@azure/msal-common 6.4.0 → 7.2.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v6.4.0 2022-06-06 */
+/*! @azure/msal-common v7.2.0 2022-07-18 */
 'use strict';
 'use strict';
 
@@ -138,7 +138,8 @@ var Constants = {
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
     KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
     TOKEN_RESPONSE_TYPE: "token",
-    ID_TOKEN_RESPONSE_TYPE: "id_token"
+    ID_TOKEN_RESPONSE_TYPE: "id_token",
+    SHR_NONCE_VALIDITY: 240,
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -170,6 +171,7 @@ exports.PersistentCacheKeys = void 0;
     PersistentCacheKeys["ERROR"] = "error";
     PersistentCacheKeys["ERROR_DESC"] = "error.description";
     PersistentCacheKeys["ACTIVE_ACCOUNT"] = "active-account";
+    PersistentCacheKeys["ACTIVE_ACCOUNT_FILTERS"] = "active-account-filters"; // new cache entry for active_account for a more robust version for browser
 })(exports.PersistentCacheKeys || (exports.PersistentCacheKeys = {}));
 /**
  * String constants related to AAD Authority
@@ -379,6 +381,7 @@ var AuthorityMetadataSource;
     AuthorityMetadataSource["CONFIG"] = "config";
     AuthorityMetadataSource["CACHE"] = "cache";
     AuthorityMetadataSource["NETWORK"] = "network";
+    AuthorityMetadataSource["HARDCODED_VALUES"] = "hardcoded_values";
 })(AuthorityMetadataSource || (AuthorityMetadataSource = {}));
 var SERVER_TELEM_CONSTANTS = {
     SCHEMA_VERSION: 5,
@@ -1357,7 +1360,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "6.4.0";
+var version = "7.2.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1400,9 +1403,9 @@ exports.AzureCloudInstance = void 0;
  *      familyId: Family ID identifier, usually only used for refresh tokens
  *      realm: Full tenant or organizational identifier that the account belongs to
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
  *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+ *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -2043,7 +2046,6 @@ exports.AuthorityType = void 0;
  *      clientInfo: Full base64 encoded client info received from ESTS
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
  * }
@@ -2122,7 +2124,7 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
@@ -2136,7 +2138,6 @@ var AccountEntity = /** @class */ (function () {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         if (idToken) {
             account.idTokenClaims = idToken.claims;
             // How do you account for MSA CID here?
@@ -2157,14 +2158,13 @@ var AccountEntity = /** @class */ (function () {
      * @param authority
      * @param idToken
      */
-    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
         account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         var env = environment || authority && authority.getPreferredCache();
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2412,7 +2412,7 @@ var CacheManager = /** @class */ (function () {
      * @param realm
      */
     CacheManager.prototype.getAccountsFilteredBy = function (accountFilter) {
-        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING);
+        return this.getAccountsFilteredByInternal(accountFilter ? accountFilter.homeAccountId : Constants.EMPTY_STRING, accountFilter ? accountFilter.environment : Constants.EMPTY_STRING, accountFilter ? accountFilter.realm : Constants.EMPTY_STRING, accountFilter ? accountFilter.nativeAccountId : Constants.EMPTY_STRING);
     };
     /**
      * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -2421,7 +2421,7 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param realm
      */
-    CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm) {
+    CacheManager.prototype.getAccountsFilteredByInternal = function (homeAccountId, environment, realm, nativeAccountId) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingAccounts = {};
@@ -2439,6 +2439,9 @@ var CacheManager = /** @class */ (function () {
             if (!!realm && !_this.matchRealm(entity, realm)) {
                 return;
             }
+            if (!!nativeAccountId && !_this.matchNativeAccountId(entity, nativeAccountId)) {
+                return;
+            }
             matchingAccounts[cacheKey] = entity;
         });
         return matchingAccounts;
@@ -2453,7 +2456,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2463,10 +2466,10 @@ var CacheManager = /** @class */ (function () {
      * @param clientId
      * @param realm
      * @param target
-     * @param oboAssertion
+     * @param userAssertionHash
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2485,7 +2488,7 @@ var CacheManager = /** @class */ (function () {
             if (!entity) {
                 return;
             }
-            if (!!oboAssertion && !_this.matchOboAssertion(entity, oboAssertion)) {
+            if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                 return;
             }
             if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
@@ -2767,6 +2770,26 @@ var CacheManager = /** @class */ (function () {
         var accountKey = AccountEntity.generateAccountCacheKey(account);
         return this.getAccount(accountKey);
     };
+    /**
+     * Retrieve AccountEntity from cache
+     * @param nativeAccountId
+     * @returns AccountEntity or Null
+     */
+    CacheManager.prototype.readAccountFromCacheWithNativeAccountId = function (nativeAccountId) {
+        // fetch account from memory
+        var accountFilter = {
+            nativeAccountId: nativeAccountId
+        };
+        var accountCache = this.getAccountsFilteredBy(accountFilter);
