plugin-data-source-mssql 2.0.5 → 2.0.6

package/dist/tedious/node_modules/@azure/msal-browser/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -4,75 +4,81 @@
  */
 
 import {
-    Logger,
-    ICrypto,
-    PromptValue,
-    AuthToken,
-    Constants,
+    AADServerParamKeys,
+    AccessTokenEntity,
     AccountEntity,
+    AccountEntityUtils,
+    AccountInfo,
+    AuthError,
+    AuthToken,
     AuthorityType,
-    ScopeSet,
-    TimeUtils,
-    AuthenticationScheme,
-    UrlString,
-    OIDC_DEFAULT_SCOPES,
-    PopTokenGenerator,
-    SignedHttpRequestParameters,
+    CacheHelpers,
+    ClientAuthErrorCodes,
+    CommonSilentFlowRequest,
+    Constants,
+    ICrypto,
     IPerformanceClient,
-    PerformanceEvents,
     IdTokenEntity,
-    AccessTokenEntity,
-    AuthError,
-    CommonSilentFlowRequest,
-    AccountInfo,
-    AADServerParamKeys,
+    InProgressPerformanceEvent,
+    Logger,
+    PerformanceEvents,
+    PopTokenGenerator,
+    RequestParameterBuilder,
+    ScopeSet,
+    ServerTelemetryManager,
+    SignedHttpRequestParameters,
+    TimeUtils,
     TokenClaims,
+    UrlString,
+    buildAccountToCache,
     createClientAuthError,
-    ClientAuthErrorCodes,
     invokeAsync,
     updateAccountTenantProfileData,
-    CacheHelpers,
-    buildAccountToCache,
-    InProgressPerformanceEvent,
-    ServerTelemetryManager,
 } from "@azure/msal-common/browser";
-import { BaseInteractionClient } from "./BaseInteractionClient.js";
-import { BrowserConfiguration } from "../config/Configuration.js";
-import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
-import { EventHandler } from "../event/EventHandler.js";
-import { PopupRequest } from "../request/PopupRequest.js";
-import { SilentRequest } from "../request/SilentRequest.js";
-import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import {
-    ApiId,
-    TemporaryCacheKeys,
-    PlatformAuthConstants,
-    BrowserConstants,
-    CacheLookupPolicy,
-} from "../utils/BrowserConstants.js";
+import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 import { PlatformAuthRequest } from "../broker/nativeBroker/PlatformAuthRequest.js";
 import {
     MATS,
     PlatformAuthResponse,
 } from "../broker/nativeBroker/PlatformAuthResponse.js";
+import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
+import { BrowserConfiguration } from "../config/Configuration.js";
+import { base64Decode } from "../encode/Base64Decode.js";
+import {
+    BrowserAuthErrorCodes,
+    createBrowserAuthError,
+} from "../error/BrowserAuthError.js";
 import {
     NativeAuthError,
     NativeAuthErrorCodes,
     createNativeAuthError,
     isFatalNativeAuthError,
 } from "../error/NativeAuthError.js";
-import { RedirectRequest } from "../request/RedirectRequest.js";
-import { NavigationOptions } from "../navigation/NavigationOptions.js";
+import { EventHandler } from "../event/EventHandler.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
+import { NavigationOptions } from "../navigation/NavigationOptions.js";
+import { version } from "../packageMetadata.js";
+import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
+import { PopupRequest } from "../request/PopupRequest.js";
+import { RedirectRequest } from "../request/RedirectRequest.js";
+import { SilentRequest } from "../request/SilentRequest.js";
+import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
+import { AuthenticationResult } from "../response/AuthenticationResult.js";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
-    createBrowserAuthError,
-    BrowserAuthErrorCodes,
-} from "../error/BrowserAuthError.js";
+    ApiId,
+    BrowserConstants,
+    CacheLookupPolicy,
+    PlatformAuthConstants,
+    TemporaryCacheKeys,
+} from "../utils/BrowserConstants.js";
+import {
+    BaseInteractionClient,
+    getDiscoveredAuthority,
+    getRedirectUri,
+    initializeServerTelemetryManager,
+} from "./BaseInteractionClient.js";
 import { SilentCacheClient } from "./SilentCacheClient.js";
-import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { base64Decode } from "../encode/Base64Decode.js";
-import { version } from "../packageMetadata.js";
-import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 
 export class PlatformAuthInteractionClient extends BaseInteractionClient {
     protected apiId: ApiId;
@@ -94,7 +100,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         provider: IPlatformAuthHandler,
         accountId: string,
         nativeStorageImpl: BrowserCacheManager,
-        correlationId?: string
+        correlationId: string
     ) {
         super(
             config,
@@ -104,8 +110,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             eventHandler,
             navigationClient,
             performanceClient,
-            provider,
-            correlationId
+            correlationId,
+            provider
         );
         this.apiId = apiId;
         this.accountId = accountId;
@@ -119,8 +125,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             eventHandler,
             navigationClient,
             performanceClient,
-            provider,
-            correlationId
+            correlationId,
+            provider
         );
 
