@azure/msal-common 16.9.0 → 16.11.0

package/src/account/AccountInfo.ts

@@ -4,6 +4,7 @@
  */
 
 import { TokenClaims } from "./TokenClaims.js";
+import { isKmsi } from "./AuthToken.js";
 
 export type DataBoundary = "EU" | "None";
 
@@ -45,6 +46,11 @@ export type AccountInfo = {
     authorityType?: string;
     tenantProfiles?: Map<string, TenantProfile>;
     dataBoundary?: DataBoundary;
+    /**
+     * Indicates whether the user selected "Keep Me Signed In" (KMSI) during authentication.
+     * Derived from the signin_state claim in the ID token.
+     */
+    kmsi?: boolean;
 };
 
 /**
@@ -52,7 +58,13 @@ export type AccountInfo = {
  */
 export type TenantProfile = Pick<
     AccountInfo,
-    "tenantId" | "localAccountId" | "name" | "username" | "loginHint" | "upn"
+    | "tenantId"
+    | "localAccountId"
+    | "name"
+    | "username"
+    | "loginHint"
+    | "upn"
+    | "nativeAccountId"
 > & {
     /**
      * - isHomeTenant           - True if this is the home tenant profile of the account, false if it's a guest tenant profile
@@ -88,6 +100,7 @@ export function tenantIdMatchesHomeTenant(
  * @param homeAccountId - Home account identifier for this account object
  * @param localAccountId - Local account identifer for this account object
  * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param nativeAccountId - Native account identifier for this tenant
  * @param idTokenClaims - Claims from the ID token
  * @returns
  */
@@ -95,6 +108,7 @@ export function buildTenantProfile(
     homeAccountId: string,
     localAccountId: string,
     tenantId: string,
+    nativeAccountId?: string,
     idTokenClaims?: TokenClaims
 ): TenantProfile {
     if (idTokenClaims) {
@@ -126,6 +140,7 @@ export function buildTenantProfile(
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
             upn: upn,
+            ...(nativeAccountId && { nativeAccountId }),
         };
     } else {
         return {
@@ -133,6 +148,7 @@ export function buildTenantProfile(
             localAccountId,
             username: "",
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            ...(nativeAccountId && { nativeAccountId }),
         };
     }
 }
@@ -166,6 +182,7 @@ export function updateAccountTenantProfileData(
                 baseAccountInfo.homeAccountId,
                 baseAccountInfo.localAccountId,
                 baseAccountInfo.tenantId,
+                updatedAccountInfo.nativeAccountId,
                 idTokenClaims
             );
 
@@ -174,6 +191,7 @@ export function updateAccountTenantProfileData(
             ...claimsSourcedTenantProfile,
             idTokenClaims: idTokenClaims,
             idToken: idTokenSecret,
+            kmsi: isKmsi(idTokenClaims),
         };
 
         return updatedAccountInfo;

package/src/account/AuthToken.ts

@@ -16,9 +16,10 @@ import {
  */
 export function extractTokenClaims(
     encodedToken: string,
-    base64Decode: (input: string) => string
+    base64Decode: (input: string) => string,
+    correlationId: string
 ): TokenClaims {
-    const jswPayload = getJWSPayload(encodedToken);
+    const jswPayload = getJWSPayload(encodedToken, correlationId);
 
     // token will be decoded to get the username
     try {
@@ -26,7 +27,10 @@ export function extractTokenClaims(
         const base64Decoded = base64Decode(jswPayload);
         return JSON.parse(base64Decoded) as TokenClaims;
     } catch (err) {
-        throw createClientAuthError(ClientAuthErrorCodes.tokenParsingError);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.tokenParsingError,
+            correlationId
+        );
     }
 }
 
@@ -57,14 +61,23 @@ export function isKmsi(idTokenClaims: TokenClaims): boolean {
  *
  * @param authToken
  */
-export function getJWSPayload(authToken: string): string {
+export function getJWSPayload(
+    authToken: string,
+    correlationId: string
+): string {
     if (!authToken) {
-        throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.nullOrEmptyToken,
+            correlationId
+        );
     }
     const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
     const matches = tokenPartsRegex.exec(authToken);
     if (!matches || matches.length < 4) {
-        throw createClientAuthError(ClientAuthErrorCodes.tokenParsingError);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.tokenParsingError,
+            correlationId
+        );
     }
     /**
      * const crackedToken = {
@@ -76,18 +89,3 @@ export function getJWSPayload(authToken: string): string {
 
     return matches[2];
 }
-
-/**
- * Determine if the token's max_age has transpired
- */
-export function checkMaxAge(authTime: number, maxAge: number): void {
-    /*
-     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-     */
-    const fiveMinuteSkew = 300000; // five minutes in milliseconds
-    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-        throw createClientAuthError(ClientAuthErrorCodes.maxAgeTranspired);
-    }
-}

