@azure/msal-common 5.0.1 → 6.1.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.1 2021-10-05 */
+/*! @azure/msal-common v6.1.0 2022-02-08 */
 'use strict';
 'use strict';
 
@@ -102,6 +102,7 @@ var Constants = {
     // default authority
     DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
     DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",
+    DEFAULT_COMMON_TENANT: "common",
     // ADFS String
     ADFS: "adfs",
     // Default AAD Instance Discovery Endpoint
@@ -153,6 +154,8 @@ var HeaderNames;
     HeaderNames["CONTENT_TYPE"] = "Content-Type";
     HeaderNames["RETRY_AFTER"] = "Retry-After";
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
+    HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
+    HeaderNames["AuthenticationInfo"] = "Authentication-Info";
 })(HeaderNames || (HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
@@ -223,6 +226,8 @@ var AADServerParamKeys;
     AADServerParamKeys["ON_BEHALF_OF"] = "on_behalf_of";
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
+    AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+    AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
  * Claims request keys
@@ -387,8 +392,9 @@ var SERVER_TELEM_CONSTANTS = {
  */
 exports.AuthenticationScheme = void 0;
 (function (AuthenticationScheme) {
-    AuthenticationScheme["POP"] = "pop";
     AuthenticationScheme["BEARER"] = "Bearer";
+    AuthenticationScheme["POP"] = "pop";
+    AuthenticationScheme["SSH"] = "ssh-cert";
 })(exports.AuthenticationScheme || (exports.AuthenticationScheme = {}));
 /**
  * Constants related to throttling
@@ -556,6 +562,15 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
                 throw AuthError.createUnexpectedError(notImplErr);
             });
         });
+    },
+    hashString: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - hashString() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
     }
 };
 
@@ -743,6 +758,10 @@ var ClientAuthErrorMessage = {
     bindingKeyNotRemovedError: {
         code: "binding_key_not_removed",
         desc: "Could not remove the credential's binding key from storage."
+    },
+    logoutNotSupported: {
+        code: "end_session_endpoint_not_supported",
+        desc: "Provided authority does not support logout."
     }
 };
 /**
@@ -1006,6 +1025,12 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createBindingKeyNotRemovedError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.bindingKeyNotRemovedError.code, ClientAuthErrorMessage.bindingKeyNotRemovedError.desc);
     };
+    /**
+     * Thrown when logout is attempted for an authority that doesnt have an end_session_endpoint
+     */
+    ClientAuthError.createLogoutNotSupportedError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
+    };
     return ClientAuthError;
 }(AuthError));
 
@@ -1312,7 +1337,25 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "5.0.1";
+var version = "6.1.0";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+exports.AzureCloudInstance = void 0;
+(function (AzureCloudInstance) {
+    // AzureCloudInstance is not specified.
+    AzureCloudInstance[AzureCloudInstance["None"] = 0] = "None";
+    // Microsoft Azure public cloud
+    AzureCloudInstance["AzurePublic"] = "https://login.microsoftonline.com";
+    // Microsoft Chinese national cloud
+    AzureCloudInstance["AzureChina"] = "https://login.chinacloudapi.cn";
+    // Microsoft German national cloud ("Black Forest")
+    AzureCloudInstance["AzureGermany"] = "https://login.microsoftonline.de";
+    // US Government cloud
+    AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
+})(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1323,7 +1366,7 @@ var version = "5.0.1";
  *
  * Key:Value Schema:
  *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
  *
  * Value Schema:
  * {
@@ -1337,6 +1380,7 @@ var version = "5.0.1";
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
  *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1364,7 +1408,7 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      */
     CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
     };
     /**
      * returns the type of the cache (in this case credential)
@@ -1408,16 +1452,14 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
         var credentialKey = [
             this.generateAccountIdForCacheKey(homeAccountId, environment),
             this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target)
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType)
         ];
-        // PoP Tokens include scheme in cache key
-        if (tokenType === exports.AuthenticationScheme.POP) {
-            credentialKey.push(tokenType.toLowerCase());
-        }
         return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
@@ -1453,6 +1495,22 @@ var CredentialEntity = /** @class */ (function () {
     CredentialEntity.generateTargetForCacheKey = function (scopes) {
         return (scopes || "").toLowerCase();
     };
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+        return (requestedClaimsHash || "").toLowerCase();
+    };
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+    };
     return CredentialEntity;
 }());
 
@@ -1526,15 +1584,35 @@ var ClientConfigurationErrorMessage = {
     },
     invalidCloudDiscoveryMetadata: {
         code: "invalid_cloud_discovery_metadata",
-        desc: "Invalid cloudDiscoveryMetadata provided. Must be a JSON object containing tenant_discovery_endpoint and metadata fields"
+        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields"
     },
     invalidAuthorityMetadata: {
         code: "invalid_authority_metadata",
-        desc: "Invalid authorityMetadata provided. Must by a JSON object containing authorization_endpoint, token_endpoint, end_session_endpoint, issuer fields."
