plugin-data-source-mssql 2.0.5 → 2.0.6

package/dist/tedious/node_modules/@azure/msal-common/src/cache/CacheManager.ts

@@ -13,13 +13,7 @@ import {
     TenantProfileFilter,
 } from "./utils/CacheTypes.js";
 import { CacheRecord } from "./entities/CacheRecord.js";
-import {
-    CredentialType,
-    APP_METADATA,
-    THE_FAMILY_ID,
-    AUTHORITY_METADATA_CONSTANTS,
-    AuthenticationScheme,
-} from "../utils/Constants.js";
+import * as Constants from "../utils/Constants.js";
 import { CredentialEntity } from "./entities/CredentialEntity.js";
 import { ScopeSet } from "../request/ScopeSet.js";
 import { AccountEntity } from "./entities/AccountEntity.js";
@@ -51,6 +45,7 @@ import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
 import { TokenClaims } from "../account/TokenClaims.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
 import { createCacheError } from "../error/CacheError.js";
+import * as AccountEntityUtils from "./utils/AccountEntityUtils.js";
 import { AuthError } from "../error/AuthError.js";
 
 /**
@@ -92,8 +87,6 @@ export abstract class CacheManager implements ICacheManager {
      * set account entity in the platform cache
      * @param account
      * @param correlationId
-     * @param kmsi - Keep Me Signed In
-     * @param apiId - API identifier for telemetry tracking
      */
     abstract setAccount(
         account: AccountEntity,
@@ -165,8 +158,12 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * fetch appMetadata entity from the platform cache
      * @param appMetadataKey
+     * @param correlationId
      */
-    abstract getAppMetadata(appMetadataKey: string): AppMetadataEntity | null;
+    abstract getAppMetadata(
+        appMetadataKey: string,
+        correlationId: string
+    ): AppMetadataEntity | null;
 
     /**
      * set appMetadata entity to the platform cache
@@ -180,15 +177,18 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * fetch server telemetry entity from the platform cache
      * @param serverTelemetryKey
+     * @param correlationId
      */
     abstract getServerTelemetry(
-        serverTelemetryKey: string
+        serverTelemetryKey: string,
+        correlationId: string
     ): ServerTelemetryEntity | null;
 
     /**
      * set server telemetry entity to the platform cache
      * @param serverTelemetryKey
      * @param serverTelemetry
+     * @param correlationId
      */
     abstract setServerTelemetry(
         serverTelemetryKey: string,
@@ -199,8 +199,12 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * fetch cloud discovery metadata entity from the platform cache
      * @param key
+     * @param correlationId
      */
-    abstract getAuthorityMetadata(key: string): AuthorityMetadataEntity | null;
+    abstract getAuthorityMetadata(
+        key: string,
+        correlationId: string
+    ): AuthorityMetadataEntity | null;
 
     /**
      *
@@ -211,18 +215,22 @@ export abstract class CacheManager implements ICacheManager {
      * set cloud discovery metadata entity to the platform cache
      * @param key
      * @param value
+     * @param correlationId
      */
     abstract setAuthorityMetadata(
         key: string,
-        value: AuthorityMetadataEntity
+        value: AuthorityMetadataEntity,
+        correlationId: string
     ): void;
 
     /**
      * fetch throttling entity from the platform cache
      * @param throttlingCacheKey
+     * @param correlationId
      */
     abstract getThrottlingCache(
-        throttlingCacheKey: string
+        throttlingCacheKey: string,
+        correlationId: string
     ): ThrottlingEntity | null;
 
