@azure/msal-common 5.2.0 → 6.0.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 'use strict';
 'use strict';
 
@@ -560,6 +560,15 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
                 throw AuthError.createUnexpectedError(notImplErr);
             });
         });
+    },
+    hashString: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - hashString() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
     }
 };
 
@@ -1326,7 +1335,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "5.2.0";
+var version = "6.0.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1337,7 +1346,7 @@ var version = "5.2.0";
  *
  * Key:Value Schema:
  *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
  *
  * Value Schema:
  * {
@@ -1351,6 +1360,7 @@ var version = "5.2.0";
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
  *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1378,7 +1388,7 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      */
     CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
     };
     /**
      * returns the type of the cache (in this case credential)
@@ -1422,16 +1432,14 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
         var credentialKey = [
             this.generateAccountIdForCacheKey(homeAccountId, environment),
             this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target)
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType)
         ];
-        // PoP Tokens and SSH certs include scheme in cache key
-        if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
-            credentialKey.push(tokenType.toLowerCase());
-        }
         return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
@@ -1467,6 +1475,22 @@ var CredentialEntity = /** @class */ (function () {
     CredentialEntity.generateTargetForCacheKey = function (scopes) {
         return (scopes || "").toLowerCase();
     };
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+        return (requestedClaimsHash || "").toLowerCase();
+    };
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+    };
     return CredentialEntity;
 }());
 
@@ -2300,7 +2324,8 @@ var CacheManager = /** @class */ (function () {
                             environment: credential.environment,
                             homeAccountId: credential.homeAccountId,
                             realm: credential.realm,
-                            tokenType: credential.tokenType
+                            tokenType: credential.tokenType,
+                            requestedClaimsHash: credential.requestedClaimsHash
                         });
                         currentScopes = ScopeSet.fromString(credential.target);
                         currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2372,7 +2397,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2385,7 +2410,7 @@ var CacheManager = /** @class */ (function () {
      * @param oboAssertion
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2432,38 +2457,37 @@ var CacheManager = /** @class */ (function () {
             if (!!target && !_this.matchTarget(entity, target)) {
                 return;
             }
+            // If request OR cached entity has requested Claims Hash, check if they match
+            if (requestedClaimsHash || entity.requestedClaimsHash) {
+                // Don't match if either is undefined or they are different
+                if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                    return;
+                }
+            }
             // Access Token with Auth Scheme specific matching
             if (credentialType === exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                 if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                     return;
                 }
-                switch (tokenType) {
-                    case exports.AuthenticationScheme.POP:
-                        // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                        if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                            // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
-                            _this.removeItem(cacheKey, exports.CacheSchemaType.CREDENTIAL);
-                            return;
-                        }
-                        break;
-                    case exports.AuthenticationScheme.SSH:
-                        // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                        if (keyId && !_this.matchKeyId(entity, keyId)) {
-                            return;
-                        }
-                        break;
+                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                if (tokenType === exports.AuthenticationScheme.SSH) {
+                    if (keyId && !_this.matchKeyId(entity, keyId)) {
+                        return;
+                    }
                 }
             }
+            // At this point, the entity matches the request, update cache key if key schema has changed
+            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
             switch (credType) {
                 case exports.CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[cacheKey] = entity;
+                    matchingCredentials.idTokens[updatedCacheKey] = entity;
                     break;
                 case exports.CredentialType.ACCESS_TOKEN:
                 case exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[cacheKey] = entity;
+                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
                     break;
                 case exports.CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[cacheKey] = entity;
+                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                     break;
             }
         });
@@ -2662,10 +2686,10 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
+    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
         var cachedAccount = this.readAccountFromCache(account);
         var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
+        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
         var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
         var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
         if (cachedAccount && cachedIdToken) {
@@ -2719,9 +2743,14 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
-        // Distinguish between Bearer and PoP/SSH token cache types
-        var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+        var scopes = new ScopeSet(request.scopes || []);
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
         var accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -2730,7 +2759,8 @@ var CacheManager = /** @class */ (function () {
             realm: account.tenantId,
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
-            keyId: keyId
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -3039,6 +3069,10 @@ var DefaultStorageClass = /** @class */ (function (_super) {
             });
         });
     };
+    DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+        var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     return DefaultStorageClass;
 }(CacheManager));
 
@@ -3221,11 +3255,11 @@ var ThrottlingUtils = /** @class */ (function () {
             authority: request.authority,
             scopes: request.scopes,
             homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
             authenticationScheme: request.authenticationScheme,
             resourceRequestMethod: request.resourceRequestMethod,
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
-            sshJwk: request.sshJwk,
             sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
@@ -3956,8 +3990,8 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
-        var _a;
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+        var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
         atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN;
@@ -3979,14 +4013,21 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.target = scopes;
         atEntity.oboAssertion = oboAssertion;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-        // Create Access Token With Auth Scheme instead of regular access token
-        if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
+        if (requestedClaims) {
+            atEntity.requestedClaims = requestedClaims;
+            atEntity.requestedClaimsHash = requestedClaimsHash;
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
             atEntity.credentialType = exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
             switch (atEntity.tokenType) {
                 case exports.AuthenticationScheme.POP:
                     // Make sure keyId is present and add it to credential
                     var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                    if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                    if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
                         throw ClientAuthError.createTokenClaimsRequiredError();
                     }
                     atEntity.keyId = tokenClaims.cnf.kid;
@@ -4684,7 +4725,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4732,7 +4773,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4748,7 +4789,7 @@ var ResponseHandler = /** @class */ (function () {
         var cachedAccessToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
             // If scopes not returned in server response, use request scopes
-            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -4760,7 +4801,7 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
@@ -4979,11 +5020,11 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.createTokenRequestBody(request)];
@@ -5325,11 +5366,11 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                     clientId: this.config.authOptions.clientId,
                     authority: request.authority,
                     scopes: request.scopes,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
                     shrClaims: request.shrClaims,
-                    sshJwk: request.sshJwk,
                     sshKid: request.sshKid
                 };
                 return [2 /*return*/, this.executePostRequestToDeviceCodeEndpoint(this.authority.deviceCodeEndpoint, queryString, headers, thumbprint)];
@@ -5424,11 +5465,11 @@ var DeviceCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.executePostToTokenEndpoint(this.authority.tokenEndpoint, requestBody, headers, thumbprint)];
@@ -5592,11 +5633,11 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
@@ -5800,11 +5841,11 @@ var ClientCredentialClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
@@ -6001,11 +6042,11 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: request.authority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
@@ -6098,7 +6139,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     SilentFlowClient.prototype.acquireCachedToken = function (request) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var requestScopes, environment, authScheme, cacheRecord;
+            var environment, cacheRecord;
             return __generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -6112,19 +6153,12 @@ var SilentFlowClient = /** @class */ (function (_super) {
                             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
-                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
                         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                         if (!request.account) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
                         }
-                        requestScopes = new ScopeSet(request.scopes || []);
                         environment = request.authority || this.authority.getPreferredCache();
-                        authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
                         if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -6226,11 +6260,11 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
                     clientId: this.config.authOptions.clientId,
                     authority: authority.canonicalAuthority,
                     scopes: request.scopes,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
                     shrClaims: request.shrClaims,
-                    sshJwk: request.sshJwk,
                     sshKid: request.sshKid
                 };
                 requestBody = this.createTokenRequestBody(request);