@azure/msal-common 6.4.0 → 7.0.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v6.4.0 2022-06-06 */
+/*! @azure/msal-common v7.0.0 2022-06-13 */
 'use strict';
 'use strict';
 
@@ -1357,7 +1357,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "6.4.0";
+var version = "7.0.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1400,9 +1400,9 @@ exports.AzureCloudInstance = void 0;
  *      familyId: Family ID identifier, usually only used for refresh tokens
  *      realm: Full tenant or organizational identifier that the account belongs to
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
  *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+ *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -2043,7 +2043,6 @@ exports.AuthorityType = void 0;
  *      clientInfo: Full base64 encoded client info received from ESTS
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
  * }
@@ -2122,7 +2121,7 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
@@ -2136,7 +2135,6 @@ var AccountEntity = /** @class */ (function () {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         if (idToken) {
             account.idTokenClaims = idToken.claims;
             // How do you account for MSA CID here?
@@ -2157,14 +2155,13 @@ var AccountEntity = /** @class */ (function () {
      * @param authority
      * @param idToken
      */
-    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
         account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         var env = environment || authority && authority.getPreferredCache();
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2453,7 +2450,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2463,10 +2460,10 @@ var CacheManager = /** @class */ (function () {
      * @param clientId
      * @param realm
      * @param target
-     * @param oboAssertion
+     * @param userAssertionHash
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2485,7 +2482,7 @@ var CacheManager = /** @class */ (function () {
             if (!entity) {
                 return;
             }
-            if (!!oboAssertion && !_this.matchOboAssertion(entity, oboAssertion)) {
+            if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                 return;
             }
             if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
@@ -2816,7 +2813,7 @@ var CacheManager = /** @class */ (function () {
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
             keyId: request.sshKid,
-            requestedClaimsHash: request.requestedClaimsHash
+            requestedClaimsHash: request.requestedClaimsHash,
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2842,7 +2839,7 @@ var CacheManager = /** @class */ (function () {
             environment: account.environment,
             credentialType: exports.CredentialType.REFRESH_TOKEN,
             clientId: clientId,
-            familyId: id
+            familyId: id,
         };
         var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
         var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
@@ -2894,8 +2891,8 @@ var CacheManager = /** @class */ (function () {
      * @param value
      * @param oboAssertion
      */
-    CacheManager.prototype.matchOboAssertion = function (entity, oboAssertion) {
-        return !!(entity.oboAssertion && oboAssertion === entity.oboAssertion);
+    CacheManager.prototype.matchUserAssertionHash = function (entity, userAssertionHash) {
+        return !!(entity.userAssertionHash && userAssertionHash === entity.userAssertionHash);
     };
     /**
      * helper to match environment
@@ -3796,14 +3793,18 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param clientAssertion
      */
     RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        if (!StringUtils.isEmpty(clientAssertion)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        }
     };
     /**
      * add clientAssertionType for confidential client flows
      * @param clientAssertionType
      */
     RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        if (!StringUtils.isEmpty(clientAssertionType)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        }
     };
     /**
      * add OBO assertion for confidential client flows
@@ -3969,7 +3970,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId, oboAssertion) {
+    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId) {
         var idTokenEntity = new IdTokenEntity();
         idTokenEntity.credentialType = exports.CredentialType.ID_TOKEN;
         idTokenEntity.homeAccountId = homeAccountId;
@@ -3977,7 +3978,6 @@ var IdTokenEntity = /** @class */ (function (_super) {
         idTokenEntity.clientId = clientId;
         idTokenEntity.secret = idToken;
         idTokenEntity.realm = tenantId;
-        idTokenEntity.oboAssertion = oboAssertion;
         return idTokenEntity;
     };
     /**
@@ -4092,7 +4092,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
         var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
@@ -4113,7 +4113,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.clientId = clientId;
         atEntity.realm = tenantId;
         atEntity.target = scopes;
-        atEntity.oboAssertion = oboAssertion;
+        atEntity.userAssertionHash = userAssertionHash;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
         if (requestedClaims) {
             atEntity.requestedClaims = requestedClaims;
@@ -4195,14 +4195,14 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, oboAssertion) {
+    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
         var rtEntity = new RefreshTokenEntity();
         rtEntity.clientId = clientId;
         rtEntity.credentialType = exports.CredentialType.REFRESH_TOKEN;
         rtEntity.environment = environment;
         rtEntity.homeAccountId = homeAccountId;
         rtEntity.secret = refreshToken;
-        rtEntity.oboAssertion = oboAssertion;
+        rtEntity.userAssertionHash = userAssertionHash;
         if (familyId)
             rtEntity.familyId = familyId;
         return rtEntity;
@@ -4831,7 +4831,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, oboAssertion, handlingRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse) {
         return __awaiter(this, void 0, void 0, function () {
             var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
@@ -4853,7 +4853,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4901,7 +4901,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4910,8 +4910,8 @@ var ResponseHandler = /** @class */ (function () {
         var cachedIdToken;
         var cachedAccount;
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING, oboAssertion);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, oboAssertion, authCodePayload);
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
         }
         // AccessToken
         var cachedAccessToken = null;
@@ -4929,12 +4929,12 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
-            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, oboAssertion);
+            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
         }
         // appMetadata
         var cachedAppMetadata = null;
@@ -4949,22 +4949,22 @@ var ResponseHandler = /** @class */ (function () {
      * @param idToken
      * @param authority
      */
-    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
         var authorityType = authority.authorityType;
         var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
         var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
         // ADFS does not require client_info in the response
         if (authorityType === exports.AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
         }
         // This fallback applies to B2C as well as they fall under an AAD account type.