+        var accounts = Object.keys(accountCache).map(function (key) { return accountCache[key]; });
+        if (accounts.length < 1) {
+            return null;
+        }
+        else if (accounts.length > 1) {
+            throw ClientAuthError.createMultipleMatchingAccountsInCacheError();
+        }
+        return accountCache[0];
+    };
     /**
      * Retrieve IdTokenEntity from cache
      * @param clientId
@@ -2816,7 +2839,7 @@ var CacheManager = /** @class */ (function () {
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
             keyId: request.sshKid,
-            requestedClaimsHash: request.requestedClaimsHash
+            requestedClaimsHash: request.requestedClaimsHash,
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2842,7 +2865,7 @@ var CacheManager = /** @class */ (function () {
             environment: account.environment,
             credentialType: exports.CredentialType.REFRESH_TOKEN,
             clientId: clientId,
-            familyId: id
+            familyId: id,
         };
         var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
         var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
@@ -2894,8 +2917,8 @@ var CacheManager = /** @class */ (function () {
      * @param value
      * @param oboAssertion
      */
-    CacheManager.prototype.matchOboAssertion = function (entity, oboAssertion) {
-        return !!(entity.oboAssertion && oboAssertion === entity.oboAssertion);
+    CacheManager.prototype.matchUserAssertionHash = function (entity, userAssertionHash) {
+        return !!(entity.userAssertionHash && userAssertionHash === entity.userAssertionHash);
     };
     /**
      * helper to match environment
@@ -2941,6 +2964,15 @@ var CacheManager = /** @class */ (function () {
     CacheManager.prototype.matchRealm = function (entity, realm) {
         return !!(entity.realm && realm === entity.realm);
     };
+    /**
+     * helper to match nativeAccountId
+     * @param entity
+     * @param nativeAccountId
+     * @returns boolean indicating the match result
+     */
+    CacheManager.prototype.matchNativeAccountId = function (entity, nativeAccountId) {
+        return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
+    };
     /**
      * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
      * @param entity
@@ -3213,7 +3245,7 @@ function buildClientConfiguration(_a) {
         telemetry: __assign(__assign({}, DEFAULT_TELEMETRY_OPTIONS), telemetry),
         serverTelemetryManager: serverTelemetryManager || null,
         persistencePlugin: persistencePlugin || null,
-        serializableCache: serializableCache || null
+        serializableCache: serializableCache || null,
     };
 }
 /**
@@ -3221,7 +3253,7 @@ function buildClientConfiguration(_a) {
  * @param authOptions
  */
 function buildAuthOptions(authOptions) {
-    return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
+    return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
 }
 
 /*
@@ -3796,14 +3828,18 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param clientAssertion
      */
     RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        if (!StringUtils.isEmpty(clientAssertion)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        }
     };
     /**
      * add clientAssertionType for confidential client flows
      * @param clientAssertionType
      */
     RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        if (!StringUtils.isEmpty(clientAssertionType)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        }
     };
     /**
      * add OBO assertion for confidential client flows
@@ -3969,7 +4005,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId, oboAssertion) {
+    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId) {
         var idTokenEntity = new IdTokenEntity();
         idTokenEntity.credentialType = exports.CredentialType.ID_TOKEN;
         idTokenEntity.homeAccountId = homeAccountId;
@@ -3977,7 +4013,6 @@ var IdTokenEntity = /** @class */ (function (_super) {
         idTokenEntity.clientId = clientId;
         idTokenEntity.secret = idToken;
         idTokenEntity.realm = tenantId;
-        idTokenEntity.oboAssertion = oboAssertion;
         return idTokenEntity;
     };
     /**
@@ -4092,7 +4127,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
         var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
@@ -4113,7 +4148,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.clientId = clientId;
         atEntity.realm = tenantId;
         atEntity.target = scopes;
-        atEntity.oboAssertion = oboAssertion;
+        atEntity.userAssertionHash = userAssertionHash;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
         if (requestedClaims) {
             atEntity.requestedClaims = requestedClaims;
@@ -4195,14 +4230,14 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, oboAssertion) {
+    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
         var rtEntity = new RefreshTokenEntity();
         rtEntity.clientId = clientId;
         rtEntity.credentialType = exports.CredentialType.REFRESH_TOKEN;
         rtEntity.environment = environment;
         rtEntity.homeAccountId = homeAccountId;
         rtEntity.secret = refreshToken;
-        rtEntity.oboAssertion = oboAssertion;
+        rtEntity.userAssertionHash = userAssertionHash;
         if (familyId)
             rtEntity.familyId = familyId;
         return rtEntity;
@@ -4251,6 +4286,10 @@ var InteractionRequiredAuthErrorMessage = {
     noTokensFoundError: {
         code: "no_tokens_found",
         desc: "No refresh token found in the cache. Please sign-in."