         const extensionName = this.platformAuthProvider.getExtensionName();
@@ -153,26 +159,29 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         request: PopupRequest | SilentRequest | SsoSilentRequest,
         cacheLookupPolicy?: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.NativeInteractionClientAcquireToken,
+        this.logger.trace(
+            "NativeInteractionClient - acquireToken called.",
             this.correlationId
         );
-        this.logger.trace("NativeInteractionClient - acquireToken called.");
 
         // start the perf measurement
         const nativeATMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.NativeInteractionClientAcquireToken,
+            BrowserPerformanceEvents.NativeInteractionClientAcquireToken,
             this.correlationId
         );
         const reqTimestamp = TimeUtils.nowSeconds();
 
-        const serverTelemetryManager = this.initializeServerTelemetryManager(
-            this.apiId
+        const serverTelemetryManager = initializeServerTelemetryManager(
+            this.apiId,
+            this.config.auth.clientId,
+            this.correlationId,
+            this.browserStorage,
+            this.logger
         );
 
         try {
             // initialize native request
-            const nativeRequest = await this.initializeNativeRequest(request);
+            const nativeRequest = await this.initializePlatformRequest(request);
 
             // check if the tokens can be retrieved from internal cache
             try {
@@ -189,7 +198,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             } catch (e) {
                 if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
                     this.logger.info(
-                        "MSAL internal Cache does not contain tokens, return error as per cache policy"
+                        "MSAL internal Cache does not contain tokens, return error as per cache policy",
+                        this.correlationId
                     );
                     nativeATMeasurement.end({
                         success: false,
@@ -199,7 +209,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 }
                 // continue with a native call for any and all errors
                 this.logger.info(
-                    "MSAL internal Cache does not contain tokens, proceed to make a native call"
+                    "MSAL internal Cache does not contain tokens, proceed to make a native call",
+                    this.correlationId
                 );
             }
 
@@ -270,7 +281,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
     ): Promise<AuthenticationResult> {
         if (!nativeAccountId) {
             this.logger.warning(
-                "NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided"
+                "NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided",
+                this.correlationId
             );
             throw createClientAuthError(ClientAuthErrorCodes.noAccountFound);
         }
@@ -296,14 +308,29 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 silentRequest
             );
 