     /**
@@ -275,7 +283,7 @@ export abstract class CacheManager implements ICacheManager {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(
-        accountFilter: AccountFilter,
+        accountFilter: AccountFilter = {},
         correlationId: string
     ): AccountInfo[] {
         return this.buildTenantProfiles(
@@ -294,10 +302,13 @@ export abstract class CacheManager implements ICacheManager {
     ): AccountInfo | null {
         if (
             Object.keys(accountFilter).length === 0 ||
-            Object.values(accountFilter).every((value) => !value)
+            Object.values(accountFilter).every(
+                (value) => value === null || value === undefined || value === ""
+            )
         ) {
             this.commonLogger.warning(
-                "getAccountInfoFilteredBy: Account filter is empty or invalid, returning null"
+                "getAccountInfoFilteredBy: Account filter is empty or invalid, returning null",
+                correlationId
             );
             return null;
         }
@@ -330,7 +341,7 @@ export abstract class CacheManager implements ICacheManager {
             correlationId
         );
         if (accountEntities.length > 0) {
-            return AccountEntity.getAccountInfo(accountEntities[0]);
+            return AccountEntityUtils.getAccountInfo(accountEntities[0]);
         } else {
             return null;
         }
@@ -420,7 +431,7 @@ export abstract class CacheManager implements ICacheManager {
         targetTenantId?: string,
         tenantProfileFilter?: TenantProfileFilter
     ): AccountInfo[] {
-        const accountInfo = AccountEntity.getAccountInfo(accountEntity);
+        const accountInfo = AccountEntityUtils.getAccountInfo(accountEntity);
         let searchTenantProfiles: Map<string, TenantProfile> =
             accountInfo.tenantProfiles || new Map<string, TenantProfile>();
         const tokenKeys = this.getTokenKeys();
@@ -484,6 +495,39 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
+        if (
+            !!tenantProfileFilter.username &&
+            !(
+                this.matchUsername(
+                    tenantProfile.username,
+                    tenantProfileFilter.username
+                ) ||
+                !this.matchUsername(
+                    tenantProfile.upn,
+                    tenantProfileFilter.username
+                )
+            )
+        ) {
+            return false;
+        }
+
+        if (
+            !!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(
+                tenantProfile,
+                tenantProfileFilter.loginHint
+            )
+        ) {
+            return false;
+        }
+
+        if (
+            !!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)
+        ) {
+            return false;
+        }
+
         return true;
     }
 
@@ -518,6 +562,10 @@ export abstract class CacheManager implements ICacheManager {
                 !this.matchUsername(
                     idTokenClaims.preferred_username,
                     tenantProfileFilter.username
+                ) &&
+                !this.matchUsername(
+                    idTokenClaims.upn,
+                    tenantProfileFilter.username
                 )
             ) {
                 return false;
@@ -544,10 +592,8 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * saves a cache record
      * @param cacheRecord {CacheRecord}
-     * @param correlationId {?string} correlation id
-     * @param kmsi - Keep Me Signed In
-     * @param apiId - API identifier for telemetry tracking
      * @param storeInCache {?StoreInCache}
+     * @param correlationId {?string} correlation id
      */
     async saveCacheRecord(
         cacheRecord: CacheRecord,
@@ -606,7 +652,10 @@ export abstract class CacheManager implements ICacheManager {
                 this.setAppMetadata(cacheRecord.appMetadata, correlationId);
             }
         } catch (e: unknown) {
-            this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
+            this.commonLogger?.error(
+                `CacheManager.saveCacheRecord: failed`,
+                correlationId
+            );
             if (e instanceof AuthError) {
                 throw e;
             } else {
@@ -631,7 +680,6 @@ export abstract class CacheManager implements ICacheManager {
             homeAccountId: credential.homeAccountId,
             realm: credential.realm,
             tokenType: credential.tokenType,
-            requestedClaimsHash: credential.requestedClaimsHash,
         };
 
         const tokenKeys = this.getTokenKeys();
@@ -651,7 +699,11 @@ export abstract class CacheManager implements ICacheManager {
 
             if (
                 tokenEntity &&
-                this.credentialMatchesFilter(tokenEntity, accessTokenFilter)
+                this.credentialMatchesFilter(
+                    tokenEntity,
+                    accessTokenFilter,
+                    correlationId
+                )
             ) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
@@ -692,16 +744,13 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            if (
-                !!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)
-            ) {
-                return;
-            }
-
             if (
                 !!accountFilter.environment &&
-                !this.matchEnvironment(entity, accountFilter.environment)
+                !this.matchEnvironment(
+                    entity,
+                    accountFilter.environment,
+                    correlationId
+                )
             ) {
                 return;
             }
@@ -734,6 +783,9 @@ export abstract class CacheManager implements ICacheManager {
             const tenantProfileFilter: TenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
 
             const matchingTenantProfiles = entity.tenantProfiles?.filter(
@@ -760,11 +812,13 @@ export abstract class CacheManager implements ICacheManager {
      * Returns whether or not the given credential entity matches the filter
      * @param entity
      * @param filter
+     * @param correlationId
      * @returns
      */
     credentialMatchesFilter(
         entity: ValidCredentialType,
-        filter: CredentialFilter
+        filter: CredentialFilter,
+        correlationId: string
     ): boolean {
         if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {
             return false;
@@ -790,7 +844,7 @@ export abstract class CacheManager implements ICacheManager {
 
