@azure/msal-common 16.11.3 → 16.13.0

package/lib/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "16.11.3",
+  "version": "16.13.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/authority/AuthorityMetadata.ts

@@ -19,10 +19,7 @@ type RawMetadata = {
 // Build endpoint metadata dynamically to avoid string duplication
 const endpointHosts: Array<{ host: string; issuerHost?: string }> = [
     { host: "login.microsoftonline.com" },
-    {
-        host: "login.chinacloudapi.cn",
-        issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
-    },
+    { host: "login.partner.microsoftonline.cn" },
     { host: "login.microsoftonline.us" },
     { host: "login.sovcloud-identity.fr" },
     { host: "login.sovcloud-identity.de" },

package/src/cache/CacheManager.ts

@@ -38,6 +38,7 @@ import { ServerTelemetryEntity } from "./entities/ServerTelemetryEntity.js";
 import { ThrottlingEntity } from "./entities/ThrottlingEntity.js";
 import { ICacheManager } from "./interface/ICacheManager.js";
 import * as AccountEntityUtils from "./utils/AccountEntityUtils.js";
+import * as CacheHelpers from "./utils/CacheHelpers.js";
 import {
     AccountFilter,
     AppMetadataCache,
@@ -125,14 +126,17 @@ export abstract class CacheManager implements ICacheManager {
     ): AccessTokenEntity | null;
 
     /**
-     * set accessToken entity to the platform cache
-     * @param accessToken
-     * @param correlationId
+     * Set accessToken entity to the platform cache
+     * @param accessToken - the access token entity to cache
+     * @param correlationId - unique identifier for the request
+     * @param kmsi - keep me signed in flag
+     * @param additionalCacheKeyHash - hash of additionalCacheKeyComponents for credential key generation
      */
     abstract setAccessTokenCredential(
         accessToken: AccessTokenEntity,
         correlationId: string,
-        kmsi: boolean
+        kmsi: boolean,
+        additionalCacheKeyHash?: string
     ): Promise<void>;
 
     /**
@@ -268,8 +272,12 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * Returns credential cache key from the entity
      * @param credential
+     * @param additionalCacheKeyHash - optional precomputed hash of additionalCacheKeyComponents
      */
-    abstract generateCredentialKey(credential: CredentialEntity): string;
+    abstract generateCredentialKey(
+        credential: CredentialEntity,
+        additionalCacheKeyHash?: string
+    ): string;
 
     /**
      * Returns the account cache key from the account info
@@ -673,13 +681,25 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * saves access token credential
-     * @param credential
+     * @param credential - the access token entity to save
+     * @param correlationId - unique identifier for the request
+     * @param kmsi - keep me signed in flag
      */
     private async saveAccessToken(
         credential: AccessTokenEntity,
         correlationId: string,
         kmsi: boolean
     ): Promise<void> {
+        // Compute hash from components on the entity itself — no need to thread externally.
+        let additionalCacheKeyHash: string | undefined;
+        if (
+            credential.additionalCacheKeyComponents &&
+            Object.keys(credential.additionalCacheKeyComponents).length > 0
+        ) {
+            additionalCacheKeyHash = await this.cryptoImpl.hashString(
+                JSON.stringify(credential.additionalCacheKeyComponents)
+            );
+        }
         const accessTokenFilter: CredentialFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -724,7 +744,12 @@ export abstract class CacheManager implements ICacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId, kmsi);
+        await this.setAccessTokenCredential(
+            credential,
+            correlationId,
+            kmsi,
+            additionalCacheKeyHash
+        );
     }
 
     /**
@@ -884,19 +909,9 @@ export abstract class CacheManager implements ICacheManager {
             entity.credentialType ===
             Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
         ) {
-            if (
-                !!filter.tokenType &&
-                !this.matchTokenType(entity, filter.tokenType)
-            ) {
+            if (!this.matchAccessTokenWithAuthScheme(entity, filter)) {
                 return false;
             }
-
-            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-            if (filter.tokenType === Constants.AuthenticationScheme.SSH) {
-                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
-                    return false;
-                }
-            }
         }
 
         // Additional cache key components matching (bidirectional isolation)
@@ -1345,6 +1360,15 @@ export abstract class CacheManager implements ICacheManager {
                 ? Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
                 : Constants.CredentialType.ACCESS_TOKEN;
 