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims as TokenClaims,
-                idToken: result?.idToken,
-            };
+            const idToken = this.browserStorage.getIdToken(
+                account,
+                this.correlationId,
+                this.browserStorage.getTokenKeys(),
+                account.tenantId
+            );
+
+            const idTokenClaims = AuthToken.extractTokenClaims(
+                idToken?.secret || "",
+                base64Decode
+            );
+
+            const fullAccount = updateAccountTenantProfileData(
+                account,
+                undefined, // tenantProfile optional
+                idTokenClaims,
+                idToken?.secret
+            );
 
             return {
                 ...result,
+                idToken: idToken?.secret || "",
+                idTokenClaims: idTokenClaims as TokenClaims,
                 account: fullAccount,
             };
         } catch (e) {
@@ -315,29 +342,34 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
      * @param {RedirectRequest} request
      * @param {InProgressPerformanceEvent} rootMeasurement
+     * @param {HandleRedirectPromiseOptions} options
      */
     async acquireTokenRedirect(
         request: RedirectRequest,
-        rootMeasurement: InProgressPerformanceEvent
+        rootMeasurement: InProgressPerformanceEvent,
+        options?: HandleRedirectPromiseOptions
     ): Promise<void> {
         this.logger.trace(
-            "NativeInteractionClient - acquireTokenRedirect called."
+            "NativeInteractionClient - acquireTokenRedirect called.",
+            this.correlationId
         );
 
-        const { ...remainingParameters } = request;
-        delete remainingParameters.onRedirectNavigate;
-
-        const nativeRequest = await this.initializeNativeRequest(
-            remainingParameters
-        );
+        const nativeRequest = await this.initializePlatformRequest(request);
+        const navigateToLoginRequestUrl =
+            options?.navigateToLoginRequestUrl ?? true;
 
         try {
             await this.platformAuthProvider.sendMessage(nativeRequest);
         } catch (e) {
             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
             if (e instanceof NativeAuthError) {
-                const serverTelemetryManager =
-                    this.initializeServerTelemetryManager(this.apiId);
+                const serverTelemetryManager = initializeServerTelemetryManager(
+                    this.apiId,
+                    this.config.auth.clientId,
+                    this.correlationId,
+                    this.browserStorage,
+                    this.logger
+                );
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
                     throw e;
@@ -355,9 +387,14 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             timeout: this.config.system.redirectNavigationTimeout,
             noHistory: false,
         };
-        const redirectUri = this.config.auth.navigateToLoginRequestUrl
+        const redirectUri = navigateToLoginRequestUrl
             ? window.location.href
-            : this.getRedirectUri(request.redirectUri);
+            : getRedirectUri(
+                  request.redirectUri,
+                  this.config.auth.redirectUri,
+                  this.logger,
+                  this.correlationId
+              );
         rootMeasurement.end({ success: true });
         await this.navigationClient.navigateExternal(
             redirectUri,
@@ -370,16 +407,15 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param performanceClient {IPerformanceClient?}
      * @param correlationId {string?} correlation identifier
      */
-    async handleRedirectPromise(
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
-    ): Promise<AuthenticationResult | null> {
+    async handleRedirectPromise(): Promise<AuthenticationResult | null> {
         this.logger.trace(
-            "NativeInteractionClient - handleRedirectPromise called."
+            "NativeInteractionClient - handleRedirectPromise called.",
+            this.correlationId
         );
         if (!this.browserStorage.isInteractionInProgress(true)) {
             this.logger.info(
-                "handleRedirectPromise called but there is no interaction in progress, returning null."
+                "handleRedirectPromise called but there is no interaction in progress, returning null.",
+                this.correlationId
             );
             return null;
         }
@@ -388,21 +424,21 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         const cachedRequest = this.browserStorage.getCachedNativeRequest();
         if (!cachedRequest) {
             this.logger.verbose(
-                "NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null."
+                "NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.",
+                this.correlationId
+            );
+            this.performanceClient?.addFields(
+                { errorCode: "no_cached_request" },
+                this.correlationId
             );
-            if (performanceClient && correlationId) {
-                performanceClient?.addFields(
-                    { errorCode: "no_cached_request" },
-                    correlationId
-                );
-            }
             return null;
         }
 
         const { prompt, ...request } = cachedRequest;
         if (prompt) {
             this.logger.verbose(
-                "NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window."
+                "NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window.",
+                this.correlationId
             );
         }
 