         if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
             throw ClientAuthError.createClientInfoEmptyError();
         }
         return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
+            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
     };
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -5242,8 +5242,8 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         if (this.config.clientCredentials.clientSecret) {
                             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                         }
-                        clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-                        if (clientAssertion) {
+                        if (this.config.clientCredentials.clientAssertion) {
+                            clientAssertion = this.config.clientCredentials.clientAssertion;
                             parameterBuilder.addClientAssertion(clientAssertion.assertion);
                             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                         }
@@ -5846,8 +5846,8 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         if (this.config.clientCredentials.clientSecret) {
                             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                         }
-                        clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-                        if (clientAssertion) {
+                        if (this.config.clientCredentials.clientAssertion) {
+                            clientAssertion = this.config.clientCredentials.clientAssertion;
                             parameterBuilder.addClientAssertion(clientAssertion.assertion);
                             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                         }
@@ -6078,44 +6078,64 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
      */
     OnBehalfOfClient.prototype.acquireToken = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var cachedAuthenticationResult;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         this.scopeSet = new ScopeSet(request.scopes || []);
-                        if (!request.skipCache) return [3 /*break*/, 2];
-                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
-                    case 1: return [2 /*return*/, _a.sent()];
-                    case 2: return [4 /*yield*/, this.getCachedAuthenticationResult(request)];
+                        // generate the user_assertion_hash for OBOAssertion
+                        _a = this;
+                        return [4 /*yield*/, this.cryptoUtils.hashString(request.oboAssertion)];
+                    case 1:
+                        // generate the user_assertion_hash for OBOAssertion
+                        _a.userAssertionHash = _b.sent();
+                        if (!request.skipCache) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority, this.userAssertionHash)];
+                    case 2: return [2 /*return*/, _b.sent()];
                     case 3:
-                        cachedAuthenticationResult = _a.sent();
-                        if (!cachedAuthenticationResult) return [3 /*break*/, 4];
-                        return [2 /*return*/, cachedAuthenticationResult];
-                    case 4: return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
-                    case 5: return [2 /*return*/, _a.sent()];
+                        _b.trys.push([3, 5, , 7]);
+                        return [4 /*yield*/, this.getCachedAuthenticationResult(request)];
+                    case 4: return [2 /*return*/, _b.sent()];
+                    case 5:
+                        _b.sent();
+                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority, this.userAssertionHash)];
+                    case 6: 
+                    // Any failure falls back to interactive request, once we implement distributed cache, we plan to handle `createRefreshRequiredError` to refresh using the RT
+                    return [2 /*return*/, _b.sent()];
+                    case 7: return [2 /*return*/];
                 }
             });
         });
     };
     /**
      * look up cache for tokens
+     * Find idtoken in the cache
+     * Find accessToken based on user assertion and account info in the cache
+     * Please note we are not yet supported OBO tokens refreshed with long lived RT. User will have to send a new assertion if the current access token expires
+     * This is to prevent security issues when the assertion changes over time, however, longlived RT helps retaining the session
      * @param request
      */
     OnBehalfOfClient.prototype.getCachedAuthenticationResult = function (request) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
             var cachedAccessToken, cachedIdToken, idTokenObject, cachedAccount, localAccountId, accountInfo;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
-                        cachedAccessToken = this.readAccessTokenFromCache();
-                        if (!cachedAccessToken ||
-                            TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-                            // Update the server telemetry outcome
-                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(!cachedAccessToken ? CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED : CacheOutcome.NO_CACHED_ACCESS_TOKEN);
-                            return [2 /*return*/, null];
+                        cachedAccessToken = this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId, request);
+                        if (!cachedAccessToken) {
+                            // Must refresh due to non-existent access_token.
