@azure/msal-common 4.5.1 → 5.2.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v4.5.1 2021-08-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 'use strict';
 'use strict';
 
@@ -153,6 +153,8 @@ var HeaderNames;
     HeaderNames["CONTENT_TYPE"] = "Content-Type";
     HeaderNames["RETRY_AFTER"] = "Retry-After";
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
+    HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
+    HeaderNames["AuthenticationInfo"] = "Authentication-Info";
 })(HeaderNames || (HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
@@ -223,6 +225,7 @@ var AADServerParamKeys;
     AADServerParamKeys["ON_BEHALF_OF"] = "on_behalf_of";
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
+    AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
  * Claims request keys
@@ -387,8 +390,9 @@ var SERVER_TELEM_CONSTANTS = {
  */
 exports.AuthenticationScheme = void 0;
 (function (AuthenticationScheme) {
-    AuthenticationScheme["POP"] = "pop";
     AuthenticationScheme["BEARER"] = "Bearer";
+    AuthenticationScheme["POP"] = "pop";
+    AuthenticationScheme["SSH"] = "ssh-cert";
 })(exports.AuthenticationScheme || (exports.AuthenticationScheme = {}));
 /**
  * Constants related to throttling
@@ -482,6 +486,9 @@ var AuthError = /** @class */ (function (_super) {
         _this.name = "AuthError";
         return _this;
     }
+    AuthError.prototype.setCorrelationId = function (correlationId) {
+        this.correlationId = correlationId;
+    };
     /**
      * Creates an error that is thrown when something unexpected happens in the library.
      * @param errDesc
@@ -527,6 +534,24 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
             });
         });
     },
+    removeTokenBindingKey: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - removeTokenBindingKey() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
+    },
+    clearKeystore: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - clearKeystore() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
+    },
     signJwt: function () {
         return __awaiter(this, void 0, void 0, function () {
             var notImplErr;
@@ -718,6 +743,14 @@ var ClientAuthErrorMessage = {
     accessTokenEntityNullError: {
         code: "access_token_entity_null",
         desc: "Access token entity is null, please check logs and cache to ensure a valid access token is present."
+    },
+    bindingKeyNotRemovedError: {
+        code: "binding_key_not_removed",
+        desc: "Could not remove the credential's binding key from storage."
+    },
+    logoutNotSupported: {
+        code: "end_session_endpoint_not_supported",
+        desc: "Provided authority does not support logout."
     }
 };
 /**
@@ -817,12 +850,6 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createNonceNotFoundError = function (missingNonce) {
         return new ClientAuthError(ClientAuthErrorMessage.nonceNotFoundError.code, ClientAuthErrorMessage.nonceNotFoundError.desc + ":  " + missingNonce);
     };
-    /**
-     * Creates an error thrown when the authorization code required for a token request is null or empty.
-     */
-    ClientAuthError.createNoTokensFoundError = function () {
-        return new ClientAuthError(ClientAuthErrorMessage.noTokensFoundError.code, ClientAuthErrorMessage.noTokensFoundError.desc);
-    };
     /**
      * Throws error when multiple tokens are in cache.
      */
@@ -984,6 +1011,15 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createNoAuthCodeInServerResponseError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.noAuthorizationCodeFromServer.code, ClientAuthErrorMessage.noAuthorizationCodeFromServer.desc);
     };
+    ClientAuthError.createBindingKeyNotRemovedError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.bindingKeyNotRemovedError.code, ClientAuthErrorMessage.bindingKeyNotRemovedError.desc);
+    };
+    /**
+     * Thrown when logout is attempted for an authority that doesnt have an end_session_endpoint
+     */
+    ClientAuthError.createLogoutNotSupportedError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
+    };
     return ClientAuthError;
 }(AuthError));
 
@@ -1052,16 +1088,17 @@ var StringUtils = /** @class */ (function () {
      * @param query
      */
     StringUtils.queryStringToObject = function (query) {
-        var match; // Regex for replacing addition symbol with a space
-        var pl = /\+/g;
-        var search = /([^&=]+)=([^&]*)/g;
-        var decode = function (s) { return decodeURIComponent(s.replace(pl, " ")); };
         var obj = {};
-        match = search.exec(query);
-        while (match) {
-            obj[decode(match[1])] = decode(match[2]);
-            match = search.exec(query);
-        }
+        var params = query.split("&");
+        var decode = function (s) { return decodeURIComponent(s.replace(/\+/g, " ")); };
+        params.forEach(function (pair) {
+            if (pair.trim()) {
+                var _a = pair.split(/=(.+)/g, 2), key = _a[0], value = _a[1]; // Split on the first occurence of the '=' character
+                if (key && value) {
+                    obj[decode(key)] = decode(value);
+                }
+            }
+        });
         return obj;
     };
     /**
@@ -1103,7 +1140,7 @@ var StringUtils = /** @class */ (function () {
          * Wildcard support: https://stackoverflow.com/a/3117248/4888559
          * Queries: replaces "?" in string with escaped "\?" for regex test
          */
-        var regex = new RegExp(pattern.replace(/\*/g, "[^ ]*").replace(/\?/g, "\\\?"));
+        var regex = new RegExp(pattern.replace(/\\/g, "\\\\").replace(/\*/g, "[^ ]*").replace(/\?/g, "\\\?")); // eslint-disable-line security/detect-non-literal-regexp
         return regex.test(input);
     };
     return StringUtils;
@@ -1131,10 +1168,12 @@ var Logger = /** @class */ (function () {
     function Logger(loggerOptions, packageName, packageVersion) {
         // Current log level, defaults to info.