@@ -416,7 +452,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
 
         try {
             this.logger.verbose(
-                "NativeInteractionClient - handleRedirectPromise sending message to native broker."
+                "NativeInteractionClient - handleRedirectPromise sending message to native broker.",
+                this.correlationId
             );
             const response: PlatformAuthResponse =
                 await this.platformAuthProvider.sendMessage(request);
@@ -426,15 +463,18 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 reqTimestamp
             );
 
-            const serverTelemetryManager =
-                this.initializeServerTelemetryManager(this.apiId);
+            const serverTelemetryManager = initializeServerTelemetryManager(
+                this.apiId,
+                this.config.auth.clientId,
+                this.correlationId,
+                this.browserStorage,
+                this.logger
+            );
             serverTelemetryManager.clearNativeBrokerErrorCode();
-            if (performanceClient && this.correlationId) {
-                this.performanceClient.addFields(
-                    { isNativeBroker: true },
-                    this.correlationId
-                );
-            }
+            this.performanceClient?.addFields(
+                { isNativeBroker: true },
+                this.correlationId
+            );
             return authResult;
         } catch (e) {
             throw e;
@@ -446,7 +486,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param request
      */
     logout(): Promise<void> {
-        this.logger.trace("NativeInteractionClient - logout called.");
+        this.logger.trace(
+            "NativeInteractionClient - logout called.",
+            this.correlationId
+        );
         return Promise.reject("Logout not implemented yet");
     }
 
@@ -462,7 +505,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         reqTimestamp: number
     ): Promise<AuthenticationResult> {
         this.logger.trace(
-            "NativeInteractionClient - handleNativeResponse called."
+            "NativeInteractionClient - handleNativeResponse called.",
+            this.correlationId
         );
 
         // generate identifiers
@@ -490,7 +534,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             response.account.id !== request.accountId
         ) {
             this.logger.info(
-                "handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch"
+                "handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch",
+                this.correlationId
             );
         } else if (
             homeAccountIdentifier !== cachedhomeAccountId &&
@@ -501,9 +546,14 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         }
 
         // Get the preferred_cache domain for the given authority
-        const authority = await this.getDiscoveredAuthority({
-            requestAuthority: request.authority,
-        });
+        const authority = await getDiscoveredAuthority(
+            this.config,
+            this.correlationId,
+            this.performanceClient,
+            this.browserStorage,
+            this.logger,
+            request.authority
+        );
 
         const baseAccount = buildAccountToCache(
             this.browserStorage,
@@ -513,11 +563,12 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.correlationId,
             idTokenClaims,
             response.client_info,
-            undefined, // environment
+            authority.getPreferredCache(), // environment
             idTokenClaims.tid,
             undefined, // auth code payload
             response.account.id,
-            this.logger
+            this.logger,
+            this.performanceClient
         );
 
         // Ensure expires_in is in number format
@@ -534,19 +585,15 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         );
 
         // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(
-            baseAccount,
-            this.correlationId,
-            AuthToken.isKmsi(idTokenClaims)
-        );
+        await this.cacheAccount(baseAccount, AuthToken.isKmsi(idTokenClaims));
         await this.cacheNativeTokens(
             response,
             request,
             homeAccountIdentifier,
             idTokenClaims,
-            response.access_token,
             result.tenantId,
-            reqTimestamp
+            reqTimestamp,
+            authority.getPreferredCache() // environment
         );
 
         return result;
@@ -563,11 +610,12 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         idTokenClaims: TokenClaims
     ): string {
         // Save account in browser storage
-        const homeAccountIdentifier = AccountEntity.generateHomeAccountId(
-            response.client_info || Constants.EMPTY_STRING,
+        const homeAccountIdentifier = AccountEntityUtils.generateHomeAccountId(
+            response.client_info || "",
             AuthorityType.Default,
             this.logger,
             this.browserCrypto,
+            this.correlationId,
             idTokenClaims
         );
 