+    },
+    native_account_unavailable: {
+        code: "native_account_unavailable",
+        desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API."
     }
 };
 /**
@@ -4284,6 +4323,13 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     InteractionRequiredAuthError.createNoTokensFoundError = function () {
         return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.noTokensFoundError.code, InteractionRequiredAuthErrorMessage.noTokensFoundError.desc);
     };
+    /**
+     * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
+     * @returns
+     */
+    InteractionRequiredAuthError.createNativeAccountUnavailableError = function () {
+        return new InteractionRequiredAuthError(InteractionRequiredAuthErrorMessage.native_account_unavailable.code, InteractionRequiredAuthErrorMessage.native_account_unavailable.desc);
+    };
     return InteractionRequiredAuthError;
 }(AuthError));
 
@@ -4831,7 +4877,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, oboAssertion, handlingRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
         return __awaiter(this, void 0, void 0, function () {
             var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
@@ -4853,7 +4899,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4868,14 +4914,15 @@ var ResponseHandler = /** @class */ (function () {
                         /*
                          * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
                          * If not present, we should return null, as it's the case that another application called removeAccount in between
-                         * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal.
+                         * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
+                         * the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
                          */
-                        if (handlingRefreshTokenResponse && cacheRecord.account) {
+                        if (handlingRefreshTokenResponse && !forceCacheRefreshTokenResponse && cacheRecord.account) {
                             key = cacheRecord.account.generateAccountKey();
                             account = this.cacheStorage.getAccount(key);
                             if (!account) {
                                 this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
                             }
                         }
                         return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -4901,7 +4948,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4910,8 +4957,8 @@ var ResponseHandler = /** @class */ (function () {
         var cachedIdToken;
         var cachedAccount;
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING, oboAssertion);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, oboAssertion, authCodePayload);
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
         }
         // AccessToken
         var cachedAccessToken = null;
@@ -4929,12 +4976,12 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
-            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, oboAssertion);
+            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
         }
         // appMetadata
         var cachedAppMetadata = null;
@@ -4949,22 +4996,22 @@ var ResponseHandler = /** @class */ (function () {
      * @param idToken
      * @param authority
      */
-    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
         var authorityType = authority.authorityType;
         var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
         var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
         // ADFS does not require client_info in the response
         if (authorityType === exports.AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
         }
         // This fallback applies to B2C as well as they fall under an AAD account type.
         if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
             throw ClientAuthError.createClientInfoEmptyError();
         }
         return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
+            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
     };
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -5139,7 +5186,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
             throw ClientConfigurationError.createEmptyLogoutRequestError();
         }
         var queryString = this.createLogoutUrlQueryString(logoutRequest);
-        // Construct logout URI.
+        // Construct logout URI
         return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
     };
     /**
@@ -5242,8 +5289,8 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         if (this.config.clientCredentials.clientSecret) {
                             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                         }
-                        clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-                        if (clientAssertion) {
+                        if (this.config.clientCredentials.clientAssertion) {
+                            clientAssertion = this.config.clientCredentials.clientAssertion;
                             parameterBuilder.addClientAssertion(clientAssertion.assertion);
                             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                         }
@@ -5710,7 +5757,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         response = _a.sent();
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true)];
+                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
                 }
             });
         });
@@ -5846,8 +5893,8 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         if (this.config.clientCredentials.clientSecret) {
                             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                         }
-                        clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-                        if (clientAssertion) {
+                        if (this.config.clientCredentials.clientAssertion) {
+                            clientAssertion = this.config.clientCredentials.clientAssertion;
                             parameterBuilder.addClientAssertion(clientAssertion.assertion);
                             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                         }
@@ -5906,8 +5953,10 @@ var RefreshTokenClient = /** @class */ (function (_super) {
  */
 var ClientCredentialClient = /** @class */ (function (_super) {
     __extends(ClientCredentialClient, _super);
-    function ClientCredentialClient(configuration) {
-        return _super.call(this, configuration) || this;
+    function ClientCredentialClient(configuration, appTokenProvider) {
+        var _this = _super.call(this, configuration) || this;
+        _this.appTokenProvider = appTokenProvider;
+        return _this;
     }
     /**