+        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields."
     },
     untrustedAuthority: {
         code: "untrusted_authority",
         desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter."
+    },
+    invalidAzureCloudInstance: {
+        code: "invalid_azure_cloud_instance",
+        desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values"
+    },
+    missingSshJwk: {
+        code: "missing_ssh_jwk",
+        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme."
+    },
+    missingSshKid: {
+        code: "missing_ssh_kid",
+        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme."
+    },
+    missingNonceAuthenticationHeader: {
+        code: "missing_nonce_authentication_header",
+        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce."
+    },
+    invalidAuthenticationHeader: {
+        code: "invalid_authentication_header",
+        desc: "Invalid authentication header provided"
     }
 };
 /**
@@ -1656,6 +1734,36 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     ClientConfigurationError.createUntrustedAuthorityError = function () {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
     };
+    /**
+     * Throws error when the AzureCloudInstance is set to an invalid value
+     */
+    ClientConfigurationError.createInvalidAzureCloudInstanceError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAzureCloudInstance.code, ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc);
+    };
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
+     */
+    ClientConfigurationError.createMissingSshJwkError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
+    };
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
+     */
+    ClientConfigurationError.createMissingSshKidError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
+    };
+    /**
+     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
+     */
+    ClientConfigurationError.createMissingNonceAuthenticationHeadersError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
+    };
+    /**
+     * Throws error when a provided header is invalid in any way
+     */
+    ClientConfigurationError.createInvalidAuthenticationHeaderError = function (invalidHeaderName, details) {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc + ". Invalid header: " + invalidHeaderName + ". Details: " + details);
+    };
     return ClientConfigurationError;
 }(ClientAuthError));
 
@@ -2246,7 +2354,8 @@ var CacheManager = /** @class */ (function () {
                             environment: credential.environment,
                             homeAccountId: credential.homeAccountId,
                             realm: credential.realm,
-                            tokenType: credential.tokenType
+                            tokenType: credential.tokenType,
+                            requestedClaimsHash: credential.requestedClaimsHash
                         });
                         currentScopes = ScopeSet.fromString(credential.target);
                         currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2318,7 +2427,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2331,7 +2440,7 @@ var CacheManager = /** @class */ (function () {
      * @param oboAssertion
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2378,27 +2487,37 @@ var CacheManager = /** @class */ (function () {
             if (!!target && !_this.matchTarget(entity, target)) {
                 return;
             }
+            // If request OR cached entity has requested Claims Hash, check if they match
+            if (requestedClaimsHash || entity.requestedClaimsHash) {
+                // Don't match if either is undefined or they are different
+                if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                    return;
+                }
+            }
+            // Access Token with Auth Scheme specific matching
             if (credentialType === exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                 if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                     return;
                 }
-                // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                    // AccessToken_With_AuthScheme that doesn't have pop in the key is outdated
-                    _this.removeItem(cacheKey, exports.CacheSchemaType.CREDENTIAL);
-                    return;
+                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                if (tokenType === exports.AuthenticationScheme.SSH) {
+                    if (keyId && !_this.matchKeyId(entity, keyId)) {
+                        return;
+                    }
                 }
             }
+            // At this point, the entity matches the request, update cache key if key schema has changed
+            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
             switch (credType) {
                 case exports.CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[cacheKey] = entity;
+                    matchingCredentials.idTokens[updatedCacheKey] = entity;
                     break;
                 case exports.CredentialType.ACCESS_TOKEN:
                 case exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[cacheKey] = entity;
+                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
                     break;
                 case exports.CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[cacheKey] = entity;
+                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                     break;
             }
         });
@@ -2557,6 +2676,7 @@ var CacheManager = /** @class */ (function () {
                     case 0:
                         key = credential.generateCredentialKey();
