId,
         target: scopes,
-        tokenType: tokenType || AuthenticationScheme.BEARER,
+        tokenType: tokenType || Constants.AuthenticationScheme.BEARER,
         lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
     };
 
@@ -106,22 +96,18 @@ export function createAccessTokenEntity(
         atEntity.refreshOn = refreshOn.toString();
     }
 
-    if (requestedClaims) {
-        atEntity.requestedClaims = requestedClaims;
-        atEntity.requestedClaimsHash = requestedClaimsHash;
-    }
-
     /*
      * Create Access Token With Auth Scheme instead of regular access token
      * Cast to lower to handle "bearer" from ADFS
      */
     if (
         atEntity.tokenType?.toLowerCase() !==
-        AuthenticationScheme.BEARER.toLowerCase()
+        Constants.AuthenticationScheme.BEARER.toLowerCase()
     ) {
-        atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        atEntity.credentialType =
+            Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
         switch (atEntity.tokenType) {
-            case AuthenticationScheme.POP:
+            case Constants.AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
                 const tokenClaims: TokenClaims | null = extractTokenClaims(
                     accessToken,
@@ -134,7 +120,7 @@ export function createAccessTokenEntity(
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
-            case AuthenticationScheme.SSH:
+            case Constants.AuthenticationScheme.SSH:
                 atEntity.keyId = keyId;
         }
     }
@@ -159,7 +145,7 @@ export function createRefreshTokenEntity(
     expiresOn?: number
 ): RefreshTokenEntity {
     const rtEntity: RefreshTokenEntity = {
-        credentialType: CredentialType.REFRESH_TOKEN,
+        credentialType: Constants.CredentialType.REFRESH_TOKEN,
         homeAccountId: homeAccountId,
         environment: environment,
         clientId: clientId,
@@ -207,9 +193,9 @@ export function isAccessTokenEntity(
         isCredentialEntity(entity) &&
         entity.hasOwnProperty("realm") &&
         entity.hasOwnProperty("target") &&
-        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+        (entity["credentialType"] === Constants.CredentialType.ACCESS_TOKEN ||
             entity["credentialType"] ===
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME)
+                Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME)
     );
 }
 
@@ -225,7 +211,7 @@ export function isIdTokenEntity(entity: object): entity is IdTokenEntity {
     return (
         isCredentialEntity(entity) &&
         entity.hasOwnProperty("realm") &&
-        entity["credentialType"] === CredentialType.ID_TOKEN
+        entity["credentialType"] === Constants.CredentialType.ID_TOKEN
     );
 }
 
@@ -242,7 +228,7 @@ export function isRefreshTokenEntity(
 
     return (
         isCredentialEntity(entity) &&
-        entity["credentialType"] === CredentialType.REFRESH_TOKEN
+        entity["credentialType"] === Constants.CredentialType.REFRESH_TOKEN
     );
 }
 
@@ -253,7 +239,7 @@ export function isRefreshTokenEntity(
  */
 export function isServerTelemetryEntity(key: string, entity?: object): boolean {
     const validateKey: boolean =
-        key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
+        key.indexOf(Constants.SERVER_TELEM_CACHE_KEY) === 0;
     let validateEntity: boolean = true;
 
     if (entity) {
@@ -274,7 +260,7 @@ export function isServerTelemetryEntity(key: string, entity?: object): boolean {
 export function isThrottlingEntity(key: string, entity?: object): boolean {
     let validateKey: boolean = false;
     if (key) {
-        validateKey = key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
+        validateKey = key.indexOf(Constants.THROTTLING_PREFIX) === 0;
     }
 
     let validateEntity: boolean = true;
@@ -293,12 +279,12 @@ export function generateAppMetadataKey({
     clientId,
 }: AppMetadataEntity): string {
     const appMetaDataKeyArray: Array<string> = [
-        APP_METADATA,
+        Constants.APP_METADATA,
         environment,
         clientId,
     ];
     return appMetaDataKeyArray
-        .join(Separators.CACHE_KEY_SEPARATOR)
+        .join(Constants.CACHE_KEY_SEPARATOR)
         .toLowerCase();
 }
 