      * Public API to acquire a token with ClientCredential Flow for Confidential clients
@@ -5995,10 +6044,30 @@ var ClientCredentialClient = /** @class */ (function (_super) {
      */
     ClientCredentialClient.prototype.executeTokenRequest = function (request, authority) {
         return __awaiter(this, void 0, void 0, function () {
-            var requestBody, headers, thumbprint, reqTimestamp, response, responseHandler, tokenResponse;
+            var serverTokenResponse, reqTimestamp, appTokenPropviderParameters, appTokenProviderResult, requestBody, headers, thumbprint, response, responseHandler, tokenResponse;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        if (!this.appTokenProvider) return [3 /*break*/, 2];
+                        this.logger.info("Using appTokenProvider extensibility.");
+                        appTokenPropviderParameters = {
+                            correlationId: request.correlationId,
+                            tenantId: this.config.authOptions.authority.tenant,
+                            scopes: request.scopes,
+                            claims: request.claims,
+                        };
+                        reqTimestamp = TimeUtils.nowSeconds();
+                        return [4 /*yield*/, this.appTokenProvider(appTokenPropviderParameters)];
+                    case 1:
+                        appTokenProviderResult = _a.sent();
+                        serverTokenResponse = {
+                            access_token: appTokenProviderResult.accessToken,
+                            expires_in: appTokenProviderResult.expiresInSeconds,
+                            refresh_in: appTokenProviderResult.refreshInSeconds,
+                            token_type: exports.AuthenticationScheme.BEARER
+                        };
+                        return [3 /*break*/, 4];
+                    case 2:
                         requestBody = this.createTokenRequestBody(request);
                         headers = this.createTokenRequestHeaders();
                         thumbprint = {
@@ -6014,12 +6083,15 @@ var ClientCredentialClient = /** @class */ (function (_super) {
                         };
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint)];
-                    case 1:
+                    case 3:
                         response = _a.sent();
+                        serverTokenResponse = response.body;
+                        _a.label = 4;
+                    case 4:
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
-                        responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request)];
-                    case 2:
+                        responseHandler.validateTokenResponse(serverTokenResponse);
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(serverTokenResponse, this.authority, reqTimestamp, request)];
+                    case 5:
                         tokenResponse = _a.sent();
                         return [2 /*return*/, tokenResponse];
                 }
@@ -6078,44 +6150,64 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
      */
     OnBehalfOfClient.prototype.acquireToken = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var cachedAuthenticationResult;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         this.scopeSet = new ScopeSet(request.scopes || []);
-                        if (!request.skipCache) return [3 /*break*/, 2];
-                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
-                    case 1: return [2 /*return*/, _a.sent()];
-                    case 2: return [4 /*yield*/, this.getCachedAuthenticationResult(request)];
+                        // generate the user_assertion_hash for OBOAssertion
+                        _a = this;
+                        return [4 /*yield*/, this.cryptoUtils.hashString(request.oboAssertion)];
+                    case 1:
+                        // generate the user_assertion_hash for OBOAssertion
+                        _a.userAssertionHash = _b.sent();
+                        if (!request.skipCache) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority, this.userAssertionHash)];
+                    case 2: return [2 /*return*/, _b.sent()];
                     case 3:
-                        cachedAuthenticationResult = _a.sent();
-                        if (!cachedAuthenticationResult) return [3 /*break*/, 4];
-                        return [2 /*return*/, cachedAuthenticationResult];
-                    case 4: return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
-                    case 5: return [2 /*return*/, _a.sent()];
+                        _b.trys.push([3, 5, , 7]);
+                        return [4 /*yield*/, this.getCachedAuthenticationResult(request)];
+                    case 4: return [2 /*return*/, _b.sent()];
+                    case 5:
+                        _b.sent();
+                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority, this.userAssertionHash)];
+                    case 6: 
+                    // Any failure falls back to interactive request, once we implement distributed cache, we plan to handle `createRefreshRequiredError` to refresh using the RT
+                    return [2 /*return*/, _b.sent()];
+                    case 7: return [2 /*return*/];
                 }
             });
         });
     };
     /**
      * look up cache for tokens
+     * Find idtoken in the cache
+     * Find accessToken based on user assertion and account info in the cache
+     * Please note we are not yet supported OBO tokens refreshed with long lived RT. User will have to send a new assertion if the current access token expires
+     * This is to prevent security issues when the assertion changes over time, however, longlived RT helps retaining the session
      * @param request
      */
     OnBehalfOfClient.prototype.getCachedAuthenticationResult = function (request) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
             var cachedAccessToken, cachedIdToken, idTokenObject, cachedAccount, localAccountId, accountInfo;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
-                        cachedAccessToken = this.readAccessTokenFromCache();
-                        if (!cachedAccessToken ||
-                            TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-                            // Update the server telemetry outcome
-                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(!cachedAccessToken ? CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED : CacheOutcome.NO_CACHED_ACCESS_TOKEN);
-                            return [2 /*return*/, null];
+                        cachedAccessToken = this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId, request);
+                        if (!cachedAccessToken) {
+                            // Must refresh due to non-existent access_token.