         this.level = exports.LogLevel.Info;
-        var defaultLoggerCallback = function () { };
+        var defaultLoggerCallback = function () {
+            return;
+        };
         this.localCallback = loggerOptions.loggerCallback || defaultLoggerCallback;
         this.piiLoggingEnabled = loggerOptions.piiLoggingEnabled || false;
-        this.level = loggerOptions.logLevel || exports.LogLevel.Info;
+        this.level = typeof (loggerOptions.logLevel) === "number" ? loggerOptions.logLevel : exports.LogLevel.Info;
         this.correlationId = loggerOptions.correlationId || "";
         this.packageName = packageName || Constants.EMPTY_STRING;
         this.packageVersion = packageVersion || Constants.EMPTY_STRING;
@@ -1287,7 +1326,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "4.5.1";
+var version = "5.2.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1298,7 +1337,7 @@ var version = "4.5.1";
  *
  * Key:Value Schema:
  *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
  *
  * Value Schema:
  * {
@@ -1311,6 +1350,7 @@ var version = "4.5.1";
  *      realm: Full tenant or organizational identifier that the account belongs to
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
  *      oboAssertion: access token passed in as part of OBO request
+ *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1338,7 +1378,7 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      */
     CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId);
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
     };
     /**
      * returns the type of the cache (in this case credential)
@@ -1348,6 +1388,7 @@ var CredentialEntity = /** @class */ (function () {
             case exports.CredentialType.ID_TOKEN:
                 return exports.CacheType.ID_TOKEN;
             case exports.CredentialType.ACCESS_TOKEN:
+            case exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
                 return exports.CacheType.ACCESS_TOKEN;
             case exports.CredentialType.REFRESH_TOKEN:
                 return exports.CacheType.REFRESH_TOKEN;
@@ -1379,13 +1420,18 @@ var CredentialEntity = /** @class */ (function () {
     };
     /**
      * generates credential key
+     * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId) {
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
         var credentialKey = [
             this.generateAccountIdForCacheKey(homeAccountId, environment),
             this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target),
+            this.generateTargetForCacheKey(target)
         ];
+        // PoP Tokens and SSH certs include scheme in cache key
+        if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
+            credentialKey.push(tokenType.toLowerCase());
+        }
         return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
@@ -1494,15 +1540,31 @@ var ClientConfigurationErrorMessage = {
     },
     invalidCloudDiscoveryMetadata: {
         code: "invalid_cloud_discovery_metadata",
-        desc: "Invalid cloudDiscoveryMetadata provided. Must be a JSON object containing tenant_discovery_endpoint and metadata fields"
+        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields"
     },
     invalidAuthorityMetadata: {
         code: "invalid_authority_metadata",
-        desc: "Invalid authorityMetadata provided. Must by a JSON object containing authorization_endpoint, token_endpoint, end_session_endpoint, issuer fields."
+        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields."
     },
     untrustedAuthority: {
         code: "untrusted_authority",
         desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter."
+    },
+    missingSshJwk: {
+        code: "missing_ssh_jwk",
+        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme."
+    },
+    missingSshKid: {
+        code: "missing_ssh_kid",
+        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme."
+    },
+    missingNonceAuthenticationHeader: {
+        code: "missing_nonce_authentication_header",
+        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce."
+    },
+    invalidAuthenticationHeader: {
+        code: "invalid_authentication_header",
+        desc: "Invalid authentication header provided"
     }
 };
 /**
@@ -1624,6 +1686,30 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     ClientConfigurationError.createUntrustedAuthorityError = function () {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
     };
+    /*
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
+     */
+    ClientConfigurationError.createMissingSshJwkError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
+    };
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
+     */
+    ClientConfigurationError.createMissingSshKidError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
+    };
+    /**
+     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
+     */
+    ClientConfigurationError.createMissingNonceAuthenticationHeadersError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
+    };
+    /**
+     * Throws error when a provided header is invalid in any way
+     */
+    ClientConfigurationError.createInvalidAuthenticationHeaderError = function (invalidHeaderName, details) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc + ". Invalid header: " + invalidHeaderName + ". Details: " + details);
+    };
     return ClientConfigurationError;
 }(ClientAuthError));
 
@@ -1958,14 +2044,14 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, authority, idToken, oboAssertion, cloudGraphHostName, msGraphHost) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
         account.clientInfo = clientInfo;
         account.homeAccountId = homeAccountId;
-        var env = authority.getPreferredCache();
-        if (StringUtils.isEmpty(env)) {
+        var env = environment || (authority && authority.getPreferredCache());
+        if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         account.environment = env;
@@ -1992,16 +2078,16 @@ var AccountEntity = /** @class */ (function () {
      * @param authority
      * @param idToken
      */
-    AccountEntity.createGenericAccount = function (authority, homeAccountId, idToken, oboAssertion, cloudGraphHostName, msGraphHost) {
+    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
-        account.authorityType = (authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = "";
         account.oboAssertion = oboAssertion;
-        var env = authority.getPreferredCache();
-        if (StringUtils.isEmpty(env)) {
+        var env = environment || authority && authority.getPreferredCache();
+        if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         if (idToken) {
@@ -2167,49 +2253,75 @@ var CacheManager = /** @class */ (function () {
      * @param cacheRecord
      */
     CacheManager.prototype.saveCacheRecord = function (cacheRecord) {
-        if (!cacheRecord) {
-            throw ClientAuthError.createNullOrUndefinedCacheRecord();
-        }
-        if (!!cacheRecord.account) {
-            this.setAccount(cacheRecord.account);
-        }
-        if (!!cacheRecord.idToken) {
-            this.setIdTokenCredential(cacheRecord.idToken);
-        }
-        if (!!cacheRecord.accessToken) {
-            this.saveAccessToken(cacheRecord.accessToken);
-        }
-        if (!!cacheRecord.refreshToken) {
-            this.setRefreshTokenCredential(cacheRecord.refreshToken);
-        }
-        if (!!cacheRecord.appMetadata) {
-            this.setAppMetadata(cacheRecord.appMetadata);
-        }
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!cacheRecord) {
+                            throw ClientAuthError.createNullOrUndefinedCacheRecord();
+                        }
+                        if (!!cacheRecord.account) {
+                            this.setAccount(cacheRecord.account);
+                        }
+                        if (!!cacheRecord.idToken) {
+                            this.setIdTokenCredential(cacheRecord.idToken);
+                        }
+                        if (!!!cacheRecord.accessToken) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.saveAccessToken(cacheRecord.accessToken)];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        if (!!cacheRecord.refreshToken) {
+                            this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                        }
+                        if (!!cacheRecord.appMetadata) {
+                            this.setAppMetadata(cacheRecord.appMetadata);
+                        }
+                        return [2 /*return*/];
+                }
+            });
+        });
     };
     /**