                         if (!(credential.credentialType.toLowerCase() === exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
+                        if (!(credential.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 4];
                         accessTokenWithAuthSchemeEntity = credential;
                         kid = accessTokenWithAuthSchemeEntity.keyId;
                         if (!kid) return [3 /*break*/, 4];
@@ -2596,10 +2716,10 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme) {
+    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
         var cachedAccount = this.readAccountFromCache(account);
         var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme);
+        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
         var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
         var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
         if (cachedAccount && cachedIdToken) {
@@ -2653,9 +2773,14 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme) {
-        // Distinguish between Bearer and PoP token cache types
-        var credentialType = (authScheme === exports.AuthenticationScheme.POP) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+        var scopes = new ScopeSet(request.scopes || []);
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
         var accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -2663,7 +2788,9 @@ var CacheManager = /** @class */ (function () {
             clientId: clientId,
             realm: account.tenantId,
             target: scopes.printScopesLowerCase(),
-            tokenType: authScheme
+            tokenType: authScheme,
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2816,6 +2943,14 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.matchTokenType = function (entity, tokenType) {
         return !!(entity.tokenType && entity.tokenType === tokenType);
     };
+    /**
+     * Returns true if the credential's keyId matches the one in the request, false otherwise
+     * @param entity
+     * @param tokenType
+     */
+    CacheManager.prototype.matchKeyId = function (entity, keyId) {
+        return !!(entity.keyId && entity.keyId === keyId);
+    };
     /**
      * returns if a given cache entity is of the type appmetadata
      * @param key
@@ -2964,6 +3099,10 @@ var DefaultStorageClass = /** @class */ (function (_super) {
             });
         });
     };
+    DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+        var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     return DefaultStorageClass;
 }(CacheManager));
 
@@ -2975,7 +3114,8 @@ var DefaultStorageClass = /** @class */ (function (_super) {
 var DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 var DEFAULT_SYSTEM_OPTIONS = {
     tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-    preventCorsPreflight: false
+    preventCorsPreflight: false,
+    proxyUrl: "",
 };
 var DEFAULT_LOGGER_IMPLEMENTATION = {
     loggerCallback: function () {
@@ -3015,6 +3155,10 @@ var DEFAULT_CLIENT_CREDENTIALS = {
     clientSecret: "",
     clientAssertion: undefined
 };
+var DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: exports.AzureCloudInstance.None,
+    tenant: "" + Constants.DEFAULT_COMMON_TENANT
+};
 /**
  * Function that sets the default options when not explicitly configured from app developer
  *
@@ -3044,7 +3188,7 @@ function buildClientConfiguration(_a) {
  * @param authOptions
  */
 function buildAuthOptions(authOptions) {
-    return __assign({ clientCapabilities: [] }, authOptions);
+    return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
 }
 
 /*
@@ -3146,10 +3290,12 @@ var ThrottlingUtils = /** @class */ (function () {
             authority: request.authority,
             scopes: request.scopes,
             homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
             authenticationScheme: request.authenticationScheme,
             resourceRequestMethod: request.resourceRequestMethod,
             resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
         return cacheManager.removeItem(key, exports.CacheSchemaType.THROTTLING);
@@ -3276,7 +3422,7 @@ var BaseClient = /** @class */ (function () {
             var response;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers })];
+                    case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers, proxyUrl: this.config.systemOptions.proxyUrl })];
                     case 1:
                         response = _a.sent();
                         if (this.config.serverTelemetryManager && response.status < 500 && response.status !== 429) {
@@ -3687,6 +3833,15 @@ var RequestParameterBuilder = /** @class */ (function () {
             this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
         }
     };
+    /**
+     * add SSH JWK and key ID to query params
+     */
+    RequestParameterBuilder.prototype.addSshJwk = function (sshJwkString) {
+        if (!StringUtils.isEmpty(sshJwkString)) {
+            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
+            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+        }
+    };
     /**
      * add server telemetry fields
      * @param serverTelemetryManager
@@ -3701,6 +3856,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addThrottling = function () {
         this.parameters.set(AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
     };
+    /**
+     * Adds logout_hint parameter for "silent" logout which prevent server account picker
+     */
+    RequestParameterBuilder.prototype.addLogoutHint = function (logoutHint) {
+        this.parameters.set(AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
+    };
     /**
      * Utility to create a URL from the params map
      */
@@ -3870,8 +4031,8 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion) {
-        var _a;