@@ -596,7 +644,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         request: PlatformAuthRequest
     ): Promise<string> {
         if (
-            request.tokenType === AuthenticationScheme.POP &&
+            request.tokenType === Constants.AuthenticationScheme.POP &&
             request.signPopToken
         ) {
             /**
@@ -607,20 +655,23 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             // Check if native layer returned an SHR token
             if (response.shr) {
                 this.logger.trace(
-                    "handleNativeServerResponse: SHR is enabled in native layer"
+                    "handleNativeServerResponse: SHR is enabled in native layer",
+                    this.correlationId
                 );
                 return response.shr;
             }
 
             // Generate SHR in msal js if WAM does not compute it when POP is enabled
             const popTokenGenerator: PopTokenGenerator = new PopTokenGenerator(
-                this.browserCrypto
+                this.browserCrypto,
+                this.performanceClient
             );
             const shrParameters: SignedHttpRequestParameters = {
                 resourceRequestMethod: request.resourceRequestMethod,
                 resourceRequestUri: request.resourceRequestUri,
                 shrClaims: request.shrClaims,
                 shrNonce: request.shrNonce,
+                correlationId: this.correlationId,
             };
 
             /**
@@ -674,14 +725,11 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             accountProperties["UID"] ||
             idTokenClaims.oid ||
             idTokenClaims.sub ||
-            Constants.EMPTY_STRING;
-        const tid =
-            accountProperties["TenantId"] ||
-            idTokenClaims.tid ||
-            Constants.EMPTY_STRING;
+            "";
+        const tid = accountProperties["TenantId"] || idTokenClaims.tid || "";
 
         const accountInfo: AccountInfo | null = updateAccountTenantProfileData(
-            AccountEntity.getAccountInfo(accountEntity),
+            AccountEntityUtils.getAccountInfo(accountEntity),
             undefined, // tenantProfile optional
             idTokenClaims,
             response.id_token
@@ -701,9 +749,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             request
         );
         const tokenType =
-            request.tokenType === AuthenticationScheme.POP
-                ? AuthenticationScheme.POP
-                : AuthenticationScheme.BEARER;
+            request.tokenType === Constants.AuthenticationScheme.POP
+                ? Constants.AuthenticationScheme.POP
+                : Constants.AuthenticationScheme.BEARER;
 
         const result: AuthenticationResult = {
             authority: authority,
@@ -722,7 +770,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             tokenType: tokenType,
             correlationId: this.correlationId,
             state: response.state,
-            fromNativeBroker: true,
+            fromPlatformBroker: true,
+            ...(request.resource && { resource: request.resource }),
         };
 
         return result;
@@ -734,7 +783,6 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      */
     async cacheAccount(
         accountEntity: AccountEntity,
-        correlationId: string,
         kmsi: boolean
     ): Promise<void> {
         // Store the account info and hence `nativeAccountId` in browser cache
@@ -746,8 +794,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         );
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(
-            AccountEntity.getAccountInfo(accountEntity),
-            correlationId
+            AccountEntityUtils.getAccountInfo(accountEntity),
+            this.correlationId
         );
     }
 
@@ -761,19 +809,19 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(
+    async cacheNativeTokens(
         response: PlatformAuthResponse,
         request: PlatformAuthRequest,
         homeAccountIdentifier: string,
         idTokenClaims: TokenClaims,
-        responseAccessToken: string,
         tenantId: string,
-        reqTimestamp: number
+        reqTimestamp: number,
+        environment: string
     ): Promise<void> {
         const cachedIdToken: IdTokenEntity | null =
             CacheHelpers.createIdTokenEntity(
                 homeAccountIdentifier,
-                request.authority,
+                environment,
                 response.id_token || "",
                 request.clientId,
                 idTokenClaims.tid || ""
@@ -781,7 +829,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
 