+                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
+                            throw ClientAuthError.createRefreshRequiredError();
                         }
-                        cachedIdToken = this.readIdTokenFromCache(request);
+                        else if (TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+                            // Access token expired, will need to renewed
+                            (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
+                        cachedIdToken = this.readIdTokenFromCacheForOBO(request, cachedAccessToken.homeAccountId);
                         cachedAccount = null;
                         if (cachedIdToken) {
                             idTokenObject = new AuthToken(cachedIdToken.secret, this.config.cryptoInterface);
@@ -6127,7 +6219,11 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 username: Constants.EMPTY_STRING,
                                 localAccountId: localAccountId || Constants.EMPTY_STRING
                             };
-                            cachedAccount = this.readAccountFromCache(accountInfo);
+                            cachedAccount = this.cacheManager.readAccountFromCache(accountInfo);
+                        }
+                        // increment telemetry cache hit counter
+                        if (this.config.serverTelemetryManager) {
+                            this.config.serverTelemetryManager.incrementCacheHits();
                         }
                         return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, {
                                 account: cachedAccount,
@@ -6136,45 +6232,23 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 refreshToken: null,
                                 appMetadata: null
                             }, true, request, idTokenObject)];
-                    case 1: return [2 /*return*/, _b.sent()];
+                    case 1: return [2 /*return*/, _c.sent()];
                 }
             });
         });
     };
     /**
-     * read access token from cache TODO: CacheManager API should be used here
-     * @param request
-     */
-    OnBehalfOfClient.prototype.readAccessTokenFromCache = function () {
-        var accessTokenFilter = {
-            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
-            credentialType: exports.CredentialType.ACCESS_TOKEN,
-            clientId: this.config.authOptions.clientId,
-            realm: this.authority.tenant,
-            target: this.scopeSet.printScopesLowerCase(),
-        };
-        var credentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);
-        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
-        var numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
-            return null;
-        }
-        else if (numAccessTokens > 1) {
-            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
-        }
-        return accessTokens[0];
-    };
-    /**
-     * read idtoken from cache TODO: CacheManager API should be used here instead
+     * read idtoken from cache, this is a specific implementation for OBO as the requirements differ from a generic lookup in the cacheManager
+     * Certain use cases of OBO flow do not expect an idToken in the cache/or from the service
      * @param request
      */
-    OnBehalfOfClient.prototype.readIdTokenFromCache = function (request) {
+    OnBehalfOfClient.prototype.readIdTokenFromCacheForOBO = function (request, atHomeAccountId) {
         var idTokenFilter = {
+            homeAccountId: atHomeAccountId,
             environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
             credentialType: exports.CredentialType.ID_TOKEN,
             clientId: this.config.authOptions.clientId,
-            realm: this.authority.tenant,
-            oboAssertion: request.oboAssertion
+            realm: this.authority.tenant
         };
         var credentialCache = this.cacheManager.getCredentialsFilteredBy(idTokenFilter);
         var idTokens = Object.keys(credentialCache.idTokens).map(function (key) { return credentialCache.idTokens[key]; });
@@ -6185,18 +6259,44 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         return idTokens[0];
     };
     /**
-     * read account from cache, TODO: CacheManager API should be used here instead
-     * @param account
+     * Fetches the cached access token based on incoming assertion
+     * @param clientId
+     * @param request
+     * @param userAssertionHash
      */
-    OnBehalfOfClient.prototype.readAccountFromCache = function (account) {
-        return this.cacheManager.readAccountFromCache(account);
+    OnBehalfOfClient.prototype.readAccessTokenFromCacheForOBO = function (clientId, request) {
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+        var accessTokenFilter = {
+            credentialType: credentialType,
+            clientId: clientId,
+            target: this.scopeSet.printScopesLowerCase(),
+            tokenType: authScheme,
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash,
+            userAssertionHash: this.userAssertionHash
+        };
+        var credentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);
+        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
+        var numAccessTokens = accessTokens.length;
+        if (numAccessTokens < 1) {
+            return null;
+        }
+        else if (numAccessTokens > 1) {
+            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+        }
+        return accessTokens[0];
     };
     /**
      * Make a network call to the server requesting credentials
      * @param request
      * @param authority
      */
-    OnBehalfOfClient.prototype.executeTokenRequest = function (request, authority) {
+    OnBehalfOfClient.prototype.executeTokenRequest = function (request, authority, userAssertionHash) {
         return __awaiter(this, void 0, void 0, function () {
             var requestBody, headers, thumbprint, reqTimestamp, response, responseHandler, tokenResponse;
             return __generator(this, function (_a) {
@@ -6221,7 +6321,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                         response = _a.sent();
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request)];
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, userAssertionHash)];
                     case 2:
                         tokenResponse = _a.sent();
                         return [2 /*return*/, tokenResponse];
@@ -6252,9 +6352,8 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        // Use clientAssertion from request, fallback to client assertion in base configuration
-        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-        if (clientAssertion) {
+        if (this.config.clientCredentials.clientAssertion) {
+            var clientAssertion = this.config.clientCredentials.clientAssertion;
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -6468,9 +6567,8 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        // Use clientAssertion from request, fallback to client assertion in base configuration
-        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
-        if (clientAssertion) {
+        if (this.config.clientCredentials.clientAssertion) {