+        const attributeTokenPartition = CacheHelpers.serializeAttributeTokens(
+            request.attributeTokens
+        );
+        const additionalCacheKeyComponents = attributeTokenPartition
+            ? {
+                  attribute_tokens: attributeTokenPartition,
+              }
+            : undefined;
+
         const accessTokenFilter: CredentialFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -1353,13 +1377,18 @@ export abstract class CacheManager implements ICacheManager {
             realm: targetRealm || account.tenantId,
             target: scopes,
             tokenType: authScheme,
-            keyId: request.sshKid,
+            keyId:
+                authScheme === Constants.AuthenticationScheme.SSH
+                    ? request.sshKid
+                    : undefined,
+            additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
 
         const accessTokenKeys =
             (tokenKeys && tokenKeys.accessToken) ||
             this.getTokenKeys().accessToken;
         const accessTokens: AccessTokenEntity[] = [];
+        const matchedKeys: string[] = [];
 
         accessTokenKeys.forEach((key) => {
             // Validate key
@@ -1381,27 +1410,24 @@ export abstract class CacheManager implements ICacheManager {
                     )
                 ) {
                     accessTokens.push(accessToken);
+                    matchedKeys.push(key);
                 }
             }
         });
 
-        const numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
+        if (accessTokens.length < 1) {
             this.commonLogger.info(
                 "CacheManager:getAccessToken - No token found",
                 correlationId
             );
             return null;
-        } else if (numAccessTokens > 1) {
+        } else if (accessTokens.length > 1) {
             this.commonLogger.info(
                 "CacheManager:getAccessToken - Multiple access tokens found, clearing them",
                 correlationId
             );
-            accessTokens.forEach((accessToken) => {
-                this.removeAccessToken(
-                    this.generateCredentialKey(accessToken),
-                    correlationId
-                );
+            matchedKeys.forEach((key) => {
+                this.removeAccessToken(key, correlationId);
             });
             this.performanceClient.addFields(
                 { multiMatchedAT: accessTokens.length },
@@ -1937,7 +1963,47 @@ export abstract class CacheManager implements ICacheManager {
         entity: CredentialEntity,
         tokenType: Constants.AuthenticationScheme
     ): boolean {
-        return !!(entity.tokenType && entity.tokenType === tokenType);
+        return !!(
+            entity.tokenType &&
+            entity.tokenType.toLowerCase() === tokenType.toLowerCase()
+        );
+    }
+
+    private matchAccessTokenWithAuthScheme(
+        entity: CredentialEntity,
+        filter: CredentialFilter
+    ): boolean {
+        const normalizedFilterTokenType = (
+            filter.tokenType as string | undefined
+        )?.toLowerCase();
+
+        if (
+            !!filter.tokenType &&
+            !this.matchTokenType(entity, filter.tokenType)
+        ) {
+            return false;
+        }
+
+        switch (normalizedFilterTokenType) {
+            case "dpop":
+                return this.matchKeyBoundAccessToken(entity, filter, true);
+            case Constants.AuthenticationScheme.SSH:
+                return this.matchKeyBoundAccessToken(entity, filter, false);
+            default:
+                return true;
+        }
+    }
+
+    private matchKeyBoundAccessToken(
+        entity: CredentialEntity,
+        filter: CredentialFilter,
+        requireKeyId: boolean
+    ): boolean {
+        if (!filter.keyId) {
+            return !requireKeyId;
+        }
+
+        return this.matchKeyId(entity, filter.keyId);
     }
 
     /**
@@ -2113,7 +2179,12 @@ export class DefaultStorageClass extends CacheManager {
             ""
         );
     }
-    generateCredentialKey(): string {
+    /* eslint-disable @typescript-eslint/no-unused-vars */
+    generateCredentialKey(
+        _credential: CredentialEntity,
+        _hash?: string
+    ): string {
+        /* eslint-enable @typescript-eslint/no-unused-vars */
         throw createClientAuthError(
             ClientAuthErrorCodes.methodNotImplemented,
             ""

package/src/cache/interface/ICacheManager.ts

@@ -69,14 +69,17 @@ export interface ICacheManager {
     ): AccessTokenEntity | null;
 
     /**
-     * set idToken entity to the platform cache
-     * @param accessToken
-     * @param correlationId
+     * set accessToken entity to the platform cache
+     * @param accessToken - the access token entity to cache
+     * @param correlationId - unique identifier for the request
+     * @param kmsi - keep me signed in flag
+     * @param additionalCacheKeyHash - optional precomputed hash of additionalCacheKeyComponents used in key generation
      */
     setAccessTokenCredential(
         accessToken: AccessTokenEntity,
         correlationId: string,
-        kmsi: boolean
+        kmsi: boolean,
+        additionalCacheKeyHash?: string
     ): Promise<void>;
 