      * saves access token credential
      * @param credential
      */
     CacheManager.prototype.saveAccessToken = function (credential) {
-        var _this = this;
-        var currentTokenCache = this.getCredentialsFilteredBy({
-            clientId: credential.clientId,
-            credentialType: credential.credentialType,
-            environment: credential.environment,
-            homeAccountId: credential.homeAccountId,
-            realm: credential.realm,
-        });
-        var currentScopes = ScopeSet.fromString(credential.target);
-        var currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
-        if (currentAccessTokens) {
-            currentAccessTokens.forEach(function (tokenEntity) {
-                var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
-                if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    _this.removeCredential(tokenEntity);
+        return __awaiter(this, void 0, void 0, function () {
+            var currentTokenCache, currentScopes, currentAccessTokens, removedAccessTokens_1;
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        currentTokenCache = this.getCredentialsFilteredBy({
+                            clientId: credential.clientId,
+                            credentialType: credential.credentialType,
+                            environment: credential.environment,
+                            homeAccountId: credential.homeAccountId,
+                            realm: credential.realm,
+                            tokenType: credential.tokenType
+                        });
+                        currentScopes = ScopeSet.fromString(credential.target);
+                        currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
+                        if (!currentAccessTokens) return [3 /*break*/, 2];
+                        removedAccessTokens_1 = [];
+                        currentAccessTokens.forEach(function (tokenEntity) {
+                            var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                            if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
+                                removedAccessTokens_1.push(_this.removeCredential(tokenEntity));
+                            }
+                        });
+                        return [4 /*yield*/, Promise.all(removedAccessTokens_1)];
+                    case 1:
+                        _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        this.setAccessTokenCredential(credential);
+                        return [2 /*return*/];
                 }
             });
-        }
-        this.setAccessTokenCredential(credential);
+        });
     };
     /**
      * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -2260,7 +2372,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
     };
     /**
      * Support function to help match credentials
@@ -2270,8 +2382,10 @@ var CacheManager = /** @class */ (function () {
      * @param clientId
      * @param realm
      * @param target
+     * @param oboAssertion
+     * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2318,6 +2432,28 @@ var CacheManager = /** @class */ (function () {
             if (!!target && !_this.matchTarget(entity, target)) {
                 return;
             }
+            // Access Token with Auth Scheme specific matching
+            if (credentialType === exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
+                if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
+                    return;
+                }
+                switch (tokenType) {
+                    case exports.AuthenticationScheme.POP:
+                        // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
+                        if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
+                            // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
+                            _this.removeItem(cacheKey, exports.CacheSchemaType.CREDENTIAL);
+                            return;
+                        }
+                        break;
+                    case exports.AuthenticationScheme.SSH:
+                        // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                        if (keyId && !_this.matchKeyId(entity, keyId)) {
+                            return;
+                        }
+                        break;
+                }
+            }
             switch (credType) {
                 case exports.CredentialType.ID_TOKEN:
                     matchingCredentials.idTokens[cacheKey] = entity;
@@ -2398,56 +2534,112 @@ var CacheManager = /** @class */ (function () {
      * Removes all accounts and related tokens from cache.
      */
     CacheManager.prototype.removeAllAccounts = function () {
-        var _this = this;
-        var allCacheKeys = this.getKeys();
-        allCacheKeys.forEach(function (cacheKey) {
-            var entity = _this.getAccount(cacheKey);
-            if (!entity) {
-                return;
-            }
-            _this.removeAccount(cacheKey);
+        return __awaiter(this, void 0, void 0, function () {
+            var allCacheKeys, removedAccounts;
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        allCacheKeys = this.getKeys();
+                        removedAccounts = [];
+                        allCacheKeys.forEach(function (cacheKey) {
+                            var entity = _this.getAccount(cacheKey);
+                            if (!entity) {
+                                return;
+                            }
+                            removedAccounts.push(_this.removeAccount(cacheKey));
+                        });
+                        return [4 /*yield*/, Promise.all(removedAccounts)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/, true];
+                }
+            });
         });
-        return true;
     };
     /**
      * returns a boolean if the given account is removed
      * @param account
      */
     CacheManager.prototype.removeAccount = function (accountKey) {
-        var account = this.getAccount(accountKey);
-        if (!account) {
-            throw ClientAuthError.createNoAccountFoundError();
-        }
-        return (this.removeAccountContext(account) && this.removeItem(accountKey, exports.CacheSchemaType.ACCOUNT));
+        return __awaiter(this, void 0, void 0, function () {
+            var account;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        account = this.getAccount(accountKey);
+                        if (!account) {
+                            throw ClientAuthError.createNoAccountFoundError();
+                        }
+                        return [4 /*yield*/, this.removeAccountContext(account)];
+                    case 1: return [2 /*return*/, ((_a.sent()) && this.removeItem(accountKey, exports.CacheSchemaType.ACCOUNT))];
+                }
+            });
+        });
     };
     /**
      * returns a boolean if the given account is removed
      * @param account
      */
     CacheManager.prototype.removeAccountContext = function (account) {
-        var _this = this;
-        var allCacheKeys = this.getKeys();
-        var accountId = account.generateAccountId();
-        allCacheKeys.forEach(function (cacheKey) {
-            // don't parse any non-credential type cache entities
-            var credType = CredentialEntity.getCredentialType(cacheKey);
-            if (credType === Constants.NOT_DEFINED) {
-                return;
-            }
-            var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
-            if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
-                _this.removeCredential(cacheEntity);
-            }
+        return __awaiter(this, void 0, void 0, function () {
+            var allCacheKeys, accountId, removedCredentials;
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        allCacheKeys = this.getKeys();
+                        accountId = account.generateAccountId();
+                        removedCredentials = [];
+                        allCacheKeys.forEach(function (cacheKey) {
+                            // don't parse any non-credential type cache entities
+                            var credType = CredentialEntity.getCredentialType(cacheKey);
+                            if (credType === Constants.NOT_DEFINED) {
+                                return;
+                            }
+                            var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
+                            if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
+                                removedCredentials.push(_this.removeCredential(cacheEntity));