         // cache accessToken in inmemory storage
         const expiresIn: number =
-            request.tokenType === AuthenticationScheme.POP
+            request.tokenType === Constants.AuthenticationScheme.POP
                 ? Constants.SHR_NONCE_VALIDITY
                 : (typeof response.expires_in === "string"
                       ? parseInt(response.expires_in, 10)
@@ -795,8 +843,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         const cachedAccessToken: AccessTokenEntity | null =
             CacheHelpers.createAccessTokenEntity(
                 homeAccountIdentifier,
-                request.authority,
-                responseAccessToken,
+                environment,
+                response.access_token,
                 request.clientId,
                 idTokenClaims.tid || tenantId,
                 responseScopes.printScopes(),
@@ -804,13 +852,22 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 0,
                 base64Decode,
                 undefined,
-                request.tokenType as AuthenticationScheme,
+                request.tokenType as Constants.AuthenticationScheme,
                 undefined,
                 request.keyId
             );
 
+        // save idtoken credential in configured browser storage
+        if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+            await this.browserStorage.setIdTokenCredential(
+                cachedIdToken,
+                this.correlationId,
+                AuthToken.isKmsi(idTokenClaims)
+            );
+        }
+
+        // save access token credential in memory storage
         const nativeCacheRecord = {
-            idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
 
@@ -827,7 +884,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         tokenType: string,
         expiresIn: string | number | undefined
     ): number {
-        return tokenType === AuthenticationScheme.POP
+        return tokenType === Constants.AuthenticationScheme.POP
             ? Constants.SHR_NONCE_VALIDITY
             : (typeof expiresIn === "string"
                   ? parseInt(expiresIn, 10)
@@ -879,7 +936,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 return JSON.parse(matsResponse);
             } catch (e) {
                 this.logger.error(
-                    "NativeInteractionClient - Error parsing MATS telemetry, returning null instead"
+                    "NativeInteractionClient - Error parsing MATS telemetry, returning null instead",
+                    this.correlationId
                 );
             }
         }
@@ -895,7 +953,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
     protected isResponseFromCache(mats: MATS): boolean {
         if (typeof mats.is_cached === "undefined") {
             this.logger.verbose(
-                "NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false."
+                "NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false.",
+                this.correlationId
             );
             return false;
         }
@@ -907,34 +966,54 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * Translates developer provided request object into NativeRequest object
      * @param request
      */
-    protected async initializeNativeRequest(
+    protected async initializePlatformRequest(
         request: PopupRequest | SsoSilentRequest
     ): Promise<PlatformAuthRequest> {
         this.logger.trace(
-            "NativeInteractionClient - initializeNativeRequest called"
+            "NativeInteractionClient - initializePlatformRequest called",
+            this.correlationId
         );
 
         const canonicalAuthority = await this.getCanonicalAuthority(request);
 
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims =
+            request.skipBrokerClaims && !!request.embeddedClientId
+                ? undefined
+                : this.config.auth.clientCapabilities;
+
         // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-        const { scopes, ...remainingProperties } = request;
+        const { scopes, claims, ...remainingProperties } = request;
         const scopeSet = new ScopeSet(scopes || []);
-        scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
+        scopeSet.appendScopes(Constants.OIDC_DEFAULT_SCOPES);
+
+        const mergedClaims =
+            configClaims && configClaims.length
+                ? RequestParameterBuilder.addClientCapabilitiesToClaims(
+                      claims,
+                      configClaims
+                  )
+                : claims;
 