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+        var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
         atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN;
@@ -3893,15 +4054,28 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.target = scopes;
         atEntity.oboAssertion = oboAssertion;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-        // Create Access Token With AuthScheme instead of regular access token
-        if (atEntity.tokenType === exports.AuthenticationScheme.POP) {
+        if (requestedClaims) {
+            atEntity.requestedClaims = requestedClaims;
+            atEntity.requestedClaimsHash = requestedClaimsHash;
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
             atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            // Make sure keyId is present and add it to credential
-            var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-            if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                throw ClientAuthError.createTokenClaimsRequiredError();
+            switch (atEntity.tokenType) {
+                case exports.AuthenticationScheme.POP:
+                    // Make sure keyId is present and add it to credential
+                    var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
+                    if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
+                        throw ClientAuthError.createTokenClaimsRequiredError();
+                    }
+                    atEntity.keyId = tokenClaims.cnf.kid;
+                    break;
+                case exports.AuthenticationScheme.SSH:
+                    atEntity.keyId = keyId;
             }
-            atEntity.keyId = tokenClaims.cnf.kid;
         }
         return atEntity;
     };
@@ -4392,14 +4566,14 @@ var PopTokenGenerator = /** @class */ (function () {
     };
     PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
-            var resourceRequestMethod, resourceRequestUri, shrClaims, resourceUrlString, resourceUrlComponents;
+            var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims;
+                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4590,7 +4764,9 @@ var ResponseHandler = /** @class */ (function () {
                         if (!!authCodePayload && !!authCodePayload.state) {
                             requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
                         }
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                        // Add keyId from request to serverTokenResponse if defined
+                        serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4627,7 +4803,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
                 }
             });
         });
@@ -4638,7 +4814,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4654,7 +4830,7 @@ var ResponseHandler = /** @class */ (function () {
         var cachedAccessToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
             // If scopes not returned in server response, use request scopes
-            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -4666,7 +4842,7 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
@@ -4713,7 +4889,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
@@ -4762,7 +4938,8 @@ var ResponseHandler = /** @class */ (function () {
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                                code: code
                             }];
                 }
             });
@@ -4781,7 +4958,10 @@ var ResponseHandler = /** @class */ (function () {
 var AuthorizationCodeClient = /** @class */ (function (_super) {
     __extends(AuthorizationCodeClient, _super);
     function AuthorizationCodeClient(configuration) {
-        return _super.call(this, configuration) || this;
+        var _this = _super.call(this, configuration) || this;
+        // Flag to indicate if client is for hybrid spa auth code redemption
+        _this.includeRedirectUri = true;
+        return _this;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -4881,10 +5061,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.createTokenRequestBody(request)];
                     case 1:
@@ -4928,13 +5110,24 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
-                        // validate the redirectUri (to be a non null value)
-                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        /*
+                         * For hybrid spa flow, there will be a code but no verifier
+                         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+                         */
+                        if (!this.includeRedirectUri) {
+                            // Just validate
+                            RequestValidator.validateRedirectUri(request.redirectUri);
+                        }
+                        else {
+                            // Validate and include redirect uri
+                            parameterBuilder.addRedirectUri(request.redirectUri);
+                        }
                         // Add scope array, parameter builder will add default scopes and dedupe
                         parameterBuilder.addScopes(request.scopes);
                         // add code: user set, not validated
@@ -4963,10 +5156,20 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
+                        cnfString = _b.sent();
                         parameterBuilder.addPopToken(cnfString);
-                        _a.label = 2;
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _b.label = 3;
+                    case 3:
                         correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                         parameterBuilder.addCorrelationId(correlationId);
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