+            var clientAssertion = this.config.clientCredentials.clientAssertion;
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -6492,9 +6590,18 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
 function isOpenIdConfigResponse(response) {
     return (response.hasOwnProperty("authorization_endpoint") &&
         response.hasOwnProperty("token_endpoint") &&
-        response.hasOwnProperty("issuer"));
+        response.hasOwnProperty("issuer") &&
+        response.hasOwnProperty("jwks_uri"));
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var rawMetdataJSON = { "endpointMetadata": { "https://login.microsoftonline.com/common/": { "token_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/common/": { "token_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/common/": { "token_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/common/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/common/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/common/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" }, "https://login.microsoftonline.com/consumers/": { "token_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/consumers/": { "token_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/consumers/": { "token_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/consumers/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/consumers/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/consumers/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" }, "https://login.microsoftonline.com/organizations/": { "token_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.com/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.com/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.com", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pas.windows.net" }, "https://login.chinacloudapi.cn/organizations/": { "token_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.chinacloudapi.cn/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.partner.microsoftonline.cn/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://microsoftgraph.chinacloudapi.cn/oidc/userinfo", "authorization_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.chinacloudapi.cn/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.chinacloudapi.cn/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "partner.microsoftonline.cn", "cloud_graph_host_name": "graph.chinacloudapi.cn", "msgraph_host": "microsoftgraph.chinacloudapi.cn", "rbac_url": "https://pas.chinacloudapi.cn" }, "https://login.microsoftonline.us/organizations/": { "token_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/token", "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt", "client_secret_basic"], "jwks_uri": "https://login.microsoftonline.us/organizations/discovery/v2.0/keys", "response_modes_supported": ["query", "fragment", "form_post"], "subject_types_supported": ["pairwise"], "id_token_signing_alg_values_supported": ["RS256"], "response_types_supported": ["code", "id_token", "code id_token", "id_token token"], "scopes_supported": ["openid", "profile", "email", "offline_access"], "issuer": "https://login.microsoftonline.us/{tenantid}/v2.0", "request_uri_parameter_supported": false, "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo", "authorization_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/authorize", "device_authorization_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/devicecode", "http_logout_supported": true, "frontchannel_logout_supported": true, "end_session_endpoint": "https://login.microsoftonline.us/organizations/oauth2/v2.0/logout", "claims_supported": ["sub", "iss", "cloud_instance_name", "cloud_instance_host_name", "cloud_graph_host_name", "msgraph_host", "aud", "exp", "iat", "auth_time", "acr", "nonce", "preferred_username", "name", "tid", "ver", "at_hash", "c_hash", "email"], "kerberos_endpoint": "https://login.microsoftonline.us/organizations/kerberos", "tenant_region_scope": null, "cloud_instance_name": "microsoftonline.us", "cloud_graph_host_name": "graph.windows.net", "msgraph_host": "graph.microsoft.com", "rbac_url": "https://pasff.usgovcloudapi.net" } }, "instanceDiscoveryMetadata": { "https://login.microsoftonline.com/common/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/common/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/common/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/common/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.com/consumers/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/consumers/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/consumers/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/consumers/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.com/organizations/": { "tenant_discovery_endpoint": "https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.chinacloudapi.cn/organizations/": { "tenant_discovery_endpoint": "https://login.chinacloudapi.cn/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] }, "https://login.microsoftonline.us/organizations/": { "tenant_discovery_endpoint": "https://login.microsoftonline.us/organizations/v2.0/.well-known/openid-configuration", "api-version": "1.1", "metadata": [{ "preferred_network": "login.microsoftonline.com", "preferred_cache": "login.windows.net", "aliases": ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"] }, { "preferred_network": "login.partner.microsoftonline.cn", "preferred_cache": "login.partner.microsoftonline.cn", "aliases": ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"] }, { "preferred_network": "login.microsoftonline.de", "preferred_cache": "login.microsoftonline.de", "aliases": ["login.microsoftonline.de"] }, { "preferred_network": "login.microsoftonline.us", "preferred_cache": "login.microsoftonline.us", "aliases": ["login.microsoftonline.us", "login.usgovcloudapi.net"] }, { "preferred_network": "login-us.microsoftonline.com", "preferred_cache": "login-us.microsoftonline.com", "aliases": ["login-us.microsoftonline.com"] }] } } };
+var EndpointMetadata = rawMetdataJSON.endpointMetadata;
+var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6538,6 +6645,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
         this.end_session_endpoint = metadata.end_session_endpoint;
         this.issuer = metadata.issuer;
         this.endpointsFromNetwork = fromNetwork;
+        this.jwks_uri = metadata.jwks_uri;
     };
     /**
      * Save the authority that was used to create this cache entry
@@ -6576,7 +6684,8 @@ var AuthorityMetadataEntity = /** @class */ (function () {
             entity.hasOwnProperty("issuer") &&
             entity.hasOwnProperty("aliasesFromNetwork") &&
             entity.hasOwnProperty("endpointsFromNetwork") &&
-            entity.hasOwnProperty("expiresAt"));
+            entity.hasOwnProperty("expiresAt") &&
+            entity.hasOwnProperty("jwks_uri"));
     };
     return AuthorityMetadataEntity;
 }());
@@ -6893,6 +7002,22 @@ var Authority = /** @class */ (function () {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(Authority.prototype, "jwksUri", {
+        /**
+         * Jwks_uri for token signing keys
+         */
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.jwks_uri);
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
     /**
      * Replaces tenant in url path with current tenant. Defaults to common.