+                            }
+                        });
+                        return [4 /*yield*/, Promise.all(removedCredentials)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/, true];
+                }
+            });
         });
-        return true;
     };
     /**
      * returns a boolean if the given credential is removed
      * @param credential
      */
     CacheManager.prototype.removeCredential = function (credential) {
-        var key = credential.generateCredentialKey();
-        return this.removeItem(key, exports.CacheSchemaType.CREDENTIAL);
+        return __awaiter(this, void 0, void 0, function () {
+            var key, accessTokenWithAuthSchemeEntity, kid;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        key = credential.generateCredentialKey();
+                        if (!(credential.credentialType.toLowerCase() === exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
+                        if (!(credential.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 4];
+                        accessTokenWithAuthSchemeEntity = credential;
+                        kid = accessTokenWithAuthSchemeEntity.keyId;
+                        if (!kid) return [3 /*break*/, 4];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.cryptoImpl.removeTokenBindingKey(kid)];
+                    case 2:
+                        _a.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        _a.sent();
+                        throw ClientAuthError.createBindingKeyNotRemovedError();
+                    case 4: return [2 /*return*/, this.removeItem(key, exports.CacheSchemaType.CREDENTIAL)];
+                }
+            });
+        });
     };
     /**
      * Removes all app metadata objects from cache.
@@ -2470,10 +2662,10 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme) {
+    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
         var cachedAccount = this.readAccountFromCache(account);
         var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme);
+        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
         var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
         var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
         if (cachedAccount && cachedIdToken) {
@@ -2527,8 +2719,9 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme) {
-        var credentialType = (authScheme === exports.AuthenticationScheme.POP) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
+        // Distinguish between Bearer and PoP/SSH token cache types
+        var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
         var accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -2536,6 +2729,8 @@ var CacheManager = /** @class */ (function () {
             clientId: clientId,
             realm: account.tenantId,
             target: scopes.printScopesLowerCase(),
+            tokenType: authScheme,
+            keyId: keyId
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2680,6 +2875,22 @@ var CacheManager = /** @class */ (function () {
         }
         return entityScopeSet.containsScopeSet(requestTargetScopeSet);
     };
+    /**
+     * Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
+     * @param entity
+     * @param tokenType
+     */
+    CacheManager.prototype.matchTokenType = function (entity, tokenType) {
+        return !!(entity.tokenType && entity.tokenType === tokenType);
+    };
+    /**
+     * Returns true if the credential's keyId matches the one in the request, false otherwise
+     * @param entity
+     * @param tokenType
+     */
+    CacheManager.prototype.matchKeyId = function (entity, keyId) {
+        return !!(entity.keyId && entity.keyId === keyId);
+    };
     /**
      * returns if a given cache entity is of the type appmetadata
      * @param key
@@ -2820,8 +3031,13 @@ var DefaultStorageClass = /** @class */ (function (_super) {
         throw AuthError.createUnexpectedError(notImplErr);
     };
     DefaultStorageClass.prototype.clear = function () {
-        var notImplErr = "Storage interface - clear() has not been implemented for the cacheStorage interface.";
-        throw AuthError.createUnexpectedError(notImplErr);
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Storage interface - clear() has not been implemented for the cacheStorage interface.";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
     };
     return DefaultStorageClass;
 }(CacheManager));
@@ -2883,10 +3099,11 @@ var DEFAULT_CLIENT_CREDENTIALS = {
  */
 function buildClientConfiguration(_a) {
     var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
+    var loggerOptions = __assign(__assign({}, DEFAULT_LOGGER_IMPLEMENTATION), userLoggerOption);
     return {
         authOptions: buildAuthOptions(userAuthOptions),
         systemOptions: __assign(__assign({}, DEFAULT_SYSTEM_OPTIONS), userSystemOptions),
-        loggerOptions: __assign(__assign({}, DEFAULT_LOGGER_IMPLEMENTATION), userLoggerOption),
+        loggerOptions: loggerOptions,
         storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
@@ -2998,12 +3215,18 @@ var ThrottlingUtils = /** @class */ (function () {
         var currentSeconds = Date.now() / 1000;
         return Math.floor(Math.min(currentSeconds + (time || ThrottlingConstants.DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds + ThrottlingConstants.DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
     };
-    ThrottlingUtils.removeThrottle = function (cacheManager, clientId, authority, scopes, homeAccountIdentifier) {
+    ThrottlingUtils.removeThrottle = function (cacheManager, clientId, request, homeAccountIdentifier) {
         var thumbprint = {
             clientId: clientId,
-            authority: authority,
-            scopes: scopes,
-            homeAccountIdentifier: homeAccountIdentifier
+            authority: request.authority,
+            scopes: request.scopes,
+            homeAccountIdentifier: homeAccountIdentifier,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshJwk: request.sshJwk,
+            sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
         return cacheManager.removeItem(key, exports.CacheSchemaType.THROTTLING);
@@ -3541,6 +3764,15 @@ var RequestParameterBuilder = /** @class */ (function () {
             this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
         }
     };
+    /**
+     * add SSH JWK and key ID to query params
+     */
+    RequestParameterBuilder.prototype.addSshJwk = function (sshJwkString) {
+        if (!StringUtils.isEmpty(sshJwkString)) {
+            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
+            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+        }
+    };
     /**
      * add server telemetry fields
      * @param serverTelemetryManager
@@ -3724,7 +3956,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion) {
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
         var _a;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
@@ -3747,15 +3979,21 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.target = scopes;
         atEntity.oboAssertion = oboAssertion;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-        // Create Access Token With AuthScheme instead of regular access token
-        if (atEntity.tokenType === exports.AuthenticationScheme.POP) {
+        // Create Access Token With Auth Scheme instead of regular access token
+        if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
             atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            // Make sure keyId is present and add it to credential
-            var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-            if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                throw ClientAuthError.createTokenClaimsRequiredError();
+            switch (atEntity.tokenType) {
+                case exports.AuthenticationScheme.POP:
+                    // Make sure keyId is present and add it to credential
+                    var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
+                    if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                        throw ClientAuthError.createTokenClaimsRequiredError();
+                    }
+                    atEntity.keyId = tokenClaims.cnf.kid;
+                    break;
+                case exports.AuthenticationScheme.SSH:
+                    atEntity.keyId = keyId;
             }
-            atEntity.keyId = tokenClaims.cnf.kid;
         }
         return atEntity;
     };
@@ -3849,9 +4087,9 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
  * Licensed under the MIT License.
  */
 /**
- * InteractionRequiredAuthErrorMessage class containing string constants used by error codes and messages.
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
  */
-var InteractionRequiredAuthErrorMessage = [
+var InteractionRequiredServerErrorMessage = [
     "interaction_required",
     "consent_required",
     "login_required"
@@ -3864,7 +4102,16 @@ var InteractionRequiredAuthSubErrorMessage = [
     "consent_required"
 ];
 /**
- * Error thrown when user interaction is required at the auth server.
+ * Interaction required errors defined by the SDK
+ */
+var InteractionRequiredAuthErrorMessage = {
+    noTokensFoundError: {
+        code: "no_tokens_found",
+        desc: "No refresh token found in the cache. Please sign-in."
+    }
+};
+/**
+ * Error thrown when user interaction is required.
  */
 var InteractionRequiredAuthError = /** @class */ (function (_super) {
     __extends(InteractionRequiredAuthError, _super);
@@ -3874,16 +4121,28 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
         Object.setPrototypeOf(_this, InteractionRequiredAuthError.prototype);
         return _this;
     }
+    /**
+     * Helper function used to determine if an error thrown by the server requires interaction to resolve
+     * @param errorCode
+     * @param errorString
+     * @param subError
+     */
     InteractionRequiredAuthError.isInteractionRequiredError = function (errorCode, errorString, subError) {
-        var isInteractionRequiredErrorCode = !!errorCode && InteractionRequiredAuthErrorMessage.indexOf(errorCode) > -1;
+        var isInteractionRequiredErrorCode = !!errorCode && InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
         var isInteractionRequiredSubError = !!subError && InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
-        var isInteractionRequiredErrorDesc = !!errorString && InteractionRequiredAuthErrorMessage.some(function (irErrorCode) {
+        var isInteractionRequiredErrorDesc = !!errorString && InteractionRequiredServerErrorMessage.some(function (irErrorCode) {
             return errorString.indexOf(irErrorCode) > -1;
         });
         return isInteractionRequiredErrorCode || isInteractionRequiredErrorDesc || isInteractionRequiredSubError;
     };
+    /**
+     * Creates an error thrown when the authorization code required for a token request is null or empty.
+     */
+    InteractionRequiredAuthError.createNoTokensFoundError = function () {
+        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
+    };
     return InteractionRequiredAuthError;
-}(ServerError));
+}(AuthError));
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4035,22 +4294,6 @@ var UrlString = /** @class */ (function () {
             throw ClientConfigurationError.createInsecureAuthorityUriError(this.urlString);
         }
     };
-    /**
-     * Function to remove query string params from url. Returns the new url.
-     * @param url
-     * @param name
-     */
-    UrlString.prototype.urlRemoveQueryStringParameter = function (name) {
-        var regex = new RegExp("(\\&" + name + "=)[^\&]+");
-        this._urlString = this.urlString.replace(regex, "");
-        // name=value&
-        regex = new RegExp("(" + name + "=)[^\&]+&");
-        this._urlString = this.urlString.replace(regex, "");
-        // name=value
-        regex = new RegExp("(" + name + "=)[^\&]+");
-        this._urlString = this.urlString.replace(regex, "");
-        return this.urlString;
-    };
     /**
      * Given a url and a query string return the url with provided query string appended
      * @param url
@@ -4171,7 +4414,8 @@ var UrlString = /** @class */ (function () {
      * Check if the hash of the URL string contains known properties
      */
     UrlString.hashContainsKnownProperties = function (hash) {
-        if (StringUtils.isEmpty(hash)) {
+        if (StringUtils.isEmpty(hash) || hash.indexOf("=") < 0) {
+            // Hash doesn't contain key/value pairs
             return false;
         }
         var parameters = UrlString.getDeserializedHash(hash);
@@ -4198,17 +4442,29 @@ var PopTokenGenerator = /** @class */ (function () {
     }
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var kidThumbprint, reqCnf;
+            var reqCnf;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.generateKid(request)];
+                    case 1:
+                        reqCnf = _a.sent();
+                        return [2 /*return*/, this.cryptoUtils.base64Encode(JSON.stringify(reqCnf))];
+                }
+            });
+        });
+    };
+    PopTokenGenerator.prototype.generateKid = function (request) {
+        return __awaiter(this, void 0, void 0, function () {
+            var kidThumbprint;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, this.cryptoUtils.getPublicKeyThumbprint(request)];
                     case 1:
                         kidThumbprint = _a.sent();
-                        reqCnf = {
-                            kid: kidThumbprint,
-                            xms_ksl: KeyLocation.SW
-                        };
-                        return [2 /*return*/, this.cryptoUtils.base64Encode(JSON.stringify(reqCnf))];
+                        return [2 /*return*/, {
+                                kid: kidThumbprint,
+                                xms_ksl: KeyLocation.SW
+                            }];
                 }
             });
         });
@@ -4216,28 +4472,27 @@ var PopTokenGenerator = /** @class */ (function () {
     PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var tokenClaims, resourceRequestMethod, resourceRequestUri, shrClaims, resourceUrlString, resourceUrlComponents;
+            var tokenClaims;
             return __generator(this, function (_b) {
-                switch (_b.label) {
+                tokenClaims = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);
+                if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                    throw ClientAuthError.createTokenClaimsRequiredError();
+                }
+                return [2 /*return*/, this.signPayload(accessToken, tokenClaims.cnf.kid, request)];
+            });
+        });
+    };
+    PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
+        return __awaiter(this, void 0, void 0, function () {
+            var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
-                        tokenClaims = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);
-                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims;
+                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                            throw ClientAuthError.createTokenClaimsRequiredError();
-                        }
-                        return [4 /*yield*/, this.cryptoUtils.signJwt({
-                                at: accessToken,
-                                ts: TimeUtils.nowSeconds(),
-                                m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(),
-                                u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort,
-                                nonce: this.cryptoUtils.createNewGuid(),
-                                p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath,
-                                q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined,
-                                client_claims: shrClaims || undefined
-                            }, tokenClaims.cnf.kid)];
-                    case 1: return [2 /*return*/, _b.sent()];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                    case 1: return [2 /*return*/, _a.sent()];
                 }
             });
         });
@@ -4427,10 +4682,12 @@ var ResponseHandler = /** @class */ (function () {
                         if (!!authCodePayload && !!authCodePayload.state) {
                             requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
                         }
+                        // Add keyId from request to serverTokenResponse if defined
+                        serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
                         cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
                         _a.label = 1;
                     case 1:
-                        _a.trys.push([1, , 4, 7]);
+                        _a.trys.push([1, , 5, 8]);
                         if (!(this.persistencePlugin && this.serializableCache)) return [3 /*break*/, 3];
                         this.logger.verbose("Persistence enabled, calling beforeCacheAccess");
                         cacheContext = new TokenCacheContext(this.serializableCache, true);
@@ -4452,17 +4709,19 @@ var ResponseHandler = /** @class */ (function () {
                                 return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
                             }
                         }
-                        this.cacheStorage.saveCacheRecord(cacheRecord);
-                        return [3 /*break*/, 7];
+                        return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
                     case 4:
-                        if (!(this.persistencePlugin && this.serializableCache && cacheContext)) return [3 /*break*/, 6];
+                        _a.sent();
+                        return [3 /*break*/, 8];
+                    case 5:
+                        if (!(this.persistencePlugin && this.serializableCache && cacheContext)) return [3 /*break*/, 7];
                         this.logger.verbose("Persistence enabled, calling afterCacheAccess");
                         return [4 /*yield*/, this.persistencePlugin.afterCacheAccess(cacheContext)];
-                    case 5:
+                    case 6:
                         _a.sent();
-                        _a.label = 6;
-                    case 6: return [7 /*endfinally*/];
-                    case 7: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                        _a.label = 7;
+                    case 7: return [7 /*endfinally*/];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
                 }
             });
         });
@@ -4501,7 +4760,7 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
         }
         // refreshToken
         var cachedRefreshToken = null;
@@ -4528,15 +4787,15 @@ var ResponseHandler = /** @class */ (function () {
         // ADFS does not require client_info in the response
         if (authorityType === exports.AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(authority, this.homeAccountIdentifier, idToken, oboAssertion, cloudGraphHostName, msGraphhost);
+            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
         }
         // This fallback applies to B2C as well as they fall under an AAD account type.
         if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
             throw ClientAuthError.createClientInfoEmptyError();
         }
         return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, authority, idToken, oboAssertion, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(authority, this.homeAccountIdentifier, idToken, oboAssertion, cloudGraphHostName, msGraphhost);
+            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost) :
+            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
     };
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -4548,7 +4807,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
@@ -4591,12 +4850,14 @@ var ResponseHandler = /** @class */ (function () {
                                 accessToken: accessToken,
                                 fromCache: fromTokenCache,
                                 expiresOn: expiresOn,
+                                correlationId: request.correlationId,
                                 extExpiresOn: extExpiresOn,
                                 familyId: familyId,
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                                code: code
                             }];
                 }
             });
@@ -4615,7 +4876,10 @@ var ResponseHandler = /** @class */ (function () {
 var AuthorizationCodeClient = /** @class */ (function (_super) {
     __extends(AuthorizationCodeClient, _super);
     function AuthorizationCodeClient(configuration) {
-        return _super.call(this, configuration) || this;
+        var _this = _super.call(this, configuration) || this;
+        // Flag to indicate if client is for hybrid spa auth code redemption
+        _this.includeRedirectUri = true;
+        return _this;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -4687,7 +4951,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
             code: serverParams.code });
     };
     /**
-     * Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
+     * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
      * Default behaviour is to redirect the user to `window.location.href`.
      * @param authorityUri
      */
@@ -4696,14 +4960,6 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         if (!logoutRequest) {
             throw ClientConfigurationError.createEmptyLogoutRequestError();
         }
-        if (logoutRequest.account) {
-            // Clear given account.