@@ -312,7 +298,7 @@ export function isAppMetadataEntity(key: string, entity: object): boolean {
     }
 
     return (
-        key.indexOf(APP_METADATA) === 0 &&
+        key.indexOf(Constants.APP_METADATA) === 0 &&
         entity.hasOwnProperty("clientId") &&
         entity.hasOwnProperty("environment")
     );
@@ -331,7 +317,7 @@ export function isAuthorityMetadataEntity(
     }
 
     return (
-        key.indexOf(AUTHORITY_METADATA_CONSTANTS.CACHE_KEY) === 0 &&
+        key.indexOf(Constants.AUTHORITY_METADATA_CACHE_KEY) === 0 &&
         entity.hasOwnProperty("aliases") &&
         entity.hasOwnProperty("preferred_cache") &&
         entity.hasOwnProperty("preferred_network") &&
@@ -352,7 +338,7 @@ export function isAuthorityMetadataEntity(
 export function generateAuthorityMetadataExpiresAt(): number {
     return (
         TimeUtils.nowSeconds() +
-        AUTHORITY_METADATA_CONSTANTS.REFRESH_TIME_SECONDS
+        Constants.AUTHORITY_METADATA_REFRESH_TIME_SECONDS
     );
 }
 

package/src/cache/utils/CacheTypes.ts

@@ -87,7 +87,6 @@ export type CredentialFilter = {
     userAssertionHash?: string;
     tokenType?: AuthenticationScheme;
     keyId?: string;
-    requestedClaimsHash?: string;
 };
 
 /**

package/src/client/AuthorizationCodeClient.ts

@@ -8,12 +8,7 @@ import { CommonAuthorizationCodeRequest } from "../request/CommonAuthorizationCo
 import { Authority } from "../authority/Authority.js";
 import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
 import * as UrlUtils from "../utils/UrlUtils.js";
-import {
-    GrantType,
-    AuthenticationScheme,
-    Separators,
-    HeaderNames,
-} from "../utils/Constants.js";
+import * as Constants from "../utils/Constants.js";
 import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import {
     ClientConfiguration,
@@ -43,7 +38,7 @@ import {
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
-import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent.js";
+import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { invokeAsync } from "../utils/FunctionWrappers.js";
 import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
@@ -60,7 +55,7 @@ export class AuthorizationCodeClient extends BaseClient {
 
     constructor(
         configuration: ClientConfiguration,
-        performanceClient?: IPerformanceClient
+        performanceClient: IPerformanceClient
     ) {
         super(configuration, performanceClient);
         this.oidcDefaultScopes =
@@ -76,11 +71,6 @@ export class AuthorizationCodeClient extends BaseClient {
         request: CommonAuthorizationCodeRequest,
         authCodePayload?: AuthorizationCodePayload
     ): Promise<AuthenticationResult> {
-        this.performanceClient?.addQueueMeasurement(
-            PerformanceEvents.AuthClientAcquireToken,
-            request.correlationId
-        );
-
         if (!request.code) {
             throw createClientAuthError(
                 ClientAuthErrorCodes.requestCannotBeMade
@@ -97,20 +87,24 @@ export class AuthorizationCodeClient extends BaseClient {
         )(this.authority, request);
 
         // Retrieve requestId from response headers
-        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
+        const requestId =
+            response.headers?.[Constants.HeaderNames.X_MS_REQUEST_ID];
 
         const responseHandler = new ResponseHandler(
             this.config.authOptions.clientId,
             this.cacheManager,
             this.cryptoUtils,
             this.logger,
+            this.performanceClient,
             this.config.serializableCache,
-            this.config.persistencePlugin,
-            this.performanceClient
+            this.config.persistencePlugin
         );
 