      * @param urlString
@@ -6976,11 +7101,11 @@ var Authority = /** @class */ (function () {
      * @param metadataEntity
      */
     Authority.prototype.updateEndpointMetadata = function (metadataEntity) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
-            var metadata, autodetectedRegionName, azureRegion;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            var metadata, harcodedMetadata;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
                         metadata = this.getEndpointMetadataFromConfig();
                         if (metadata) {
@@ -6991,41 +7116,30 @@ var Authority = /** @class */ (function () {
                             // No need to update
                             return [2 /*return*/, AuthorityMetadataSource.CACHE];
                         }
+                        harcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
                         return [4 /*yield*/, this.getEndpointMetadataFromNetwork()];
                     case 1:
-                        metadata = _b.sent();
+                        metadata = _c.sent();
                         if (!metadata) return [3 /*break*/, 4];
                         if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
-                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
+                        return [4 /*yield*/, this.updateMetadataWithRegionalInformation(metadata)];
                     case 2:
-                        autodetectedRegionName = _b.sent();
-                        azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
-                            ? autodetectedRegionName
-                            : this.authorityOptions.azureRegionConfiguration.azureRegion;
-                        if (this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-                            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
-                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
-                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
-                        }
-                        else {
-                            if (autodetectedRegionName) {
-                                this.regionDiscoveryMetadata.region_outcome = (this.authorityOptions.azureRegionConfiguration.azureRegion === autodetectedRegionName) ?
-                                    RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
-                                    RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
-                            }
-                            else {
-                                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
-                            }
-                        }
-                        if (azureRegion) {
-                            this.regionDiscoveryMetadata.region_used = azureRegion;
-                            metadata = Authority.replaceWithRegionalInformation(metadata, azureRegion);
-                        }
-                        _b.label = 3;
+                        metadata = _c.sent();
+                        _c.label = 3;
                     case 3:
                         metadataEntity.updateEndpointMetadata(metadata, true);
                         return [2 /*return*/, AuthorityMetadataSource.NETWORK];
-                    case 4: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
+                    case 4:
+                        if (!(harcodedMetadata && !this.authorityOptions.skipAuthorityMetadataCache)) return [3 /*break*/, 7];
+                        if (!((_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion)) return [3 /*break*/, 6];
+                        return [4 /*yield*/, this.updateMetadataWithRegionalInformation(harcodedMetadata)];
+                    case 5:
+                        harcodedMetadata = _c.sent();
+                        _c.label = 6;
+                    case 6:
+                        metadataEntity.updateEndpointMetadata(harcodedMetadata, false);
+                        return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
+                    case 7: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
                 }
             });
         });
@@ -7056,6 +7170,8 @@ var Authority = /** @class */ (function () {
     };
     /**
      * Gets OAuth endpoints from the given OpenID configuration endpoint.
+     *
+     * @param hasHardcodedMetadata boolean
      */
     Authority.prototype.getEndpointMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
@@ -7082,6 +7198,54 @@ var Authority = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Get OAuth endpoints for common authorities.
+     */
+    Authority.prototype.getEndpointMetadataFromHardcodedValues = function () {
+        if (this.canonicalAuthority in EndpointMetadata) {
+            return EndpointMetadata[this.canonicalAuthority];
+        }
+        return null;
+    };
+    /**
+     * Update the retrieved metadata with regional information.