         const validatedRequest: PlatformAuthRequest = {
             ...remainingProperties,
+            claims: mergedClaims,
             accountId: this.accountId,
             clientId: this.config.auth.clientId,
             authority: canonicalAuthority.urlString,
             scope: scopeSet.printScopes(),
-            redirectUri: this.getRedirectUri(request.redirectUri),
+            redirectUri: getRedirectUri(
+                request.redirectUri,
+                this.config.auth.redirectUri,
+                this.logger,
+                this.correlationId
+            ),
             prompt: this.getPrompt(request.prompt),
             correlationId: this.correlationId,
             tokenType: request.authenticationScheme,
             windowTitleSubstring: document.title,
             extraParameters: {
-                ...request.extraQueryParameters,
-                ...request.tokenQueryParameters,
+                ...request.extraParameters,
             },
             extendedExpiryToken: false, // Make this configurable?
             keyId: request.popKid,
@@ -953,16 +1032,22 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         validatedRequest.extraParameters.telemetry =
             PlatformAuthConstants.MATS_TELEMETRY;
 
-        if (request.authenticationScheme === AuthenticationScheme.POP) {
+        if (
+            request.authenticationScheme === Constants.AuthenticationScheme.POP
+        ) {
             // add POP request type
             const shrParameters: SignedHttpRequestParameters = {
                 resourceRequestUri: request.resourceRequestUri,
                 resourceRequestMethod: request.resourceRequestMethod,
                 shrClaims: request.shrClaims,
                 shrNonce: request.shrNonce,
+                correlationId: this.correlationId,
             };
 
-            const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
+            const popTokenGenerator = new PopTokenGenerator(
+                this.browserCrypto,
+                this.performanceClient
+            );
 
             // generate reqCnf if not provided in the request
             let reqCnfData;
@@ -998,13 +1083,21 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         const requestAuthority =
             request.authority || this.config.auth.authority;
 
-        if (request.account) {
+        const { azureCloudOptions, account } = request;
+
+        if (account) {
             // validate authority
-            await this.getDiscoveredAuthority({
+            await getDiscoveredAuthority(
+                this.config,
+                this.correlationId,
+                this.performanceClient,
+                this.browserStorage,
+                this.logger,
                 requestAuthority,
-                requestAzureCloudOptions: request.azureCloudOptions,
-                account: request.account,
-            });
+                azureCloudOptions,
+                undefined, // requestExtraQueryParameters
+                account
+            );
         }
 
         const canonicalAuthority = new UrlString(requestAuthority);
@@ -1018,9 +1111,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             case ApiId.ssoSilent:
             case ApiId.acquireTokenSilent_silentFlow:
                 this.logger.trace(
-                    "initializeNativeRequest: silent request sets prompt to none"
+                    "initializePlatformRequest: silent request sets prompt to none",
+                    this.correlationId
                 );
-                return PromptValue.NONE;
+                return Constants.PromptValue.NONE;
             default:
                 break;
         }
@@ -1028,24 +1122,26 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         // Prompt not provided, request may proceed and native broker decides if it needs to prompt
         if (!prompt) {
             this.logger.trace(
-                "initializeNativeRequest: prompt was not provided"
+                "initializePlatformRequest: prompt was not provided",
+                this.correlationId
             );
             return undefined;
         }
 
         // If request is interactive, check if prompt provided is allowed to go directly to native broker
         switch (prompt) {
-            case PromptValue.NONE:
-            case PromptValue.CONSENT:
-            case PromptValue.LOGIN:
-            case PromptValue.SELECT_ACCOUNT:
+            case Constants.PromptValue.NONE:
+            case Constants.PromptValue.CONSENT:
+            case Constants.PromptValue.LOGIN:
                 this.logger.trace(
-                    "initializeNativeRequest: prompt is compatible with native flow"
+                    "initializePlatformRequest: prompt is compatible with native flow",
+                    this.correlationId
                 );
                 return prompt;
             default:
                 this.logger.trace(
-                    `initializeNativeRequest: prompt = ${prompt} is not compatible with native flow`
+                    `initializePlatformRequest: prompt = '${prompt}' is not compatible with native flow`,
+                    this.correlationId
                 );
                 throw createBrowserAuthError(
                     BrowserAuthErrorCodes.nativePromptNotSupported