package/src/account/ClientCredentials.ts

@@ -6,6 +6,7 @@
 export type ClientAssertionConfig = {
     clientId: string;
     tokenEndpoint?: string;
+    fmiPath?: string;
 };
 
 export type ClientAssertionCallback = (

package/src/account/ClientInfo.ts

@@ -31,7 +31,10 @@ export function buildClientInfo(
     base64Decode: (input: string) => string
 ): ClientInfo {
     if (!rawClientInfo) {
-        throw createClientAuthError(ClientAuthErrorCodes.clientInfoEmptyError);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.clientInfoEmptyError,
+            ""
+        );
     }
 
     try {
@@ -39,7 +42,8 @@ export function buildClientInfo(
         return JSON.parse(decodedClientInfo) as ClientInfo;
     } catch (e) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.clientInfoDecodingError
+            ClientAuthErrorCodes.clientInfoDecodingError,
+            ""
         );
     }
 }
@@ -53,7 +57,8 @@ export function buildClientInfoFromHomeAccountId(
 ): ClientInfo {
     if (!homeAccountId) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.clientInfoDecodingError
+            ClientAuthErrorCodes.clientInfoDecodingError,
+            ""
         );
     }
     const clientInfoParts: string[] = homeAccountId.split(

package/src/authority/Authority.ts

@@ -180,7 +180,7 @@ export class Authority {
      * Sets canonical authority.
      */
     public set canonicalAuthority(url: string) {
-        this._canonicalAuthority = new UrlString(url);
+        this._canonicalAuthority = new UrlString(url, this.correlationId);
         this._canonicalAuthority.validateAsUri();
         this._canonicalAuthorityUrlComponents = null;
     }
@@ -219,7 +219,8 @@ export class Authority {
             return this.replacePath(this.metadata.authorization_endpoint);
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -232,7 +233,8 @@ export class Authority {
             return this.replacePath(this.metadata.token_endpoint);
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -244,7 +246,8 @@ export class Authority {
             );
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -257,13 +260,15 @@ export class Authority {
             // ROPC policies may not have end_session_endpoint set
             if (!this.metadata.end_session_endpoint) {
                 throw createClientAuthError(
-                    ClientAuthErrorCodes.endSessionEndpointNotSupported
+                    ClientAuthErrorCodes.endSessionEndpointNotSupported,
+                    this.correlationId
                 );
             }
             return this.replacePath(this.metadata.end_session_endpoint);
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -276,7 +281,8 @@ export class Authority {
             return this.replacePath(this.metadata.issuer);
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -289,7 +295,8 @@ export class Authority {
             return this.replacePath(this.metadata.jwks_uri);
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -325,7 +332,8 @@ export class Authority {
     private replacePath(urlString: string): string {
         let endpoint = urlString;
         const cachedAuthorityUrl = new UrlString(
-            this.metadata.canonical_authority
+            this.metadata.canonical_authority,
+            this.correlationId
         );
         const cachedAuthorityUrlComponents =
             cachedAuthorityUrl.getUrlComponents();
@@ -340,7 +348,8 @@ export class Authority {
                 this.canReplaceTenant(cachedAuthorityUrlComponents)
             ) {
                 const tenantId = new UrlString(
-                    this.metadata.authorization_endpoint
+                    this.metadata.authorization_endpoint,
+                    this.correlationId
                 ).getUrlComponents().PathSegments[0];
                 /**
                  * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
@@ -571,7 +580,8 @@ export class Authority {
             // Metadata could not be obtained from the config, cache, network or hardcoded values
             throw createClientAuthError(
                 ClientAuthErrorCodes.openIdConfigError,
-                this.defaultOpenIdConfigurationEndpoint
+                this.defaultOpenIdConfigurationEndpoint,
+                this.correlationId
             );
         }
     }
@@ -659,7 +669,8 @@ export class Authority {
         metadataEntity: AuthorityMetadataEntity
     ): boolean {
         const cachedAuthorityUrl = new UrlString(
-            metadataEntity.canonical_authority
+            metadataEntity.canonical_authority,
+            this.correlationId
         );
         const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
 
@@ -680,7 +691,8 @@ export class Authority {
                 ) as OpenIdConfigResponse;
             } catch (e) {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.invalidAuthorityMetadata
+                    ClientConfigurationErrorCodes.invalidAuthorityMetadata,
+                    this.correlationId
                 );
             }
         }
@@ -765,7 +777,8 @@ export class Authority {
                     userConfiguredAzureRegion;
                 return Authority.replaceWithRegionalInformation(
                     metadata,
-                    userConfiguredAzureRegion
+                    userConfiguredAzureRegion,
+                    this.correlationId
                 );
             }
 