+                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
+                        else if (TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+                            // Access token expired, will need to renewed
+                            (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
+                            throw ClientAuthError.createRefreshRequiredError();
                         }
-                        cachedIdToken = this.readIdTokenFromCache(request);
+                        cachedIdToken = this.readIdTokenFromCacheForOBO(request, cachedAccessToken.homeAccountId);
                         cachedAccount = null;
                         if (cachedIdToken) {
                             idTokenObject = new AuthToken(cachedIdToken.secret, this.config.cryptoInterface);
@@ -6127,7 +6147,11 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 username: Constants.EMPTY_STRING,
                                 localAccountId: localAccountId || Constants.EMPTY_STRING
                             };
-                            cachedAccount = this.readAccountFromCache(accountInfo);
+                            cachedAccount = this.cacheManager.readAccountFromCache(accountInfo);
+                        }
+                        // increment telemetry cache hit counter
+                        if (this.config.serverTelemetryManager) {
+                            this.config.serverTelemetryManager.incrementCacheHits();
                         }
                         return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, {
                                 account: cachedAccount,
@@ -6136,45 +6160,23 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 refreshToken: null,
                                 appMetadata: null
                             }, true, request, idTokenObject)];
-                    case 1: return [2 /*return*/, _b.sent()];
+                    case 1: return [2 /*return*/, _c.sent()];
                 }
             });
         });
     };
     /**
-     * read access token from cache TODO: CacheManager API should be used here
+     * read idtoken from cache, this is a specific implementation for OBO as the requirements differ from a generic lookup in the cacheManager
+     * Certain use cases of OBO flow do not expect an idToken in the cache/or from the service
      * @param request
      */
-    OnBehalfOfClient.prototype.readAccessTokenFromCache = function () {
-        var accessTokenFilter = {
-            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
-            credentialType: exports.CredentialType.ACCESS_TOKEN,
-            clientId: this.config.authOptions.clientId,
-            realm: this.authority.tenant,
-            target: this.scopeSet.printScopesLowerCase(),
-        };
-        var credentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);
-        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
-        var numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
-            return null;
-        }
-        else if (numAccessTokens > 1) {
-            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
-        }
-        return accessTokens[0];
-    };
-    /**
-     * read idtoken from cache TODO: CacheManager API should be used here instead
-     * @param request
-     */
-    OnBehalfOfClient.prototype.readIdTokenFromCache = function (request) {
+    OnBehalfOfClient.prototype.readIdTokenFromCacheForOBO = function (request, atHomeAccountId) {
         var idTokenFilter = {
+            homeAccountId: atHomeAccountId,
             environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
             credentialType: exports.CredentialType.ID_TOKEN,
             clientId: this.config.authOptions.clientId,
-            realm: this.authority.tenant,
-            oboAssertion: request.oboAssertion
+            realm: this.authority.tenant
         };
         var credentialCache = this.cacheManager.getCredentialsFilteredBy(idTokenFilter);
         var idTokens = Object.keys(credentialCache.idTokens).map(function (key) { return credentialCache.idTokens[key]; });
@@ -6185,18 +6187,44 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         return idTokens[0];
     };
     /**
-     * read account from cache, TODO: CacheManager API should be used here instead
-     * @param account
+     * Fetches the cached access token based on incoming assertion
+     * @param clientId
+     * @param request
+     * @param userAssertionHash
      */
-    OnBehalfOfClient.prototype.readAccountFromCache = function (account) {
-        return this.cacheManager.readAccountFromCache(account);
+    OnBehalfOfClient.prototype.readAccessTokenFromCacheForOBO = function (clientId, request) {
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+        var accessTokenFilter = {
+            credentialType: credentialType,
+            clientId: clientId,
+            target: this.scopeSet.printScopesLowerCase(),
+            tokenType: authScheme,
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash,
+            userAssertionHash: this.userAssertionHash
+        };
+        var credentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);
+        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
+        var numAccessTokens = accessTokens.length;
+        if (numAccessTokens < 1) {
+            return null;
+        }
+        else if (numAccessTokens > 1) {
+            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+        }
+        return accessTokens[0];
     };
     /**
      * Make a network call to the server requesting credentials
      * @param request
      * @param authority
      */
-    OnBehalfOfClient.prototype.executeTokenRequest = function (request, authority) {
+    OnBehalfOfClient.prototype.executeTokenRequest = function (request, authority, userAssertionHash) {
         return __awaiter(this, void 0, void 0, function () {
             var requestBody, headers, thumbprint, reqTimestamp, response, responseHandler, tokenResponse;
             return __generator(this, function (_a) {
@@ -6221,7 +6249,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                         response = _a.sent();
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request)];
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, userAssertionHash)];
                     case 2:
                         tokenResponse = _a.sent();
                         return [2 /*return*/, tokenResponse];
@@ -6252,9 +6280,8 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        // Use clientAssertion from request, fallback to client assertion in base configuration
-        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-        if (clientAssertion) {
+        if (this.config.clientCredentials.clientAssertion) {
+            var clientAssertion = this.config.clientCredentials.clientAssertion;
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -6468,9 +6495,8 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        // Use clientAssertion from request, fallback to client assertion in base configuration
-        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-        if (clientAssertion) {
+        if (this.config.clientCredentials.clientAssertion) {
+            var clientAssertion = this.config.clientCredentials.clientAssertion;
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }