@sphereon/ssi-sdk.ms-authenticator 0.13.1-next.3 → 0.13.1-next.33

package/README.md

@@ -8,7 +8,7 @@
 
 ---
 
-**Warning: This package still is in every early development. Breaking changes without notice will happen at this point!**
+**Warning: This package still is in early development. Breaking changes without notice will happen at this point!**
 
 ---
 
@@ -19,11 +19,11 @@ A SSI-SDK plugin to authenticate using the Microsoft Authentication Library (MSA
 ### Installation
 
 ```shell
-yarn add @sphereon/ssi-sdk.ms-authenticator
+pnpm add @sphereon/ssi-sdk.ms-authenticator
 ```
 
 ### Build
 
 ```shell
-yarn build
+pnpm build
 ```

package/dist/authenticators/MsAuthenticator.d.ts

@@ -1,22 +1,33 @@
-import { IMsAuthenticationClientCredentialArgs, IMsAuthenticationUsernamePasswordArgs } from '../index';
-export declare const MS_IDENTITY_HOST_NAME_NONE_EU = "https://beta.did.msidentity.com/v1.0/";
-export declare const MS_IDENTITY_HOST_NAME_EU = "https://beta.eu.did.msidentity.com/v1.0/";
-export declare function checkMsIdentityHostname(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<string>;
+import { AuthenticationResult, ConfidentialClientApplication } from '@azure/msal-node';
+import { IMSClientCredentialAuthInfo, IMsAuthenticationClientCredentialArgs, IMsAuthenticationUsernamePasswordArgs } from '../index';
+export declare const MS_DID_ENDPOINT_NON_EU = "https://beta.did.msidentity.com/v1.0/";
+export declare const MS_DID_ENDPOINT_EU = "https://beta.eu.did.msidentity.com/v1.0/";
+export declare function getMSOpenIDClientRegion(azTenantId: string): Promise<string>;
+export declare function getEntraDIDEndpoint(opts: {
+    region?: string;
+    azTenantId: string;
+}): Promise<"https://beta.did.msidentity.com/v1.0/" | "https://beta.eu.did.msidentity.com/v1.0/">;
+export declare function assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<string>;
 /**
  * necessary fields are:
  *   azClientId: clientId of the application you're trying to login
  *   azClientSecret: secret of the application you're trying to login
  *   azTenantId: your MS Azure tenantId
+ * optional fields:
  *   credentialManifest: address of your credential manifest. usually in following format:
  *    https://beta.eu.did.msidentity.com/v1.0/<tenant_id>/verifiableCredential/contracts/<verifiable_credential_schema>
  * @param authenticationArgs
  * @constructor
  */
-export declare function ClientCredentialAuthenticator(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<string>;
+export declare function getMSClientCredentialAccessToken(authenticationArgs: IMsAuthenticationClientCredentialArgs, opts?: {
+    confidentialClient?: ConfidentialClientApplication;
+}): Promise<AuthenticationResult>;
+export declare function newMSClientCredentialAuthenticator(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<IMSClientCredentialAuthInfo>;
 /**
  * Logs in with provided authenticationArgs and returns access token
  * @param authenticationArgs
  * @constructor
  */
 export declare function UsernamePasswordAuthenticator(authenticationArgs: IMsAuthenticationUsernamePasswordArgs): Promise<string>;
+export declare function determineMSAuthId(authenticationArgs: IMsAuthenticationClientCredentialArgs | IMsAuthenticationUsernamePasswordArgs): string;
 //# sourceMappingURL=MsAuthenticator.d.ts.map

package/dist/authenticators/MsAuthenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MsAuthenticator.d.ts","sourceRoot":"","sources":["../../src/authenticators/MsAuthenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,qCAAqC,EAAE,MAAM,UAAU,CAAA;AASvG,eAAO,MAAM,6BAA6B,0CAA0C,CAAA;AACpF,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAmBlF,wBAAsB,uBAAuB,CAAC,kBAAkB,EAAE,qCAAqC,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxH;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,kBAAkB,EAAE,qCAAqC,GAAG,OAAO,CAAC,MAAM,CAAC,CAmC9H;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,kBAAkB,EAAE,qCAAqC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB9H"}
+{"version":3,"file":"MsAuthenticator.d.ts","sourceRoot":"","sources":["../../src/authenticators/MsAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAM9B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,2BAA2B,EAAE,qCAAqC,EAAE,qCAAqC,EAAE,MAAM,UAAU,CAAA;AAUpI,eAAO,MAAM,sBAAsB,0CAA0C,CAAA;AAC7E,eAAO,MAAM,kBAAkB,6CAA6C,CAAA;AAU5E,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjF;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,iGAGtF;AAED,wBAAsB,+CAA+C,CAAC,kBAAkB,EAAE,qCAAqC,GAAG,OAAO,CAAC,MAAM,CAAC,CAOhJ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gCAAgC,CACpD,kBAAkB,EAAE,qCAAqC,EACzD,IAAI,CAAC,EAAE;IACL,kBAAkB,CAAC,EAAE,6BAA6B,CAAA;CACnD,GACA,OAAO,CAAC,oBAAoB,CAAC,CA6B/B;AAED,wBAAsB,kCAAkC,CACtD,kBAAkB,EAAE,qCAAqC,GACxD,OAAO,CAAC,2BAA2B,CAAC,CAkBtC;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,kBAAkB,EAAE,qCAAqC,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9H;AAUD,wBAAgB,iBAAiB,CAAC,kBAAkB,EAAE,qCAAqC,GAAG,qCAAqC,GAAG,MAAM,CAE3I"}

package/dist/authenticators/MsAuthenticator.js

@@ -8,81 +8,88 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UsernamePasswordAuthenticator = exports.ClientCredentialAuthenticator = exports.checkMsIdentityHostname = exports.MS_IDENTITY_HOST_NAME_EU = exports.MS_IDENTITY_HOST_NAME_NONE_EU = void 0;
+exports.determineMSAuthId = exports.UsernamePasswordAuthenticator = exports.newMSClientCredentialAuthenticator = exports.getMSClientCredentialAccessToken = exports.assertEntraCredentialManifestUrlInCorrectRegion = exports.getEntraDIDEndpoint = exports.getMSOpenIDClientRegion = exports.MS_DID_ENDPOINT_EU = exports.MS_DID_ENDPOINT_NON_EU = void 0;
 const msal_node_1 = require("@azure/msal-node");
 const cross_fetch_1 = require("cross-fetch");
+const object_hash_1 = __importDefault(require("object-hash"));
 const EU = 'EU';
 const HTTP_METHOD_GET = 'GET';
-// Event though there are many regions, MS has only 2 identity host names (EU and NONE_EU)
+// Event though there are many regions, MS has only 2 DID identity host names (EU and NON_EU)
 // https://docs.microsoft.com/en-us/azure/active-directory/verifiable-credentials/whats-new#are-there-any-changes-to-the-way-that-we-use-the-request-api-as-a-result-of-this-move
-exports.MS_IDENTITY_HOST_NAME_NONE_EU = 'https://beta.did.msidentity.com/v1.0/';
-exports.MS_IDENTITY_HOST_NAME_EU = 'https://beta.eu.did.msidentity.com/v1.0/';
+exports.MS_DID_ENDPOINT_NON_EU = 'https://beta.did.msidentity.com/v1.0/';
+exports.MS_DID_ENDPOINT_EU = 'https://beta.eu.did.msidentity.com/v1.0/';
 const MS_LOGIN_PREFIX = 'https://login.microsoftonline.com/';
 const MS_LOGIN_OPENID_CONFIG_POSTFIX = '/v2.0/.well-known/openid-configuration';
 const MS_CLIENT_CREDENTIAL_DEFAULT_SCOPE = '3db474b9-6a0c-4840-96ac-1fceb342124f/.default';
 const ERROR_CREDENTIAL_MANIFEST_REGION = `Error in config file. CredentialManifest URL configured for wrong tenant region. Should start with:`;
 const ERROR_ACQUIRE_ACCESS_TOKEN_FOR_CLIENT = 'Could not acquire verifiableCredentials to access your Azure Key Vault:\n';
 const ERROR_FAILED_AUTHENTICATION = 'failed to authenticate: ';
-function getClientRegion(azTenantId) {
+// todo: This is a pretty heavy operation. Getting all the OIDC discovery data from a fetch only to return the region. Probably wise to add some caching and refactor so we can do more with the other OIDC info as well
+function getMSOpenIDClientRegion(azTenantId) {
     return __awaiter(this, void 0, void 0, function* () {
-        let region = EU;
-        yield (0, cross_fetch_1.fetch)(MS_LOGIN_PREFIX + azTenantId + MS_LOGIN_OPENID_CONFIG_POSTFIX, { method: HTTP_METHOD_GET })
+        return (0, cross_fetch_1.fetch)(MS_LOGIN_PREFIX + azTenantId + MS_LOGIN_OPENID_CONFIG_POSTFIX, { method: HTTP_METHOD_GET })
             .then((res) => res.json())
             .then((resp) => __awaiter(this, void 0, void 0, function* () {
-            region = resp.tenant_region_scope;
+            var _a;
+            return (_a = resp.tenant_region_scope) !== null && _a !== void 0 ? _a : EU;
         }));
-        return region;
     });
 }
-function checkMsIdentityHostname(authenticationArgs) {
+exports.getMSOpenIDClientRegion = getMSOpenIDClientRegion;
+function getEntraDIDEndpoint(opts) {
+    var _a;
+    return __awaiter(this, void 0, void 0, function* () {
+        const region = (_a = opts === null || opts === void 0 ? void 0 : opts.region) !== null && _a !== void 0 ? _a : (yield getMSOpenIDClientRegion(opts.azTenantId));
+        return region === EU ? exports.MS_DID_ENDPOINT_EU : exports.MS_DID_ENDPOINT_NON_EU;
+    });
+}
+exports.getEntraDIDEndpoint = getEntraDIDEndpoint;
+function assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs) {
+    var _a;
     return __awaiter(this, void 0, void 0, function* () {
-        const region = authenticationArgs.region ? authenticationArgs.region : yield getClientRegion(authenticationArgs.azTenantId);
-        const msIdentityHostName = region === EU ? exports.MS_IDENTITY_HOST_NAME_EU : exports.MS_IDENTITY_HOST_NAME_NONE_EU;
+        const msDIDEndpoint = yield getEntraDIDEndpoint(authenticationArgs);
         // Check that the Credential Manifest URL is in the same tenant Region and throw an error if it's not
-        if (!authenticationArgs.credentialManifestUrl.startsWith(msIdentityHostName)) {
-            throw new Error(ERROR_CREDENTIAL_MANIFEST_REGION + msIdentityHostName + `. value: ${authenticationArgs.credentialManifestUrl}`);
+        if (!((_a = authenticationArgs.credentialManifestUrl) === null || _a === void 0 ? void 0 : _a.startsWith(msDIDEndpoint))) {
+            throw new Error(ERROR_CREDENTIAL_MANIFEST_REGION + msDIDEndpoint + `. value: ${authenticationArgs.credentialManifestUrl}`);
         }
-        return msIdentityHostName;
+        return msDIDEndpoint;
     });
 }
-exports.checkMsIdentityHostname = checkMsIdentityHostname;
+exports.assertEntraCredentialManifestUrlInCorrectRegion = assertEntraCredentialManifestUrlInCorrectRegion;
 /**
  * necessary fields are:
  *   azClientId: clientId of the application you're trying to login
  *   azClientSecret: secret of the application you're trying to login
  *   azTenantId: your MS Azure tenantId
+ * optional fields:
  *   credentialManifest: address of your credential manifest. usually in following format:
  *    https://beta.eu.did.msidentity.com/v1.0/<tenant_id>/verifiableCredential/contracts/<verifiable_credential_schema>
  * @param authenticationArgs
  * @constructor
  */
-function ClientCredentialAuthenticator(authenticationArgs) {
+function getMSClientCredentialAccessToken(authenticationArgs, opts) {
+    var _a, _b, _c;
     return __awaiter(this, void 0, void 0, function* () {
-        const msalConfig = {
-            auth: {
-                clientId: authenticationArgs.azClientId,
-                authority: authenticationArgs.authority ? authenticationArgs.authority : MS_LOGIN_PREFIX + authenticationArgs.azTenantId,
-                clientSecret: authenticationArgs.azClientSecret,
-            },
-            system: {
-                loggerOptions: {
-                    piiLoggingEnabled: authenticationArgs.piiLoggingEnabled ? authenticationArgs.piiLoggingEnabled : false,
-                    logLevel: authenticationArgs.logLevel ? authenticationArgs.logLevel : msal_node_1.LogLevel.Verbose,
-                },
-            },
-        };
-        const cca = new msal_node_1.ConfidentialClientApplication(msalConfig);
+        const confidentialClient = (_a = opts === null || opts === void 0 ? void 0 : opts.confidentialClient) !== null && _a !== void 0 ? _a : (yield newMSClientCredentialAuthenticator(authenticationArgs).then((cca) => cca.confidentialClient));
+        if (!confidentialClient) {
+            throw Error('No Credential Client Authenticator could be constructed');
+        }
+        if (authenticationArgs === null || authenticationArgs === void 0 ? void 0 : authenticationArgs.credentialManifestUrl) {
+            yield assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs);
+        }
         const msalClientCredentialRequest = {
-            scopes: authenticationArgs.scopes ? authenticationArgs.scopes : [MS_CLIENT_CREDENTIAL_DEFAULT_SCOPE],
-            skipCache: authenticationArgs.skipCache ? authenticationArgs.skipCache : false,
+            scopes: (_b = authenticationArgs.scopes) !== null && _b !== void 0 ? _b : ((authenticationArgs === null || authenticationArgs === void 0 ? void 0 : authenticationArgs.credentialManifestUrl) ? [MS_CLIENT_CREDENTIAL_DEFAULT_SCOPE] : []),
+            skipCache: (_c = authenticationArgs.skipCache) !== null && _c !== void 0 ? _c : false,
         };
-        checkMsIdentityHostname(authenticationArgs);
         // get the Access Token
         try {
-            const result = yield cca.acquireTokenByClientCredential(msalClientCredentialRequest);
-            if (result && result.accessToken) {
-                return result.accessToken;
+            const result = yield confidentialClient.acquireTokenByClientCredential(msalClientCredentialRequest);
+            if (result) {
+                return result;
             }
         }
         catch (err) {
@@ -90,10 +97,33 @@ function ClientCredentialAuthenticator(authenticationArgs) {
                 error: ERROR_ACQUIRE_ACCESS_TOKEN_FOR_CLIENT + err,
             };
         }
-        return '';
+        throw {
+            error: ERROR_ACQUIRE_ACCESS_TOKEN_FOR_CLIENT,
+        };
     });
 }
-exports.ClientCredentialAuthenticator = ClientCredentialAuthenticator;
+exports.getMSClientCredentialAccessToken = getMSClientCredentialAccessToken;
+function newMSClientCredentialAuthenticator(authenticationArgs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const didEndpoint = (authenticationArgs === null || authenticationArgs === void 0 ? void 0 : authenticationArgs.credentialManifestUrl)
+            ? yield assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs)
+            : undefined;
+        const auth = authOptions(authenticationArgs);
+        const id = (0, object_hash_1.default)(auth);
+        const msalConfig = {
+            auth,
+            system: {
+                loggerOptions: {
+                    piiLoggingEnabled: authenticationArgs.piiLoggingEnabled ? authenticationArgs.piiLoggingEnabled : false,
+                    logLevel: authenticationArgs.logLevel ? authenticationArgs.logLevel : msal_node_1.LogLevel.Verbose,
+                },
+            },
+        };
+        const confidentialClientApp = new msal_node_1.ConfidentialClientApplication(msalConfig);
+        return { confidentialClient: confidentialClientApp, msalConfig, authenticationArgs, didEndpoint, id };
+    });
+}
+exports.newMSClientCredentialAuthenticator = newMSClientCredentialAuthenticator;
 /**
  * Logs in with provided authenticationArgs and returns access token
  * @param authenticationArgs
@@ -102,10 +132,7 @@ exports.ClientCredentialAuthenticator = ClientCredentialAuthenticator;
 function UsernamePasswordAuthenticator(authenticationArgs) {
     return __awaiter(this, void 0, void 0, function* () {
         const msalConfig = {
-            auth: {
-                clientId: authenticationArgs.azClientId,
-                authority: authenticationArgs.authority ? authenticationArgs.authority : MS_LOGIN_PREFIX + authenticationArgs.azTenantId,
-            },
+            auth: authOptions(authenticationArgs),
         };
         const pca = new msal_node_1.PublicClientApplication(msalConfig);
         return yield pca
@@ -119,4 +146,11 @@ function UsernamePasswordAuthenticator(authenticationArgs) {
     });
 }
 exports.UsernamePasswordAuthenticator = UsernamePasswordAuthenticator;
+function authOptions(authenticationArgs) {
+    return Object.assign({ clientId: authenticationArgs.azClientId, authority: authenticationArgs.authority ? authenticationArgs.authority : MS_LOGIN_PREFIX + authenticationArgs.azTenantId }, (authenticationArgs && 'azClientSecret' in authenticationArgs && { clientSecret: authenticationArgs.azClientSecret }));
+}
+function determineMSAuthId(authenticationArgs) {
+    return (0, object_hash_1.default)(authOptions(authenticationArgs));
+}
+exports.determineMSAuthId = determineMSAuthId;
 //# sourceMappingURL=MsAuthenticator.js.map

package/dist/authenticators/MsAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"MsAuthenticator.js","sourceRoot":"","sources":["../../src/authenticators/MsAuthenticator.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gDAA4H;AAE5H,6CAAmC;AAEnC,MAAM,EAAE,GAAG,IAAI,CAAA;AAEf,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,0FAA0F;AAC1F,iLAAiL;AACpK,QAAA,6BAA6B,GAAG,uCAAuC,CAAA;AACvE,QAAA,wBAAwB,GAAG,0CAA0C,CAAA;AAClF,MAAM,eAAe,GAAG,oCAAoC,CAAA;AAC5D,MAAM,8BAA8B,GAAG,wCAAwC,CAAA;AAC/E,MAAM,kCAAkC,GAAG,+CAA+C,CAAA;AAE1F,MAAM,gCAAgC,GAAG,qGAAqG,CAAA;AAC9I,MAAM,qCAAqC,GAAG,2EAA2E,CAAA;AACzH,MAAM,2BAA2B,GAAG,0BAA0B,CAAA;AAE9D,SAAe,eAAe,CAAC,UAAkB;;QAC/C,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,IAAA,mBAAK,EAAC,eAAe,GAAG,UAAU,GAAG,8BAA8B,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;aACpG,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACzB,IAAI,CAAC,CAAO,IAAI,EAAE,EAAE;YACnB,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnC,CAAC,CAAA,CAAC,CAAA;QACJ,OAAO,MAAM,CAAA;IACf,CAAC;CAAA;AAED,SAAsB,uBAAuB,CAAC,kBAAyD;;QACrG,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;QAC3H,MAAM,kBAAkB,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,gCAAwB,CAAC,CAAC,CAAC,qCAA6B,CAAA;QACnG,qGAAqG;QACrG,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;YAC5E,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,kBAAkB,GAAG,YAAY,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,CAAA;SAChI;QACD,OAAO,kBAAkB,CAAA;IAC3B,CAAC;CAAA;AARD,0DAQC;AAED;;;;;;;;;GASG;AACH,SAAsB,6BAA6B,CAAC,kBAAyD;;QAC3G,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE;gBACJ,QAAQ,EAAE,kBAAkB,CAAC,UAAU;gBACvC,SAAS,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,GAAG,kBAAkB,CAAC,UAAU;gBACxH,YAAY,EAAE,kBAAkB,CAAC,cAAc;aAChD;YACD,MAAM,EAAE;gBACN,aAAa,EAAE;oBACb,iBAAiB,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK;oBACtG,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAQ,CAAC,OAAO;iBACvF;aACF;SACF,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,yCAA6B,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,2BAA2B,GAAG;YAClC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC;YACpG,SAAS,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SAC/E,CAAA;QAED,uBAAuB,CAAC,kBAAkB,CAAC,CAAA;QAE3C,uBAAuB;QACvB,IAAI;YACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAA;YACpF,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE;gBAChC,OAAO,MAAM,CAAC,WAAW,CAAA;aAC1B;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM;gBACJ,KAAK,EAAE,qCAAqC,GAAG,GAAG;aACnD,CAAA;SACF;QACD,OAAO,EAAE,CAAA;IACX,CAAC;CAAA;AAnCD,sEAmCC;AAED;;;;GAIG;AACH,SAAsB,6BAA6B,CAAC,kBAAyD;;QAC3G,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE;gBACJ,QAAQ,EAAE,kBAAkB,CAAC,UAAU;gBACvC,SAAS,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,GAAG,kBAAkB,CAAC,UAAU;aACzH;SACF,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,mCAAuB,CAAC,UAAU,CAAC,CAAA;QACnD,OAAO,MAAM,GAAG;aACb,8BAA8B,CAAC,kBAA6C,CAAC;aAC7E,IAAI,CAAC,CAAC,QAAa,EAAE,EAAE;YACtB,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;IACN,CAAC;CAAA;AAhBD,sEAgBC"}
+{"version":3,"file":"MsAuthenticator.js","sourceRoot":"","sources":["../../src/authenticators/MsAuthenticator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,gDAQyB;AACzB,6CAAmC;AAGnC,8DAA8B;AAE9B,MAAM,EAAE,GAAG,IAAI,CAAA;AAEf,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,6FAA6F;AAC7F,iLAAiL;AACpK,QAAA,sBAAsB,GAAG,uCAAuC,CAAA;AAChE,QAAA,kBAAkB,GAAG,0CAA0C,CAAA;AAC5E,MAAM,eAAe,GAAG,oCAAoC,CAAA;AAC5D,MAAM,8BAA8B,GAAG,wCAAwC,CAAA;AAC/E,MAAM,kCAAkC,GAAG,+CAA+C,CAAA;AAE1F,MAAM,gCAAgC,GAAG,qGAAqG,CAAA;AAC9I,MAAM,qCAAqC,GAAG,2EAA2E,CAAA;AACzH,MAAM,2BAA2B,GAAG,0BAA0B,CAAA;AAE9D,wNAAwN;AACxN,SAAsB,uBAAuB,CAAC,UAAkB;;QAC9D,OAAO,IAAA,mBAAK,EAAC,eAAe,GAAG,UAAU,GAAG,8BAA8B,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;aACrG,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACzB,IAAI,CAAC,CAAO,IAAI,EAAE,EAAE;;YACnB,OAAO,MAAA,IAAI,CAAC,mBAAmB,mCAAI,EAAE,CAAA;QACvC,CAAC,CAAA,CAAC,CAAA;IACN,CAAC;CAAA;AAND,0DAMC;AAED,SAAsB,mBAAmB,CAAC,IAA6C;;;QACrF,MAAM,MAAM,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/E,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,0BAAkB,CAAC,CAAC,CAAC,8BAAsB,CAAA;;CACnE;AAHD,kDAGC;AAED,SAAsB,+CAA+C,CAAC,kBAAyD;;;QAC7H,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,CAAA;QACnE,qGAAqG;QACrG,IAAI,CAAC,CAAA,MAAA,kBAAkB,CAAC,qBAAqB,0CAAE,UAAU,CAAC,aAAa,CAAC,CAAA,EAAE;YACxE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,aAAa,GAAG,YAAY,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,CAAA;SAC3H;QACD,OAAO,aAAa,CAAA;;CACrB;AAPD,0GAOC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,gCAAgC,CACpD,kBAAyD,EACzD,IAEC;;;QAED,MAAM,kBAAkB,GACtB,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,kBAAkB,mCAAI,CAAC,MAAM,kCAAkC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAClI,IAAI,CAAC,kBAAkB,EAAE;YACvB,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAA;SACvE;QACD,IAAI,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,qBAAqB,EAAE;YAC7C,MAAM,+CAA+C,CAAC,kBAAkB,CAAC,CAAA;SAC1E;QAED,MAAM,2BAA2B,GAAG;YAClC,MAAM,EAAE,MAAA,kBAAkB,CAAC,MAAM,mCAAI,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,qBAAqB,EAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5H,SAAS,EAAE,MAAA,kBAAkB,CAAC,SAAS,mCAAI,KAAK;SACjD,CAAA;QAED,uBAAuB;QACvB,IAAI;YACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAA;YACnG,IAAI,MAAM,EAAE;gBACV,OAAO,MAAM,CAAA;aACd;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM;gBACJ,KAAK,EAAE,qCAAqC,GAAG,GAAG;aACnD,CAAA;SACF;QACD,MAAM;YACJ,KAAK,EAAE,qCAAqC;SAC7C,CAAA;;CACF;AAlCD,4EAkCC;AAED,SAAsB,kCAAkC,CACtD,kBAAyD;;QAEzD,MAAM,WAAW,GAAG,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,qBAAqB;YAC3D,CAAC,CAAC,MAAM,+CAA+C,CAAC,kBAAkB,CAAC;YAC3E,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,IAAI,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,EAAE,GAAG,IAAA,qBAAI,EAAC,IAAI,CAAC,CAAA;QACrB,MAAM,UAAU,GAAkB;YAChC,IAAI;YACJ,MAAM,EAAE;gBACN,aAAa,EAAE;oBACb,iBAAiB,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK;oBACtG,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAQ,CAAC,OAAO;iBACvF;aACF;SACF,CAAA;QACD,MAAM,qBAAqB,GAAG,IAAI,yCAA6B,CAAC,UAAU,CAAC,CAAA;QAE3E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IACvG,CAAC;CAAA;AApBD,gFAoBC;AAED;;;;GAIG;AACH,SAAsB,6BAA6B,CAAC,kBAAyD;;QAC3G,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,kBAAkB,CAAC;SACtC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,mCAAuB,CAAC,UAAU,CAAC,CAAA;QACnD,OAAO,MAAM,GAAG;aACb,8BAA8B,CAAC,kBAA6C,CAAC;aAC7E,IAAI,CAAC,CAAC,QAAa,EAAE,EAAE;YACtB,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;IACN,CAAC;CAAA;AAbD,sEAaC;AAED,SAAS,WAAW,CAAC,kBAAiG;IACpH,uBACE,QAAQ,EAAE,kBAAkB,CAAC,UAAU,EACvC,SAAS,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,GAAG,kBAAkB,CAAC,UAAU,IACrH,CAAC,kBAAkB,IAAI,gBAAgB,IAAI,kBAAkB,IAAI,EAAE,YAAY,EAAE,kBAAkB,CAAC,cAAc,EAAE,CAAC,EACzH;AACH,CAAC;AAED,SAAgB,iBAAiB,CAAC,kBAAiG;IACjI,OAAO,IAAA,qBAAI,EAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAC9C,CAAC;AAFD,8CAEC"}

package/dist/types/IMsAuthenticator.d.ts

@@ -1,5 +1,4 @@
-import { IAgentContext } from '@veramo/core';
-import { LogLevel } from '@azure/msal-node';
+import { ConfidentialClientApplication, Configuration, LogLevel } from '@azure/msal-node';
 /**
  *   azClientId: clientId of the application you're trying to login
  *   azClientSecret: secret of the application you're trying to login
@@ -25,7 +24,7 @@ export interface IMsAuthenticationClientCredentialArgs {
     azClientId: string;
     azTenantId: string;
     azClientSecret: string;
-    credentialManifestUrl: string;
+    credentialManifestUrl?: string;
     authority?: string;
     region?: string;
     scopes?: string[];
@@ -51,6 +50,11 @@ export interface IMsAuthenticationUsernamePasswordArgs {
     username: string;
     authority?: string;
 }
-export type IRequiredContext = IAgentContext<Record<string, never>>;
-export type IMsAuthenticationResponse = String;
+export interface IMSClientCredentialAuthInfo {
+    id: string;
+    confidentialClient: ConfidentialClientApplication;
+    msalConfig: Configuration;
+    authenticationArgs: IMsAuthenticationClientCredentialArgs;
+    didEndpoint?: string;
+}
 //# sourceMappingURL=IMsAuthenticator.d.ts.map

package/dist/types/IMsAuthenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IMsAuthenticator.d.ts","sourceRoot":"","sources":["../../src/types/IMsAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qCAAqC;IACpD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qCAAqC;IACpD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AACnE,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAA"}
+{"version":3,"file":"IMsAuthenticator.d.ts","sourceRoot":"","sources":["../../src/types/IMsAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACzF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qCAAqC;IACpD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qCAAqC;IACpD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,6BAA6B,CAAA;IACjD,UAAU,EAAE,aAAa,CAAA;IACzB,kBAAkB,EAAE,qCAAqC,CAAA;IACzD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-sdk.ms-authenticator",
-  "version": "0.13.1-next.3+cf98046",
+  "version": "0.13.1-next.33+a7cf5cd",
   "source": "src/index.ts",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,16 +9,20 @@
     "build:clean": "tsc --build --clean && tsc --build"
   },
   "dependencies": {
-    "@azure/msal-common": "^11.0.0",
-    "@azure/msal-node": "^1.16.0",
-    "@veramo/core": "4.2.0",
-    "cross-fetch": "^3.1.5"
+    "@azure/msal-common": "^13.2.0",
+    "@azure/msal-node": "^1.18.0",
+    "cross-fetch": "^3.1.5",
+    "object-hash": "^3.0.0"
   },
   "devDependencies": {
     "@types/jest": "^27.5.2",
-    "jest": "^27.5.1",
-    "prettier": "^2.4.1",
-    "ts-jest": "^27.1.5"
+    "@types/object-hash": "^3.0.2",
+    "jest": "^29.6.1",
+    "prettier": "^2.8.8",
+    "ts-jest": "^29.1.1"
+  },
+  "engines": {
+    "node": ">= 16.0"
   },
   "files": [
     "dist/**/*",
@@ -42,5 +46,5 @@
     "SSI",
     "Veramo"
   ],
-  "gitHead": "cf9804640b7881973e03389e05e5fa4734f107a7"
+  "gitHead": "a7cf5cd23f39321ecb7c35589723a5d23114d460"
 }

package/src/authenticators/MsAuthenticator.ts

@@ -1,15 +1,25 @@
-import { ConfidentialClientApplication, LogLevel, PublicClientApplication, UsernamePasswordRequest } from '@azure/msal-node'
-import { IMsAuthenticationClientCredentialArgs, IMsAuthenticationUsernamePasswordArgs } from '../index'
+import {
+  AuthenticationResult,
+  ConfidentialClientApplication,
+  Configuration,
+  LogLevel,
+  NodeAuthOptions,
+  PublicClientApplication,
+  UsernamePasswordRequest,
+} from '@azure/msal-node'
 import { fetch } from 'cross-fetch'
+import { IMSClientCredentialAuthInfo, IMsAuthenticationClientCredentialArgs, IMsAuthenticationUsernamePasswordArgs } from '../index'
+
+import hash from 'object-hash'
 
 const EU = 'EU'
 
 const HTTP_METHOD_GET = 'GET'
 