+     */
+    Authority.prototype.updateMetadataWithRegionalInformation = function (metadata) {
+        var _a, _b, _c, _d, _e;
+        return __awaiter(this, void 0, void 0, function () {
+            var autodetectedRegionName, azureRegion;
+            return __generator(this, function (_f) {
+                switch (_f.label) {
+                    case 0: return [4 /*yield*/, this.regionDiscovery.detectRegion((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
+                    case 1:
+                        autodetectedRegionName = _f.sent();
+                        azureRegion = ((_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
+                            ? autodetectedRegionName
+                            : (_c = this.authorityOptions.azureRegionConfiguration) === null || _c === void 0 ? void 0 : _c.azureRegion;
+                        if (((_d = this.authorityOptions.azureRegionConfiguration) === null || _d === void 0 ? void 0 : _d.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
+                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
+                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+                        }
+                        else {
+                            if (autodetectedRegionName) {
+                                this.regionDiscoveryMetadata.region_outcome = (((_e = this.authorityOptions.azureRegionConfiguration) === null || _e === void 0 ? void 0 : _e.azureRegion) === autodetectedRegionName) ?
+                                    RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
+                                    RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
+                            }
+                            else {
+                                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                            }
+                        }
+                        if (azureRegion) {
+                            this.regionDiscoveryMetadata.region_used = azureRegion;
+                            return [2 /*return*/, Authority.replaceWithRegionalInformation(metadata, azureRegion)];
+                        }
+                        return [2 /*return*/, metadata];
+                }
+            });
+        });
+    };
     /**
      * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
      * @param cachedMetadata
@@ -7089,7 +7253,7 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.updateCloudDiscoveryMetadata = function (metadataEntity) {
         return __awaiter(this, void 0, void 0, function () {
-            var metadata;
+            var metadata, harcodedMetadata;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -7103,6 +7267,7 @@ var Authority = /** @class */ (function () {
                             // No need to update
                             return [2 /*return*/, AuthorityMetadataSource.CACHE];
                         }
+                        harcodedMetadata = this.getCloudDiscoveryMetadataFromHarcodedValues();
                         return [4 /*yield*/, this.getCloudDiscoveryMetadataFromNetwork()];
                     case 1:
                         metadata = _a.sent();
@@ -7110,6 +7275,10 @@ var Authority = /** @class */ (function () {
                             metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
                             return [2 /*return*/, AuthorityMetadataSource.NETWORK];
                         }
+                        if (harcodedMetadata && !this.options.skipAuthorityMetadataCache) {
+                            metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
+                            return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
+                        }
                         else {
                             // Metadata could not be obtained from config, cache or network
                             throw ClientConfigurationError.createUntrustedAuthorityError();
@@ -7143,7 +7312,8 @@ var Authority = /** @class */ (function () {
     };
     /**
      * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
-     * @param networkInterface
+     *
+     * @param hasHardcodedMetadata boolean
      */
     Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
@@ -7163,7 +7333,9 @@ var Authority = /** @class */ (function () {
                         return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                     case 2:
                         response = _a.sent();
-                        metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
+                        metadata = isCloudInstanceDiscoveryResponse(response.body)
+                            ? response.body.metadata
+                            : [];
                         if (metadata.length === 0) {
                             // If no metadata is returned, authority is untrusted
                             return [2 /*return*/, null];
@@ -7183,6 +7355,15 @@ var Authority = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Get cloud discovery metadata for common authorities
+     */
+    Authority.prototype.getCloudDiscoveryMetadataFromHarcodedValues = function () {
+        if (this.canonicalAuthority in InstanceDiscoveryMetadata) {
+            return InstanceDiscoveryMetadata[this.canonicalAuthority];
+        }
+        return null;
+    };
     /**
      * Helper function to determine if this host is included in the knownAuthorities config option
      */
@@ -7807,6 +7988,19 @@ exports.PerformanceEvents = void 0;
      * Used to acquire a token from Native component when native brokering is enabled.
      */
     PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
+    /**
+     * Used to measure the time taken for completing embedded-broker handshake (PW-Broker).
+     */
+    PerformanceEvents["BrokerHandhshake"] = "brokerHandshake";
+    /**
+     * acquireTokenByRefreshToken API in BrokerClientApplication (PW-Broker) .
+     */
+    PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
+    /**
+     * acquireToken API in BrokerClientApplication.
+     * Used to acquire a token on behalf of the embedded application (PW-Broker).
+     */
+    PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -7877,7 +8071,7 @@ var PerformanceClient = /** @class */ (function () {
             clientId: this.clientId,
             name: measureName,
             startTimeMs: Date.now(),
-            correlationId: eventCorrelationId
+            correlationId: eventCorrelationId,
         };
         // Store in progress events so they can be discarded if not ended properly
         this.cacheEventByCorrelationId(inProgressEvent);
@@ -8022,6 +8216,12 @@ var PerformanceClient = /** @class */ (function () {
                         else {
                             _this.logger.verbose("PerformanceClient: Submeasurement for " + measureName + " already exists for " + current.name + ", ignoring", correlationId);
                         }
+                        if (current.accessTokenSize) {
+                            previous.accessTokenSize = current.accessTokenSize;
+                        }
+                        if (current.idTokenSize) {
+                            previous.idTokenSize = current.idTokenSize;
+                        }
                     }
                     return previous;
                 }, topLevelEvent);