-            this.cacheManager.removeAccount(AccountEntity.generateAccountCacheKey(logoutRequest.account));
-        }
-        else {
-            // Clear all accounts and tokens
-            this.cacheManager.clear();
-        }
         var queryString = this.createLogoutUrlQueryString(logoutRequest);
         // Construct logout URI.
         return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
@@ -4722,7 +4978,13 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         thumbprint = {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
-                            scopes: request.scopes
+                            scopes: request.scopes,
+                            authenticationScheme: request.authenticationScheme,
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            resourceRequestUri: request.resourceRequestUri,
+                            shrClaims: request.shrClaims,
+                            sshJwk: request.sshJwk,
+                            sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.createTokenRequestBody(request)];
                     case 1:
@@ -4766,13 +5028,24 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
-                        // validate the redirectUri (to be a non null value)
-                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        /*
+                         * For hybrid spa flow, there will be a code but no verifier
+                         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+                         */
+                        if (!this.includeRedirectUri) {
+                            // Just validate
+                            RequestValidator.validateRedirectUri(request.redirectUri);
+                        }
+                        else {
+                            // Validate and include redirect uri
+                            parameterBuilder.addRedirectUri(request.redirectUri);
+                        }
                         // Add scope array, parameter builder will add default scopes and dedupe
                         parameterBuilder.addScopes(request.scopes);
                         // add code: user set, not validated
@@ -4801,10 +5074,20 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
+                        cnfString = _b.sent();
                         parameterBuilder.addPopToken(cnfString);
-                        _a.label = 2;
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _b.label = 3;
+                    case 3:
                         correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                         parameterBuilder.addCorrelationId(correlationId);
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
@@ -4843,6 +5126,15 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                     break;
                             }
                         }
+                        if (request.tokenBodyParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                        }
+                        // Add hybrid spa parameters if not already provided
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                            parameterBuilder.addExtraQueryParameters((_a = {},
+                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a));
+                        }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
@@ -4958,6 +5250,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         if (request.idTokenHint) {
             parameterBuilder.addIdTokenHint(request.idTokenHint);
         }
+        if (request.state) {
+            parameterBuilder.addState(request.state);
+        }
+        if (request.extraQueryParameters) {
+            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+        }
         return parameterBuilder.createQueryString();
     };
     /**
@@ -5026,7 +5324,13 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                 thumbprint = {
                     clientId: this.config.authOptions.clientId,
                     authority: request.authority,
-                    scopes: request.scopes
+                    scopes: request.scopes,
+                    authenticationScheme: request.authenticationScheme,
+                    resourceRequestMethod: request.resourceRequestMethod,
+                    resourceRequestUri: request.resourceRequestUri,
+                    shrClaims: request.shrClaims,
+                    sshJwk: request.sshJwk,
+                    sshKid: request.sshKid
                 };
                 return [2 /*return*/, this.executePostRequestToDeviceCodeEndpoint(this.authority.deviceCodeEndpoint, queryString, headers, thumbprint)];
             });
@@ -5119,7 +5423,13 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                         thumbprint = {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
-                            scopes: request.scopes
+                            scopes: request.scopes,
+                            authenticationScheme: request.authenticationScheme,
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            resourceRequestUri: request.resourceRequestUri,
+                            shrClaims: request.shrClaims,
+                            sshJwk: request.sshJwk,
+                            sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.executePostToTokenEndpoint(this.authority.tokenEndpoint, requestBody, headers, thumbprint)];
                     case 2:
@@ -5225,7 +5535,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         return [2 /*return*/, this.acquireTokenWithCachedRefreshToken(request, true)];
                     }
                     catch (e) {
-                        noFamilyRTInCache = e instanceof ClientAuthError && e.errorCode === ClientAuthErrorMessage.noTokensFoundError.code;
+                        noFamilyRTInCache = e instanceof InteractionRequiredAuthError && e.errorCode === InteractionRequiredAuthErrorMessage.noTokensFoundError.code;
                         clientMismatchErrorWithFamilyRT = e instanceof ServerError && e.errorCode === Errors.INVALID_GRANT_ERROR && e.subError === Errors.CLIENT_MISMATCH_ERROR;
                         // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
                         if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
@@ -5253,7 +5563,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                 refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
                 // no refresh Token
                 if (!refreshToken) {
-                    throw ClientAuthError.createNoTokensFoundError();
+                    throw InteractionRequiredAuthError.createNoTokensFoundError();
                 }
                 refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                         credential: request.account.homeAccountId,
@@ -5281,7 +5591,13 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         thumbprint = {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
-                            scopes: request.scopes
+                            scopes: request.scopes,
+                            authenticationScheme: request.authenticationScheme,
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            resourceRequestUri: request.resourceRequestUri,
+                            shrClaims: request.shrClaims,
+                            sshJwk: request.sshJwk,
+                            sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
                         return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
@@ -5306,9 +5622,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, _a, _b, clientInfo;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
@@ -5333,12 +5649,22 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         }
                         if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                        _b = (_a = parameterBuilder).addPopToken;
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        _b.apply(_a, [_c.sent()]);
-                        _c.label = 2;
+                        cnfString = _a.sent();
+                        parameterBuilder.addPopToken(cnfString);
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _a.label = 3;
+                    case 3:
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
                         }
@@ -5473,7 +5799,13 @@ var ClientCredentialClient = /** @class */ (function (_super) {
                         thumbprint = {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
-                            scopes: request.scopes
+                            scopes: request.scopes,
+                            authenticationScheme: request.authenticationScheme,
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            resourceRequestUri: request.resourceRequestUri,
+                            shrClaims: request.shrClaims,
+                            sshJwk: request.sshJwk,
+                            sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint)];
@@ -5668,7 +6000,13 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                         thumbprint = {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
-                            scopes: request.scopes
+                            scopes: request.scopes,
+                            authenticationScheme: request.authenticationScheme,
+                            resourceRequestMethod: request.resourceRequestMethod,
+                            resourceRequestUri: request.resourceRequestUri,
+                            shrClaims: request.shrClaims,
+                            sshJwk: request.sshJwk,
+                            sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint)];
@@ -5768,6 +6106,17 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         if (!request) {
                             throw ClientConfigurationError.createEmptyTokenRequestError();
                         }
+                        if (request.forceRefresh) {
+                            // Must refresh due to present force_refresh flag.