-// Event though there are many regions, MS has only 2 identity host names (EU and NONE_EU)
+// Event though there are many regions, MS has only 2 DID identity host names (EU and NON_EU)
 // https://docs.microsoft.com/en-us/azure/active-directory/verifiable-credentials/whats-new#are-there-any-changes-to-the-way-that-we-use-the-request-api-as-a-result-of-this-move
-export const MS_IDENTITY_HOST_NAME_NONE_EU = 'https://beta.did.msidentity.com/v1.0/'
-export const MS_IDENTITY_HOST_NAME_EU = 'https://beta.eu.did.msidentity.com/v1.0/'
+export const MS_DID_ENDPOINT_NON_EU = 'https://beta.did.msidentity.com/v1.0/'
+export const MS_DID_ENDPOINT_EU = 'https://beta.eu.did.msidentity.com/v1.0/'
 const MS_LOGIN_PREFIX = 'https://login.microsoftonline.com/'
 const MS_LOGIN_OPENID_CONFIG_POSTFIX = '/v2.0/.well-known/openid-configuration'
 const MS_CLIENT_CREDENTIAL_DEFAULT_SCOPE = '3db474b9-6a0c-4840-96ac-1fceb342124f/.default'
@@ -18,24 +28,27 @@ const ERROR_CREDENTIAL_MANIFEST_REGION = `Error in config file. CredentialManife
 const ERROR_ACQUIRE_ACCESS_TOKEN_FOR_CLIENT = 'Could not acquire verifiableCredentials to access your Azure Key Vault:\n'
 const ERROR_FAILED_AUTHENTICATION = 'failed to authenticate: '
 
-async function getClientRegion(azTenantId: string): Promise<string> {
-  let region = EU
-  await fetch(MS_LOGIN_PREFIX + azTenantId + MS_LOGIN_OPENID_CONFIG_POSTFIX, { method: HTTP_METHOD_GET })
+// todo: This is a pretty heavy operation. Getting all the OIDC discovery data from a fetch only to return the region. Probably wise to add some caching and refactor so we can do more with the other OIDC info as well
+export async function getMSOpenIDClientRegion(azTenantId: string): Promise<string> {
+  return fetch(MS_LOGIN_PREFIX + azTenantId + MS_LOGIN_OPENID_CONFIG_POSTFIX, { method: HTTP_METHOD_GET })
     .then((res) => res.json())
     .then(async (resp) => {
-      region = resp.tenant_region_scope
+      return resp.tenant_region_scope ?? EU
     })
-  return region
 }
 
-export async function checkMsIdentityHostname(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<string> {
-  const region = authenticationArgs.region ? authenticationArgs.region : await getClientRegion(authenticationArgs.azTenantId)
-  const msIdentityHostName = region === EU ? MS_IDENTITY_HOST_NAME_EU : MS_IDENTITY_HOST_NAME_NONE_EU
+export async function getEntraDIDEndpoint(opts: { region?: string; azTenantId: string }) {
+  const region = opts?.region ?? (await getMSOpenIDClientRegion(opts.azTenantId))
+  return region === EU ? MS_DID_ENDPOINT_EU : MS_DID_ENDPOINT_NON_EU
+}
+
+export async function assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<string> {
+  const msDIDEndpoint = await getEntraDIDEndpoint(authenticationArgs)
   // Check that the Credential Manifest URL is in the same tenant Region and throw an error if it's not
-  if (!authenticationArgs.credentialManifestUrl.startsWith(msIdentityHostName)) {
-    throw new Error(ERROR_CREDENTIAL_MANIFEST_REGION + msIdentityHostName + `. value: ${authenticationArgs.credentialManifestUrl}`)
+  if (!authenticationArgs.credentialManifestUrl?.startsWith(msDIDEndpoint)) {
+    throw new Error(ERROR_CREDENTIAL_MANIFEST_REGION + msDIDEndpoint + `. value: ${authenticationArgs.credentialManifestUrl}`)
   }
-  return msIdentityHostName
+  return msDIDEndpoint
 }
 
 /**
@@ -43,46 +56,68 @@ export async function checkMsIdentityHostname(authenticationArgs: IMsAuthenticat
  *   azClientId: clientId of the application you're trying to login
  *   azClientSecret: secret of the application you're trying to login
  *   azTenantId: your MS Azure tenantId
+ * optional fields:
  *   credentialManifest: address of your credential manifest. usually in following format:
  *    https://beta.eu.did.msidentity.com/v1.0/<tenant_id>/verifiableCredential/contracts/<verifiable_credential_schema>
  * @param authenticationArgs
  * @constructor
  */
-export async function ClientCredentialAuthenticator(authenticationArgs: IMsAuthenticationClientCredentialArgs): Promise<string> {
-  const msalConfig = {
-    auth: {
-      clientId: authenticationArgs.azClientId,
-      authority: authenticationArgs.authority ? authenticationArgs.authority : MS_LOGIN_PREFIX + authenticationArgs.azTenantId,
-      clientSecret: authenticationArgs.azClientSecret,
-    },
-    system: {
-      loggerOptions: {
-        piiLoggingEnabled: authenticationArgs.piiLoggingEnabled ? authenticationArgs.piiLoggingEnabled : false,
-        logLevel: authenticationArgs.logLevel ? authenticationArgs.logLevel : LogLevel.Verbose,
-      },
-    },
+export async function getMSClientCredentialAccessToken(
+  authenticationArgs: IMsAuthenticationClientCredentialArgs,
+  opts?: {
+    confidentialClient?: ConfidentialClientApplication
+  }
+): Promise<AuthenticationResult> {
+  const confidentialClient =
+    opts?.confidentialClient ?? (await newMSClientCredentialAuthenticator(authenticationArgs).then((cca) => cca.confidentialClient))
+  if (!confidentialClient) {
+    throw Error('No Credential Client Authenticator could be constructed')
+  }
+  if (authenticationArgs?.credentialManifestUrl) {
+    await assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs)
   }
 