     /**

package/src/cache/utils/CacheHelpers.ts

@@ -98,6 +98,7 @@ export function createAccessTokenEntity(
         atEntity.refreshOn = refreshOn.toString();
     }
 
+    const normalizedTokenType = atEntity.tokenType?.toLowerCase();
     /*
      * Create Access Token With Auth Scheme instead of regular access token
      * Cast to lower to handle "bearer" from ADFS
@@ -108,7 +109,7 @@ export function createAccessTokenEntity(
     ) {
         atEntity.credentialType =
             Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
+        switch (normalizedTokenType) {
             case Constants.AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
                 const tokenClaims: TokenClaims | null = extractTokenClaims(
@@ -124,6 +125,15 @@ export function createAccessTokenEntity(
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
+            case "dpop":
+                if (!keyId) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.keyIdMissing,
+                        correlationId
+                    );
+                }
+                atEntity.keyId = keyId;
+                break;
             case Constants.AuthenticationScheme.SSH:
                 atEntity.keyId = keyId;
         }
@@ -390,3 +400,20 @@ export function isAuthorityMetadataExpired(
 ): boolean {
     return metadata.expiresAt <= TimeUtils.nowSeconds();
 }
+
+/**
+ * Serialize attribute tokens synchronously (sort and join).
+ * This is a sync-only operation for use at request construction time.
+ * @param attributeTokens - array of tokens
+ * @returns serialized partition string or undefined if no tokens
+ */
+export function serializeAttributeTokens(
+    attributeTokens?: Array<string>
+): string | undefined {
+    if (!attributeTokens || attributeTokens.length === 0) {
+        return undefined;
+    }
+
+    // Serialize: sort and join tokens
+    return [...attributeTokens].sort().join(" ");
+}

package/src/client/AuthorizationCodeClient.ts

@@ -168,7 +168,8 @@ export class AuthorizationCodeClient {
             this.logger,
             this.performanceClient,
             this.config.serializableCache,
-            this.config.persistencePlugin
+            this.config.persistencePlugin,
+            this.config.tokenBindingKeyManager
         );
 
         // Validate response. This function throws a server error if an error is returned by the server.
@@ -344,6 +345,19 @@ export class AuthorizationCodeClient {
 
         RequestParameterBuilder.addResource(parameters, request.resource);
 
+        if (request.attributeTokens) {
+            RequestParameterBuilder.addAttributeTokens(
+                parameters,
+                request.attributeTokens
+            );
+        }
+        this.performanceClient?.addFields(
+            {
+                hasAttributeTokens: !!request.attributeTokens?.length,
+            },
+            request.correlationId
+        );
+
         // add code: user set, not validated
         RequestParameterBuilder.addAuthorizationCode(parameters, request.code);
 
@@ -409,6 +423,7 @@ export class AuthorizationCodeClient {
         ) {
             const popTokenGenerator = new PopTokenGenerator(
                 this.cryptoUtils,
+                this.config.tokenBindingKeyManager,
                 this.performanceClient
             );
 

package/src/client/RefreshTokenClient.ts

@@ -139,7 +139,8 @@ export class RefreshTokenClient {
             this.logger,
             this.performanceClient,
             this.config.serializableCache,
-            this.config.persistencePlugin
+            this.config.persistencePlugin,
+            this.config.tokenBindingKeyManager
         );
         responseHandler.validateTokenResponse(
             response.body,
@@ -445,6 +446,19 @@ export class RefreshTokenClient {
             request.refreshToken
         );
 
+        if (request.attributeTokens) {
+            RequestParameterBuilder.addAttributeTokens(
+                parameters,
+                request.attributeTokens
+            );
+        }
+        this.performanceClient?.addFields(
+            {
+                hasAttributeTokens: !!request.attributeTokens?.length,
+            },
+            request.correlationId
+        );
+
         if (this.config.clientCredentials.clientSecret) {
             RequestParameterBuilder.addClientSecret(
                 parameters,
@@ -475,6 +489,7 @@ export class RefreshTokenClient {
         ) {
             const popTokenGenerator = new PopTokenGenerator(
                 this.cryptoUtils,
+                this.config.tokenBindingKeyManager,
                 this.performanceClient
             );
 