@@ -5005,6 +5208,15 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                     break;
                             }
                         }
+                        if (request.tokenBodyParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                        }
+                        // Add hybrid spa parameters if not already provided
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                            parameterBuilder.addExtraQueryParameters((_a = {},
+                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a));
+                        }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
@@ -5123,6 +5335,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         if (request.state) {
             parameterBuilder.addState(request.state);
         }
+        if (request.logoutHint) {
+            parameterBuilder.addLogoutHint(request.logoutHint);
+        }
         if (request.extraQueryParameters) {
             parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
         }
@@ -5195,10 +5410,12 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                     clientId: this.config.authOptions.clientId,
                     authority: request.authority,
                     scopes: request.scopes,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
-                    shrClaims: request.shrClaims
+                    shrClaims: request.shrClaims,
+                    sshKid: request.sshKid
                 };
                 return [2 /*return*/, this.executePostRequestToDeviceCodeEndpoint(this.authority.deviceCodeEndpoint, queryString, headers, thumbprint)];
             });
@@ -5217,7 +5434,8 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                 switch (_b.label) {
                     case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, deviceCodeEndpoint, {
                             body: queryString,
-                            headers: headers
+                            headers: headers,
+                            proxyUrl: this.config.systemOptions.proxyUrl
                         })];
                     case 1:
                         _a = (_b.sent()).body, userCode = _a.user_code, deviceCode = _a.device_code, verificationUri = _a.verification_uri, expiresIn = _a.expires_in, interval = _a.interval, message = _a.message;
@@ -5292,10 +5510,12 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.executePostToTokenEndpoint(this.authority.tokenEndpoint, requestBody, headers, thumbprint)];
                     case 2:
@@ -5458,10 +5678,12 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
                         return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
@@ -5486,9 +5708,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, _a, _b, clientInfo;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
@@ -5513,12 +5735,22 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         }
                         if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                        _b = (_a = parameterBuilder).addPopToken;
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        _b.apply(_a, [_c.sent()]);
-                        _c.label = 2;
+                        cnfString = _a.sent();
+                        parameterBuilder.addPopToken(cnfString);
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _a.label = 3;
+                    case 3:
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
                         }
@@ -5654,10 +5886,12 @@ var ClientCredentialClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint)];
@@ -5853,10 +6087,12 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint)];
@@ -5948,7 +6184,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     SilentFlowClient.prototype.acquireCachedToken = function (request) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var requestScopes, environment, authScheme, cacheRecord;
+            var environment, cacheRecord;
             return __generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -5956,37 +6192,35 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         if (!request) {
                             throw ClientConfigurationError.createEmptyTokenRequestError();
                         }
-                        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
-                        if (!request.account) {
-                            throw ClientAuthError.createNoAccountInSilentRequestError();
-                        }
-                        requestScopes = new ScopeSet(request.scopes || []);
-                        environment = request.authority || this.authority.getPreferredCache();
-                        authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme);
                         if (request.forceRefresh) {
                             // Must refresh due to present force_refresh flag.
                             (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
-                        else if (!cacheRecord.accessToken) {
+                        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+                        if (!request.account) {
+                            throw ClientAuthError.createNoAccountInSilentRequestError();
+                        }
+                        environment = request.authority || this.authority.getPreferredCache();
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
+                        if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
                             TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                             // Must refresh due to expired access_token.
                             (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
                             // Must refresh due to the refresh_in value.