@@ -788,7 +801,8 @@ export class Authority {
                     autodetectedRegionName;
                 return Authority.replaceWithRegionalInformation(
                     metadata,
-                    autodetectedRegionName
+                    autodetectedRegionName,
+                    this.correlationId
                 );
             }
 
@@ -834,7 +848,8 @@ export class Authority {
 
         // Metadata could not be obtained from the config, cache, network or hardcoded values
         throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.untrustedAuthority
+            ClientConfigurationErrorCodes.untrustedAuthority,
+            this.correlationId
         );
     }
 
@@ -978,7 +993,8 @@ export class Authority {
                     this.correlationId
                 );
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.invalidCloudDiscoveryMetadata
+                    ClientConfigurationErrorCodes.invalidCloudDiscoveryMetadata,
+                    this.correlationId
                 );
             }
         }
@@ -1120,8 +1136,10 @@ export class Authority {
             (authority) => {
                 return (
                     authority &&
-                    UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                        normalizedHost
+                    UrlString.getDomainFromUrl(
+                        authority,
+                        this.correlationId
+                    ).toLowerCase() === normalizedHost
                 );
             }
         );
@@ -1178,7 +1196,8 @@ export class Authority {
             return this.metadata.preferred_cache;
         } else {
             throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+                ClientAuthErrorCodes.endpointResolutionError,
+                this.correlationId
             );
         }
     }
@@ -1226,7 +1245,8 @@ export class Authority {
     private validateIssuer(issuer: string): void {
         if (!issuer) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.issuerValidationFailed
+                ClientConfigurationErrorCodes.issuerValidationFailed,
+                this.correlationId
             );
         }
 
@@ -1236,7 +1256,8 @@ export class Authority {
             issuerUrl = new URL(issuer);
         } catch {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.issuerValidationFailed
+                ClientConfigurationErrorCodes.issuerValidationFailed,
+                this.correlationId
             );
         }
         const issuerScheme = issuerUrl.protocol;
@@ -1301,7 +1322,8 @@ export class Authority {
 
         // issuer validation fails if none of the above rules are satisfied
         throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.issuerValidationFailed
+            ClientConfigurationErrorCodes.issuerValidationFailed,
+            this.correlationId
         );
     }
 
@@ -1416,10 +1438,11 @@ export class Authority {
     static buildRegionalAuthorityString(
         host: string,
         region: string,
+        correlationId: string,
         queryString?: string
     ): string {
         // Create and validate a Url string object with the initial authority string
-        const authorityUrlInstance = new UrlString(host);
+        const authorityUrlInstance = new UrlString(host, correlationId);
         authorityUrlInstance.validateAsUri();
 
         const authorityUrlParts = authorityUrlInstance.getUrlComponents();
@@ -1431,10 +1454,13 @@ export class Authority {
         }
 
         // Include the query string portion of the url
-        const url = UrlString.constructAuthorityUriFromObject({
-            ...authorityUrlInstance.getUrlComponents(),
-            HostNameAndPort: hostNameAndPort,
-        }).urlString;
+        const url = UrlString.constructAuthorityUriFromObject(
+            {
+                ...authorityUrlInstance.getUrlComponents(),
+                HostNameAndPort: hostNameAndPort,
+            },
+            correlationId
+        ).urlString;
 
         // Add the query string if a query string was provided
         if (queryString) return `${url}?${queryString}`;
@@ -1450,26 +1476,30 @@ export class Authority {
      */
     static replaceWithRegionalInformation(
         metadata: OpenIdConfigResponse,
-        azureRegion: string
+        azureRegion: string,
+        correlationId: string
     ): OpenIdConfigResponse {
         const regionalMetadata = { ...metadata };
         regionalMetadata.authorization_endpoint =
             Authority.buildRegionalAuthorityString(
                 regionalMetadata.authorization_endpoint,
-                azureRegion
+                azureRegion,
+                correlationId
             );
 
         regionalMetadata.token_endpoint =
             Authority.buildRegionalAuthorityString(
                 regionalMetadata.token_endpoint,
-                azureRegion
+                azureRegion,
+                correlationId
             );
 
         if (regionalMetadata.end_session_endpoint) {
             regionalMetadata.end_session_endpoint =
                 Authority.buildRegionalAuthorityString(
                     regionalMetadata.end_session_endpoint,
-                    azureRegion
+                    azureRegion,
+                    correlationId
                 );
         }
 
@@ -1485,9 +1515,12 @@ export class Authority {
      *
      * @param authority
      */
-    static transformCIAMAuthority(authority: string): string {
+    static transformCIAMAuthority(
+        authority: string,
+        correlationId: string
+    ): string {
         let ciamAuthority = authority;
-        const authorityUrl = new UrlString(authority);
+        const authorityUrl = new UrlString(authority, correlationId);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
 