-  const cca = new ConfidentialClientApplication(msalConfig)
   const msalClientCredentialRequest = {
-    scopes: authenticationArgs.scopes ? authenticationArgs.scopes : [MS_CLIENT_CREDENTIAL_DEFAULT_SCOPE],
-    skipCache: authenticationArgs.skipCache ? authenticationArgs.skipCache : false,
+    scopes: authenticationArgs.scopes ?? (authenticationArgs?.credentialManifestUrl ? [MS_CLIENT_CREDENTIAL_DEFAULT_SCOPE] : []),
+    skipCache: authenticationArgs.skipCache ?? false,
   }
 
-  checkMsIdentityHostname(authenticationArgs)
-
   // get the Access Token
   try {
-    const result = await cca.acquireTokenByClientCredential(msalClientCredentialRequest)
-    if (result && result.accessToken) {
-      return result.accessToken
+    const result = await confidentialClient.acquireTokenByClientCredential(msalClientCredentialRequest)
+    if (result) {
+      return result
     }
   } catch (err) {
     throw {
       error: ERROR_ACQUIRE_ACCESS_TOKEN_FOR_CLIENT + err,
     }
   }
-  return ''
+  throw {
+    error: ERROR_ACQUIRE_ACCESS_TOKEN_FOR_CLIENT,
+  }
+}
+
+export async function newMSClientCredentialAuthenticator(
+  authenticationArgs: IMsAuthenticationClientCredentialArgs
+): Promise<IMSClientCredentialAuthInfo> {
+  const didEndpoint = authenticationArgs?.credentialManifestUrl
+    ? await assertEntraCredentialManifestUrlInCorrectRegion(authenticationArgs)
+    : undefined
+  const auth = authOptions(authenticationArgs)
+  const id = hash(auth)
+  const msalConfig: Configuration = {
+    auth,
+    system: {
+      loggerOptions: {
+        piiLoggingEnabled: authenticationArgs.piiLoggingEnabled ? authenticationArgs.piiLoggingEnabled : false,
+        logLevel: authenticationArgs.logLevel ? authenticationArgs.logLevel : LogLevel.Verbose,
+      },
+    },
+  }
+  const confidentialClientApp = new ConfidentialClientApplication(msalConfig)
+
+  return { confidentialClient: confidentialClientApp, msalConfig, authenticationArgs, didEndpoint, id }
 }
 
 /**
@@ -92,10 +127,7 @@ export async function ClientCredentialAuthenticator(authenticationArgs: IMsAuthe
  */
 export async function UsernamePasswordAuthenticator(authenticationArgs: IMsAuthenticationUsernamePasswordArgs): Promise<string> {
   const msalConfig = {
-    auth: {
-      clientId: authenticationArgs.azClientId,
-      authority: authenticationArgs.authority ? authenticationArgs.authority : MS_LOGIN_PREFIX + authenticationArgs.azTenantId,
-    },
+    auth: authOptions(authenticationArgs),
   }
   const pca = new PublicClientApplication(msalConfig)
   return await pca
@@ -107,3 +139,15 @@ export async function UsernamePasswordAuthenticator(authenticationArgs: IMsAuthe
       throw new Error(ERROR_FAILED_AUTHENTICATION + error)
     })
 }
+
+function authOptions(authenticationArgs: IMsAuthenticationClientCredentialArgs | IMsAuthenticationUsernamePasswordArgs): NodeAuthOptions {
+  return {
+    clientId: authenticationArgs.azClientId,
+    authority: authenticationArgs.authority ? authenticationArgs.authority : MS_LOGIN_PREFIX + authenticationArgs.azTenantId,
+    ...(authenticationArgs && 'azClientSecret' in authenticationArgs && { clientSecret: authenticationArgs.azClientSecret }),
+  }
+}
+
+export function determineMSAuthId(authenticationArgs: IMsAuthenticationClientCredentialArgs | IMsAuthenticationUsernamePasswordArgs): string {
+  return hash(authOptions(authenticationArgs))
+}

package/src/types/IMsAuthenticator.ts

@@ -1,6 +1,4 @@
-import { IAgentContext } from '@veramo/core'
-import { LogLevel } from '@azure/msal-node'
-
+import { ConfidentialClientApplication, Configuration, LogLevel } from '@azure/msal-node'
 /**
  *   azClientId: clientId of the application you're trying to login
  *   azClientSecret: secret of the application you're trying to login
@@ -26,7 +24,7 @@ export interface IMsAuthenticationClientCredentialArgs {
   azClientId: string
   azTenantId: string
   azClientSecret: string
-  credentialManifestUrl: string
+  credentialManifestUrl?: string
   authority?: string
   region?: string
   scopes?: string[]
@@ -54,5 +52,10 @@ export interface IMsAuthenticationUsernamePasswordArgs {
   authority?: string
 }
 
-export type IRequiredContext = IAgentContext<Record<string, never>>
-export type IMsAuthenticationResponse = String
+export interface IMSClientCredentialAuthInfo {
+  id: string
+  confidentialClient: ConfidentialClientApplication
+  msalConfig: Configuration
+  authenticationArgs: IMsAuthenticationClientCredentialArgs
+  didEndpoint?: string
+}