                             (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         if (this.config.serverTelemetryManager) {
@@ -6071,10 +6305,12 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
                     clientId: this.config.authOptions.clientId,
                     authority: authority.canonicalAuthority,
                     scopes: request.scopes,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
-                    shrClaims: request.shrClaims
+                    shrClaims: request.shrClaims,
+                    sshKid: request.sshKid
                 };
                 requestBody = this.createTokenRequestBody(request);
                 headers = this.createTokenRequestHeaders({
@@ -6130,7 +6366,6 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
 function isOpenIdConfigResponse(response) {
     return (response.hasOwnProperty("authorization_endpoint") &&
         response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("end_session_endpoint") &&
         response.hasOwnProperty("issuer"));
 }
 
@@ -6212,7 +6447,6 @@ var AuthorityMetadataEntity = /** @class */ (function () {
             entity.hasOwnProperty("canonical_authority") &&
             entity.hasOwnProperty("authorization_endpoint") &&
             entity.hasOwnProperty("token_endpoint") &&
-            entity.hasOwnProperty("end_session_endpoint") &&
             entity.hasOwnProperty("issuer") &&
             entity.hasOwnProperty("aliasesFromNetwork") &&
             entity.hasOwnProperty("endpointsFromNetwork") &&
@@ -6243,18 +6477,22 @@ var RegionDiscovery = /** @class */ (function () {
      *
      * @returns Promise<string | null>
      */
-    RegionDiscovery.prototype.detectRegion = function (environmentRegion, regionDiscoveryMetadata) {
+    RegionDiscovery.prototype.detectRegion = function (environmentRegion, regionDiscoveryMetadata, proxyUrl) {
         return __awaiter(this, void 0, void 0, function () {
-            var autodetectedRegionName, localIMDSVersionResponse, currentIMDSVersion, currentIMDSVersionResponse;
+            var autodetectedRegionName, options, localIMDSVersionResponse, currentIMDSVersion, currentIMDSVersionResponse;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         autodetectedRegionName = environmentRegion;
                         if (!!autodetectedRegionName) return [3 /*break*/, 8];
+                        options = RegionDiscovery.IMDS_OPTIONS;
+                        if (proxyUrl) {
+                            options.proxyUrl = proxyUrl;
+                        }
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 6, , 7]);
-                        return [4 /*yield*/, this.getRegionFromIMDS(Constants.IMDS_VERSION)];
+                        return [4 /*yield*/, this.getRegionFromIMDS(Constants.IMDS_VERSION, options)];
                     case 2:
                         localIMDSVersionResponse = _a.sent();
                         if (localIMDSVersionResponse.status === ResponseCodes.httpSuccess) {
@@ -6262,14 +6500,14 @@ var RegionDiscovery = /** @class */ (function () {
                             regionDiscoveryMetadata.region_source = RegionDiscoverySources.IMDS;
                         }
                         if (!(localIMDSVersionResponse.status === ResponseCodes.httpBadRequest)) return [3 /*break*/, 5];
-                        return [4 /*yield*/, this.getCurrentVersion()];
+                        return [4 /*yield*/, this.getCurrentVersion(options)];
                     case 3:
                         currentIMDSVersion = _a.sent();
                         if (!currentIMDSVersion) {
                             regionDiscoveryMetadata.region_source = RegionDiscoverySources.FAILED_AUTO_DETECTION;
                             return [2 /*return*/, null];
                         }
-                        return [4 /*yield*/, this.getRegionFromIMDS(currentIMDSVersion)];
+                        return [4 /*yield*/, this.getRegionFromIMDS(currentIMDSVersion, options)];
                     case 4:
                         currentIMDSVersionResponse = _a.sent();
                         if (currentIMDSVersionResponse.status === ResponseCodes.httpSuccess) {
@@ -6302,10 +6540,10 @@ var RegionDiscovery = /** @class */ (function () {
      * @param imdsEndpointUrl
      * @returns Promise<NetworkResponse<string>>
      */
-    RegionDiscovery.prototype.getRegionFromIMDS = function (version) {
+    RegionDiscovery.prototype.getRegionFromIMDS = function (version, options) {
         return __awaiter(this, void 0, void 0, function () {
             return __generator(this, function (_a) {
-                return [2 /*return*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?api-version=" + version + "&format=text", RegionDiscovery.IMDS_OPTIONS, Constants.IMDS_TIMEOUT)];
+                return [2 /*return*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?api-version=" + version + "&format=text", options, Constants.IMDS_TIMEOUT)];
             });
         });
     };
@@ -6314,14 +6552,14 @@ var RegionDiscovery = /** @class */ (function () {
      *
      * @returns Promise<string | null>
      */
-    RegionDiscovery.prototype.getCurrentVersion = function () {
+    RegionDiscovery.prototype.getCurrentVersion = function (options) {
         return __awaiter(this, void 0, void 0, function () {
             var response;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         _a.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?format=json", RegionDiscovery.IMDS_OPTIONS)];
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?format=json", options)];
                     case 1:
                         response = _a.sent();
                         // When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
@@ -6338,7 +6576,11 @@ var RegionDiscovery = /** @class */ (function () {
         });
     };
     // Options for the IMDS endpoint request
-    RegionDiscovery.IMDS_OPTIONS = { headers: { "Metadata": "true" } };
+    RegionDiscovery.IMDS_OPTIONS = {
+        headers: {
+            Metadata: "true",
+        },
+    };
     return RegionDiscovery;
 }());
 
@@ -6351,7 +6593,7 @@ var RegionDiscovery = /** @class */ (function () {
  * endpoint. It will store the pertinent config data in this object for use during token calls.