         // check if transformation is needed
@@ -1510,9 +1543,10 @@ export class Authority {
  * Extract tenantId from authority
  */
 export function getTenantFromAuthorityString(
-    authority: string
+    authority: string,
+    correlationId: string
 ): string | undefined {
-    const authorityUrl = new UrlString(authority);
+    const authorityUrl = new UrlString(authority, correlationId);
     const authorityUrlComponents = authorityUrl.getUrlComponents();
     /**
      * For credential matching purposes, tenantId is the last path segment of the authority URL:
@@ -1552,7 +1586,8 @@ export function buildStaticAuthorityOptions(
             cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
         } catch (e) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.invalidCloudDiscoveryMetadata
+                ClientConfigurationErrorCodes.invalidCloudDiscoveryMetadata,
+                ""
             );
         }
     }

package/src/authority/AuthorityFactory.ts

@@ -41,7 +41,8 @@ export async function createDiscoveredInstance(
     performanceClient: IPerformanceClient
 ): Promise<Authority> {
     const authorityUriFinal = Authority.transformCIAMAuthority(
-        formatAuthorityUri(authorityUri)
+        formatAuthorityUri(authorityUri),
+        correlationId
     );
 
     // Initialize authority and perform discovery endpoint check.
@@ -68,7 +69,8 @@ export async function createDiscoveredInstance(
         return acquireTokenAuthority;
     } catch (e) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.endpointResolutionError
+            ClientAuthErrorCodes.endpointResolutionError,
+            correlationId
         );
     }
 }

package/src/authority/AuthorityMetadata.ts

@@ -146,7 +146,8 @@ export function getAliasesFromStaticSources(
     const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
     if (canonicalAuthority) {
         const authorityHost = new UrlString(
-            canonicalAuthority
+            canonicalAuthority,
+            correlationId
         ).getUrlComponents().HostNameAndPort;
         staticAliases =
             getAliasesFromMetadata(

package/src/authority/RegionDiscovery.ts

@@ -6,6 +6,7 @@
 import { INetworkModule } from "../network/INetworkModule.js";
 import { NetworkResponse } from "../network/NetworkResponse.js";
 import { IMDSBadResponse } from "../response/IMDSBadResponse.js";
+import { ImdsComputeResponse } from "../response/ImdsComputeResponse.js";
 import * as Constants from "../utils/Constants.js";
 import { RegionDiscoveryMetadata } from "./RegionDiscoveryMetadata.js";
 import { ImdsOptions } from "./ImdsOptions.js";
@@ -69,9 +70,12 @@ export class RegionDiscovery {
                 if (
                     localIMDSVersionResponse.status === Constants.HTTP_SUCCESS
                 ) {
-                    autodetectedRegionName = localIMDSVersionResponse.body;
-                    regionDiscoveryMetadata.region_source =
-                        Constants.RegionDiscoverySources.IMDS;
+                    autodetectedRegionName =
+                        localIMDSVersionResponse.body?.location;
+                    if (autodetectedRegionName) {
+                        regionDiscoveryMetadata.region_source =
+                            Constants.RegionDiscoverySources.IMDS;
+                    }
                 }
 
                 // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
@@ -104,9 +108,11 @@ export class RegionDiscovery {
                         Constants.HTTP_SUCCESS
                     ) {
                         autodetectedRegionName =
-                            currentIMDSVersionResponse.body;
-                        regionDiscoveryMetadata.region_source =
-                            Constants.RegionDiscoverySources.IMDS;
+                            currentIMDSVersionResponse.body?.location;
+                        if (autodetectedRegionName) {
+                            regionDiscoveryMetadata.region_source =
+                                Constants.RegionDiscoverySources.IMDS;
+                        }
                     }
                 }
             } catch (e) {
@@ -131,15 +137,16 @@ export class RegionDiscovery {
     /**
      * Make the call to the IMDS endpoint
      *
-     * @param imdsEndpointUrl
-     * @returns Promise<NetworkResponse<string>>
+     * @param version
+     * @param options
+     * @returns Promise<NetworkResponse<ImdsComputeResponse>>
      */
     private async getRegionFromIMDS(
         version: string,
         options: ImdsOptions
-    ): Promise<NetworkResponse<string>> {
-        return this.networkInterface.sendGetRequestAsync<string>(
-            `${Constants.IMDS_ENDPOINT}?api-version=${version}&format=text`,
+    ): Promise<NetworkResponse<ImdsComputeResponse>> {
+        return this.networkInterface.sendGetRequestAsync<ImdsComputeResponse>(
+            `${Constants.IMDS_ENDPOINT}?api-version=${version}`,
             options,
             Constants.IMDS_TIMEOUT
         );