         // Validate response. This function throws a server error if an error is returned by the server.
-        responseHandler.validateTokenResponse(response.body);
+        responseHandler.validateTokenResponse(
+            response.body,
+            request.correlationId
+        );
 
         return invokeAsync(
             responseHandler.handleServerTokenResponse.bind(responseHandler),
@@ -161,11 +155,6 @@ export class AuthorizationCodeClient extends BaseClient {
         authority: Authority,
         request: CommonAuthorizationCodeRequest
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        this.performanceClient?.addQueueMeasurement(
-            PerformanceEvents.AuthClientExecuteTokenRequest,
-            request.correlationId
-        );
-
         const queryParametersString = this.createTokenQueryParameters(request);
         const endpoint = UrlString.appendQueryString(
             authority.tokenEndpoint,
@@ -188,12 +177,13 @@ export class AuthorizationCodeClient extends BaseClient {
                     this.cryptoUtils.base64Decode
                 );
                 ccsCredential = {
-                    credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
+                    credential: `${clientInfo.uid}${Constants.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
                     type: CcsCredentialType.HOME_ACCOUNT_ID,
                 };
             } catch (e) {
                 this.logger.verbose(
-                    "Could not parse client info for CCS Header: " + e
+                    `Could not parse client info for CCS Header: '${e}'`,
+                    request.correlationId
                 );
             }
         }
@@ -212,14 +202,7 @@ export class AuthorizationCodeClient extends BaseClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(
-            endpoint,
-            requestBody,
-            headers,
-            thumbprint,
-            request.correlationId,
-            PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint
-        );
+        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
     }
 
     /**
@@ -229,11 +212,6 @@ export class AuthorizationCodeClient extends BaseClient {
     private async createTokenRequestBody(
         request: CommonAuthorizationCodeRequest
     ): Promise<string> {
-        this.performanceClient?.addQueueMeasurement(
-            PerformanceEvents.AuthClientCreateTokenRequestBody,
-            request.correlationId
-        );
-
         const parameters = new Map<string, string>();
 
         RequestParameterBuilder.addClientId(
@@ -326,11 +304,13 @@ export class AuthorizationCodeClient extends BaseClient {
 
         RequestParameterBuilder.addGrantType(
             parameters,
-            GrantType.AUTHORIZATION_CODE_GRANT
+            Constants.GrantType.AUTHORIZATION_CODE_GRANT
         );
         RequestParameterBuilder.addClientInfo(parameters);
 
-        if (request.authenticationScheme === AuthenticationScheme.POP) {
+        if (
+            request.authenticationScheme === Constants.AuthenticationScheme.POP
+        ) {
             const popTokenGenerator = new PopTokenGenerator(
                 this.cryptoUtils,
                 this.performanceClient
@@ -352,7 +332,9 @@ export class AuthorizationCodeClient extends BaseClient {
 
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
             RequestParameterBuilder.addPopToken(parameters, reqCnfData);
-        } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
+        } else if (
+            request.authenticationScheme === Constants.AuthenticationScheme.SSH
+        ) {
             if (request.sshJwk) {
                 RequestParameterBuilder.addSshJwk(parameters, request.sshJwk);
             } else {
@@ -382,12 +364,13 @@ export class AuthorizationCodeClient extends BaseClient {
                     this.cryptoUtils.base64Decode
                 );
                 ccsCred = {
-                    credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
+                    credential: `${clientInfo.uid}${Constants.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
                     type: CcsCredentialType.HOME_ACCOUNT_ID,
                 };
             } catch (e) {
                 this.logger.verbose(
-                    "Could not parse client info for CCS Header: " + e
+                    `Could not parse client info for CCS Header: '${e}'`,
+                    request.correlationId
                 );
             }
         } else {
@@ -408,8 +391,8 @@ export class AuthorizationCodeClient extends BaseClient {
                         );
                     } catch (e) {
                         this.logger.verbose(
-                            "Could not parse home account ID for CCS Header: " +
-                                e
+                            `Could not parse home account ID for CCS Header: '${e}'`,
+                            request.correlationId
                         );
                     }
                     break;
@@ -510,10 +493,6 @@ export class AuthorizationCodeClient extends BaseClient {
             RequestParameterBuilder.addInstanceAware(parameters);
         }
 
-        return UrlUtils.mapToQueryString(
-            parameters,
-            this.config.authOptions.encodeExtraQueryParams,
-            request.extraQueryParameters
-        );
+        return UrlUtils.mapToQueryString(parameters);
     }
 }