  */
 var Authority = /** @class */ (function () {
-    function Authority(authority, networkInterface, cacheManager, authorityOptions) {
+    function Authority(authority, networkInterface, cacheManager, authorityOptions, proxyUrl) {
         this.canonicalAuthority = authority;
         this._canonicalAuthority.validateAsUri();
         this.networkInterface = networkInterface;
@@ -6359,6 +6601,7 @@ var Authority = /** @class */ (function () {
         this.authorityOptions = authorityOptions;
         this.regionDiscovery = new RegionDiscovery(networkInterface);
         this.regionDiscoveryMetadata = { region_used: undefined, region_source: undefined, region_outcome: undefined };
+        this.proxyUrl = proxyUrl || Constants.EMPTY_STRING;
     }
     Object.defineProperty(Authority.prototype, "authorityType", {
         // See above for AuthorityType
@@ -6494,6 +6737,10 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
+                // ROPC policies may not have end_session_endpoint set
+                if (!this.metadata.end_session_endpoint) {
+                    throw ClientAuthError.createLogoutNotSupportedError();
+                }
                 var endpoint = this.replacePath(this.metadata.end_session_endpoint);
                 return this.replaceTenant(endpoint);
             }
@@ -6623,7 +6870,7 @@ var Authority = /** @class */ (function () {
                         metadata = _b.sent();
                         if (!metadata) return [3 /*break*/, 4];
                         if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
-                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata)];
+                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
                     case 2:
                         autodetectedRegionName = _b.sent();
                         azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
@@ -6686,19 +6933,25 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.getEndpointMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var response;
+            var options, response;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        _a.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint)];
+                        options = {};
+                        if (this.proxyUrl) {
+                            options.proxyUrl = this.proxyUrl;
+                        }
+                        _a.label = 1;
                     case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                    case 2:
                         response = _a.sent();
                         return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
-                    case 2:
+                    case 3:
                         _a.sent();
                         return [2 /*return*/, null];
-                    case 3: return [2 /*return*/];
+                    case 4: return [2 /*return*/];
                 }
             });
         });
@@ -6768,16 +7021,20 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var instanceDiscoveryEndpoint, match, response, metadata;
+            var instanceDiscoveryEndpoint, options, match, response, metadata;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         instanceDiscoveryEndpoint = "" + Constants.AAD_INSTANCE_DISCOVERY_ENDPT + this.canonicalAuthority + "oauth2/v2.0/authorize";
+                        options = {};
+                        if (this.proxyUrl) {
+                            options.proxyUrl = this.proxyUrl;
+                        }
                         match = null;
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint)];
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                     case 2:
                         response = _a.sent();
                         metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
@@ -6792,7 +7049,7 @@ var Authority = /** @class */ (function () {
                         return [2 /*return*/, null];
                     case 4:
                         if (!match) {
-                            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded 
+                            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded
                             match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
                         }
                         return [2 /*return*/, match];
@@ -6810,6 +7067,19 @@ var Authority = /** @class */ (function () {
         });
         return matches.length > 0;
     };
+    /**
+     * helper function to populate the authority based on azureCloudOptions
+     * @param authorityString
+     * @param azureCloudOptions
+     */
+    Authority.generateAuthority = function (authorityString, azureCloudOptions) {
+        var authorityAzureCloudInstance;
+        if (azureCloudOptions && azureCloudOptions.azureCloudInstance !== exports.AzureCloudInstance.None) {
+            var tenant = azureCloudOptions.tenant ? azureCloudOptions.tenant : Constants.DEFAULT_COMMON_TENANT;
+            authorityAzureCloudInstance = azureCloudOptions.azureCloudInstance + "/" + tenant + "/";