package/src/client/SilentFlowClient.ts

@@ -263,7 +263,10 @@ export class SilentFlowClient {
             true,
             request,
             this.performanceClient,
-            idTokenClaims
+            {
+                idTokenClaims,
+                tokenBindingKeyManager: this.config.tokenBindingKeyManager,
+            }
         );
     }
 }

package/src/config/ClientConfiguration.ts

@@ -5,6 +5,10 @@
 
 import { INetworkModule } from "../network/INetworkModule.js";
 import { DEFAULT_CRYPTO_IMPLEMENTATION, ICrypto } from "../crypto/ICrypto.js";
+import {
+    DEFAULT_TOKEN_BINDING_KEY_MANAGER,
+    ITokenBindingKeyManager,
+} from "../crypto/ITokenBindingKeyManager.js";
 import { ILoggerCallback, Logger, LogLevel } from "../logger/Logger.js";
 import {
     DEFAULT_COMMON_TENANT,
@@ -32,6 +36,7 @@ import { StubPerformanceClient } from "../telemetry/performance/StubPerformanceC
  * This object allows you to configure important elements of MSAL functionality:
  * - authOptions                - Authentication for application
  * - cryptoInterface            - Implementation of crypto functions
+ * - tokenBindingKeyManager     - Implementation of token-binding key lifecycle functions
  * - libraryInfo                - Library metadata
  * - telemetry                  - Telemetry options and data
  * - loggerOptions              - Logging for application
@@ -48,6 +53,7 @@ export type ClientConfiguration = {
     storageInterface?: CacheManager;
     networkInterface?: INetworkModule;
     cryptoInterface?: ICrypto;
+    tokenBindingKeyManager?: ITokenBindingKeyManager;
     clientCredentials?: ClientCredentials;
     libraryInfo?: LibraryInfo;
     telemetry?: TelemetryOptions;
@@ -66,6 +72,7 @@ export type CommonClientConfiguration = {
     storageInterface: CacheManager;
     networkInterface: INetworkModule;
     cryptoInterface: Required<ICrypto>;
+    tokenBindingKeyManager: ITokenBindingKeyManager;
     libraryInfo: LibraryInfo;
     telemetry: Required<TelemetryOptions>;
     serverTelemetryManager: ServerTelemetryManager | null;
@@ -226,6 +233,7 @@ export function buildClientConfiguration({
     storageInterface: storageImplementation,
     networkInterface: networkImplementation,
     cryptoInterface: cryptoImplementation,
+    tokenBindingKeyManager: tokenBindingKeyManager,
     clientCredentials: clientCredentials,
     libraryInfo: libraryInfo,
     telemetry: telemetry,
@@ -253,6 +261,8 @@ export function buildClientConfiguration({
         networkInterface:
             networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        tokenBindingKeyManager:
+            tokenBindingKeyManager || DEFAULT_TOKEN_BINDING_KEY_MANAGER,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },

package/src/constants/AADServerParamKeys.ts

@@ -68,3 +68,4 @@ export const USER_FEDERATED_IDENTITY_CREDENTIAL =
 export const USERNAME = "username";
 export const USER_ID = "user_id";
 export const FMI_PATH = "fmi_path";
+export const ATTRIBUTE_TOKENS = "attribute_tokens";

package/src/crypto/DpopProofGenerator.ts

@@ -4,11 +4,13 @@
  */
 
 import { ICrypto, JsonWebTokenAlgorithms } from "./ICrypto.js";
+import { ITokenBindingKeyManager } from "./ITokenBindingKeyManager.js";
 import * as TimeUtils from "../utils/TimeUtils.js";
 import {
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError.js";
+import { JoseHeader } from "./JoseHeader.js";
 
 /**
  * RFC 9449 DPoP proof JWT payload claims.
@@ -44,51 +46,21 @@ export type DpopResourceProofParams = {
     nonce?: string;
 };
 