+                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
+                        else if (!StringUtils.isEmptyObj(request.claims)) {
+                            // Must refresh due to request parameters.
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
                         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                         if (!request.account) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
@@ -5775,30 +6124,24 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         requestScopes = new ScopeSet(request.scopes || []);
                         environment = request.authority || this.authority.getPreferredCache();
                         authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme);
-                        if (request.forceRefresh) {
-                            // Must refresh due to present force_refresh flag.
-                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
-                        else if (!cacheRecord.accessToken) {
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                        if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
                             TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                             // Must refresh due to expired access_token.
                             (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
                             // Must refresh due to the refresh_in value.
                             (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         if (this.config.serverTelemetryManager) {
@@ -5882,7 +6225,13 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
                 thumbprint = {
                     clientId: this.config.authOptions.clientId,
                     authority: authority.canonicalAuthority,
-                    scopes: request.scopes
+                    scopes: request.scopes,
+                    authenticationScheme: request.authenticationScheme,
+                    resourceRequestMethod: request.resourceRequestMethod,
+                    resourceRequestUri: request.resourceRequestUri,
+                    shrClaims: request.shrClaims,
+                    sshJwk: request.sshJwk,
+                    sshKid: request.sshKid
                 };
                 requestBody = this.createTokenRequestBody(request);
                 headers = this.createTokenRequestHeaders({
@@ -5938,7 +6287,6 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
 function isOpenIdConfigResponse(response) {
     return (response.hasOwnProperty("authorization_endpoint") &&
         response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("end_session_endpoint") &&
         response.hasOwnProperty("issuer"));
 }
 
@@ -6020,7 +6368,6 @@ var AuthorityMetadataEntity = /** @class */ (function () {
             entity.hasOwnProperty("canonical_authority") &&
             entity.hasOwnProperty("authorization_endpoint") &&
             entity.hasOwnProperty("token_endpoint") &&
-            entity.hasOwnProperty("end_session_endpoint") &&
             entity.hasOwnProperty("issuer") &&
             entity.hasOwnProperty("aliasesFromNetwork") &&
             entity.hasOwnProperty("endpointsFromNetwork") &&
@@ -6302,6 +6649,10 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
+                // ROPC policies may not have end_session_endpoint set
+                if (!this.metadata.end_session_endpoint) {
+                    throw ClientAuthError.createLogoutNotSupportedError();
+                }
                 var endpoint = this.replacePath(this.metadata.end_session_endpoint);
                 return this.replaceTenant(endpoint);
             }
@@ -6702,7 +7053,9 @@ var Authority = /** @class */ (function () {
         metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
         metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
-        metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        if (metadata.end_session_endpoint) {
+            metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        }
         return metadata;
     };
     return Authority;
@@ -6837,6 +7190,63 @@ var StubbedNetworkModule = {
     }
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This is a helper class that parses supported HTTP response authentication headers to extract and return
+ * header challenge values that can be used outside the basic authorization flows.
+ */
+var AuthenticationHeaderParser = /** @class */ (function () {
+    function AuthenticationHeaderParser(headers) {
+        this.headers = headers;
+    }
+    /**
+     * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+     * @returns
+     */
+    AuthenticationHeaderParser.prototype.getShrNonce = function () {
+        // Attempt to parse nonce from Authentiacation-Info
+        var authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        if (authenticationInfo) {
+            var authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
+            if (authenticationInfoChallenges.nextnonce) {
+                return authenticationInfoChallenges.nextnonce;
+            }
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+        }
+        // Attempt to parse nonce from WWW-Authenticate
+        var wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        if (wwwAuthenticate) {
+            var wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
+            if (wwwAuthenticateChallenges.nonce) {
+                return wwwAuthenticateChallenges.nonce;
+            }
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+        }
+        // If neither header is present, throw missing headers error
+        throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
+    };
+    /**
+     * Parses an HTTP header's challenge set into a key/value map.
+     * @param header
+     * @returns
+     */
+    AuthenticationHeaderParser.prototype.parseChallenges = function (header) {
+        var schemeSeparator = header.indexOf(" ");
+        var challenges = header.substr(schemeSeparator + 1).split(",");
+        var challengeMap = {};
+        challenges.forEach(function (challenge) {
+            var _a = challenge.split("="), key = _a[0], value = _a[1];
+            // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
+            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+        });
+        return challengeMap;
+    };
+    return AuthenticationHeaderParser;
+}());
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7003,6 +7413,7 @@ exports.AppMetadataEntity = AppMetadataEntity;
 exports.AuthError = AuthError;
 exports.AuthErrorMessage = AuthErrorMessage;
 exports.AuthToken = AuthToken;
+exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
 exports.Authority = Authority;
 exports.AuthorityFactory = AuthorityFactory;
 exports.AuthorityMetadataEntity = AuthorityMetadataEntity;
@@ -7022,14 +7433,17 @@ exports.DeviceCodeClient = DeviceCodeClient;
 exports.IdToken = AuthToken;
 exports.IdTokenEntity = IdTokenEntity;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
+exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
 exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
 exports.OnBehalfOfClient = OnBehalfOfClient;
+exports.PopTokenGenerator = PopTokenGenerator;
 exports.PromptValue = PromptValue;
 exports.ProtocolUtils = ProtocolUtils;
 exports.RefreshTokenClient = RefreshTokenClient;
 exports.RefreshTokenEntity = RefreshTokenEntity;
+exports.ScopeSet = ScopeSet;
 exports.ServerError = ServerError;
 exports.ServerTelemetryEntity = ServerTelemetryEntity;
 exports.ServerTelemetryManager = ServerTelemetryManager;
@@ -7042,4 +7456,5 @@ exports.TimeUtils = TimeUtils;
 exports.TokenCacheContext = TokenCacheContext;
 exports.UrlString = UrlString;
 exports.UsernamePasswordClient = UsernamePasswordClient;
+exports.version = version;
 //# sourceMappingURL=index.cjs.js.map