+        }
+        return authorityAzureCloudInstance ? authorityAzureCloudInstance : authorityString;
+    };
     /**
      * Creates cloud discovery metadata object from a given host
      * @param host
@@ -6894,7 +7164,9 @@ var Authority = /** @class */ (function () {
         metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
         metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
-        metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        if (metadata.end_session_endpoint) {
+            metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        }
         return metadata;
     };
     return Authority;
@@ -6917,13 +7189,13 @@ var AuthorityFactory = /** @class */ (function () {
      * @param networkClient
      * @param protocolMode
      */
-    AuthorityFactory.createDiscoveredInstance = function (authorityUri, networkClient, cacheManager, authorityOptions) {
+    AuthorityFactory.createDiscoveredInstance = function (authorityUri, networkClient, cacheManager, authorityOptions, proxyUrl) {
         return __awaiter(this, void 0, void 0, function () {
             var acquireTokenAuthority, e_1;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        acquireTokenAuthority = AuthorityFactory.createInstance(authorityUri, networkClient, cacheManager, authorityOptions);
+                        acquireTokenAuthority = AuthorityFactory.createInstance(authorityUri, networkClient, cacheManager, authorityOptions, proxyUrl);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
@@ -6949,12 +7221,12 @@ var AuthorityFactory = /** @class */ (function () {
      * @param networkInterface
      * @param protocolMode
      */
-    AuthorityFactory.createInstance = function (authorityUrl, networkInterface, cacheManager, authorityOptions) {
+    AuthorityFactory.createInstance = function (authorityUrl, networkInterface, cacheManager, authorityOptions, proxyUrl) {
         // Throw error if authority url is empty
         if (StringUtils.isEmpty(authorityUrl)) {
             throw ClientConfigurationError.createUrlEmptyError();
         }
-        return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions);
+        return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions, proxyUrl);
     };
     return AuthorityFactory;
 }());
@@ -7029,6 +7301,63 @@ var StubbedNetworkModule = {
     }
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This is a helper class that parses supported HTTP response authentication headers to extract and return
+ * header challenge values that can be used outside the basic authorization flows.
+ */
+var AuthenticationHeaderParser = /** @class */ (function () {
+    function AuthenticationHeaderParser(headers) {
+        this.headers = headers;
+    }
+    /**
+     * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+     * @returns
+     */
+    AuthenticationHeaderParser.prototype.getShrNonce = function () {
+        // Attempt to parse nonce from Authentiacation-Info
+        var authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        if (authenticationInfo) {
+            var authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
+            if (authenticationInfoChallenges.nextnonce) {
+                return authenticationInfoChallenges.nextnonce;
+            }
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+        }
+        // Attempt to parse nonce from WWW-Authenticate
+        var wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        if (wwwAuthenticate) {
+            var wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
+            if (wwwAuthenticateChallenges.nonce) {
+                return wwwAuthenticateChallenges.nonce;
+            }
+            throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+        }
+        // If neither header is present, throw missing headers error
+        throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
+    };
+    /**
+     * Parses an HTTP header's challenge set into a key/value map.
+     * @param header
+     * @returns
+     */
+    AuthenticationHeaderParser.prototype.parseChallenges = function (header) {
+        var schemeSeparator = header.indexOf(" ");
+        var challenges = header.substr(schemeSeparator + 1).split(",");
+        var challengeMap = {};
+        challenges.forEach(function (challenge) {
+            var _a = challenge.split("="), key = _a[0], value = _a[1];
+            // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
+            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+        });
+        return challengeMap;
+    };
+    return AuthenticationHeaderParser;
+}());
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7195,6 +7524,7 @@ exports.AppMetadataEntity = AppMetadataEntity;
 exports.AuthError = AuthError;
 exports.AuthErrorMessage = AuthErrorMessage;
 exports.AuthToken = AuthToken;
+exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
 exports.Authority = Authority;
 exports.AuthorityFactory = AuthorityFactory;
 exports.AuthorityMetadataEntity = AuthorityMetadataEntity;