-/**
- * Public JWK embedded in the DPoP proof header.
- * @internal
- */
-export type DpopPublicJwk = Record<string, unknown>;
-
-/**
- * RFC 9449 DPoP proof JWT header.
- * @internal
- */
-export type DpopProofHeader = {
-    typ: typeof DPOP_JWT_HEADER_TYPE;
-    alg: string;
-    jwk: DpopPublicJwk;
-};
-
-/**
- * Signs the ASCII DPoP JWT signing input with the declared JOSE alg
- * and returns a base64url-encoded signature.
- * @internal
- */
-export type DpopProofSigner = {
-    alg: string;
-    sign: (signingInput: string, correlationId: string) => Promise<string>;
-};
-
-/**
- * Parameters shared by token and resource DPoP proof generation.
- * @internal
- */
-export type DpopProofGenerationParams = {
-    publicJwk: DpopPublicJwk;
-    signer: DpopProofSigner;
-};
-
 const DPOP_HTM_REGEX = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-export const DPOP_JWT_HEADER_TYPE = "dpop+jwt";
-export const DPOP_JWT_HEADER_ALGORITHM = JsonWebTokenAlgorithms.ES256;
-
-function buildProofHeader(params: DpopProofGenerationParams): DpopProofHeader {
-    return {
-        typ: DPOP_JWT_HEADER_TYPE,
-        alg: params.signer.alg,
-        jwk: params.publicJwk,
-    };
+const DPOP_TOKEN_BINDING_KEY_TYPE = "dpop";
+const DPOP_JWT_HEADER_ALGORITHM = JsonWebTokenAlgorithms.ES256;
+
+function buildProofHeader(
+    publicJwk: JsonWebKey,
+    correlationId: string
+): JoseHeader {
+    return JoseHeader.getDpopHeader(
+        {
+            alg: DPOP_JWT_HEADER_ALGORITHM,
+            jwk: publicJwk,
+        },
+        correlationId
+    );
 }
 
 function normalizeHtm(htm: string, correlationId: string): string {
@@ -149,9 +121,26 @@ function normalizeHtu(url: string, correlationId: string): string {
  */
 export class DpopProofGenerator {
     private cryptoUtils: ICrypto;
+    private tokenBindingKeyManager: ITokenBindingKeyManager;
 
-    constructor(cryptoUtils: ICrypto) {
+    constructor(
+        cryptoUtils: ICrypto,
+        tokenBindingKeyManager: ITokenBindingKeyManager
+    ) {
         this.cryptoUtils = cryptoUtils;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
+    }
+
+    /**
+     * Provisions a fresh DPoP key and returns the RFC 7638 JWK thumbprint used
+     * as `dpop_jkt`.
+     */
+    async generateJkt(correlationId: string = ""): Promise<string> {
+        return this.tokenBindingKeyManager.provisionTokenBindingKey({
+            tokenBindingKeyType: DPOP_TOKEN_BINDING_KEY_TYPE,
+            tokenBindingKeyAlgorithm: DPOP_JWT_HEADER_ALGORITHM,
+            correlationId,
+        });
     }
 
     /**
@@ -180,12 +169,13 @@ export class DpopProofGenerator {
      * Builds and signs a compact DPoP proof JWT for a token-endpoint request.
      */
     async generateTokenProof(
-        params: DpopTokenProofParams & DpopProofGenerationParams,
+        params: DpopTokenProofParams,
+        keyId: string,
         correlationId: string = ""
     ): Promise<string> {
         return this.generateProof(
             this.buildTokenProofClaims(params, correlationId),
-            params,
+            keyId,
             correlationId
         );
     }
@@ -218,30 +208,33 @@ export class DpopProofGenerator {
      * Builds and signs a compact DPoP proof JWT for a resource request.
      */
     async generateResourceProof(
-        params: DpopResourceProofParams & DpopProofGenerationParams,
+        params: DpopResourceProofParams,
+        keyId: string,
         correlationId: string = ""
     ): Promise<string> {
         return this.generateProof(
             this.buildResourceProofClaims(params, correlationId),
-            params,
+            keyId,
             correlationId
         );
     }
 
     private async generateProof(
         claims: DpopProofClaims,
-        params: DpopProofGenerationParams,
+        keyId: string,
         correlationId: string
     ): Promise<string> {
-        const encodedHeader = this.cryptoUtils.base64UrlEncode(
-            JSON.stringify(buildProofHeader(params))
-        );
-        const encodedClaims = this.cryptoUtils.base64UrlEncode(
-            JSON.stringify(claims)
+        const publicJwk =
+            await this.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(
+                keyId,
+                correlationId
+            );
+
+        return this.cryptoUtils.signTokenBindingJwt(
+            buildProofHeader(publicJwk, correlationId),
+            claims,
+            keyId,
+            correlationId
         );
-        const signingInput = `${encodedHeader}.${encodedClaims}`;
-        const signature = await params.signer.sign(signingInput, correlationId);
-
-        return `${signingInput}.${signature}`;
     }
 }