         if (
             !!filter.environment &&
-            !this.matchEnvironment(entity, filter.environment)
+            !this.matchEnvironment(entity, filter.environment, correlationId)
         ) {
             return false;
         }
@@ -818,18 +872,10 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
-        // If request OR cached entity has requested Claims Hash, check if they match
-        if (filter.requestedClaimsHash || entity.requestedClaimsHash) {
-            // Don't match if either is undefined or they are different
-            if (entity.requestedClaimsHash !== filter.requestedClaimsHash) {
-                return false;
-            }
-        }
-
         // Access Token with Auth Scheme specific matching
         if (
             entity.credentialType ===
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
+            Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
         ) {
             if (
                 !!filter.tokenType &&
@@ -839,7 +885,7 @@ export abstract class CacheManager implements ICacheManager {
             }
 
             // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-            if (filter.tokenType === AuthenticationScheme.SSH) {
+            if (filter.tokenType === Constants.AuthenticationScheme.SSH) {
                 if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
                     return false;
                 }
@@ -852,8 +898,12 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
      * @param filter
+     * @param correlationId
      */
-    getAppMetadataFilteredBy(filter: AppMetadataFilter): AppMetadataCache {
+    getAppMetadataFilteredBy(
+        filter: AppMetadataFilter,
+        correlationId: string
+    ): AppMetadataCache {
         const allCacheKeys = this.getKeys();
         const matchingAppMetadata: AppMetadataCache = {};
 
@@ -864,7 +914,7 @@ export abstract class CacheManager implements ICacheManager {
             }
 
             // Attempt retrieval
-            const entity = this.getAppMetadata(cacheKey);
+            const entity = this.getAppMetadata(cacheKey, correlationId);
 
             if (!entity) {
                 return;
@@ -872,7 +922,11 @@ export abstract class CacheManager implements ICacheManager {
 
             if (
                 !!filter.environment &&
-                !this.matchEnvironment(entity, filter.environment)
+                !this.matchEnvironment(
+                    entity,
+                    filter.environment,
+                    correlationId
+                )
             ) {
                 return;
             }
@@ -892,9 +946,13 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * retrieve authorityMetadata that contains a matching alias
-     * @param filter
+     * @param host
+     * @param correlationId
      */
-    getAuthorityMetadataByAlias(host: string): AuthorityMetadataEntity | null {
+    getAuthorityMetadataByAlias(
+        host: string,
+        correlationId: string
+    ): AuthorityMetadataEntity | null {
         const allCacheKeys = this.getAuthorityMetadataKeys();
         let matchedEntity = null;
 
@@ -908,7 +966,7 @@ export abstract class CacheManager implements ICacheManager {
             }
 
             // Attempt retrieval
-            const entity = this.getAuthorityMetadata(cacheKey);
+            const entity = this.getAuthorityMetadata(cacheKey, correlationId);
 
             if (!entity) {
                 return;
@@ -983,42 +1041,47 @@ export abstract class CacheManager implements ICacheManager {
     }
 
     /**
-     * Removes accessToken from the cache
+     * returns a boolean if the given credential is removed
      * @param key
      * @param correlationId
      */
     removeAccessToken(key: string, correlationId: string): void {
         const credential = this.getAccessTokenCredential(key, correlationId);
+        if (!credential) {
+            return;
+        }
+
         this.removeItem(key, correlationId);
         this.performanceClient.incrementFields(
             { accessTokensRemoved: 1 },
             correlationId
         );
 
+        // Remove Token Binding Key from key store for PoP Tokens Credentials
         if (
-            !credential ||
-            credential.credentialType.toLowerCase() !==
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
-            credential.tokenType !== AuthenticationScheme.POP
+            credential.credentialType.toLowerCase() ===
+            Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()
         ) {
-            // If the credential is not a PoP token, we can return
-            return;
-        }
-
-        // Remove Token Binding Key from key store for PoP Tokens Credentials
-        const kid = credential.keyId;
-
-        if (kid) {
-            void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
-                this.commonLogger.error(
-                    `Failed to remove token binding key ${kid}`,
-                    correlationId
-                );
-                this.performanceClient?.incrementFields(
-                    { removeTokenBindingKeyFailure: 1 },
-                    correlationId
-                );
-            });
+            if (credential.tokenType === Constants.AuthenticationScheme.POP) {
+                const accessTokenWithAuthSchemeEntity =
+                    credential as AccessTokenEntity;
+                const kid = accessTokenWithAuthSchemeEntity.keyId;
+
+                if (kid) {
+                    void this.cryptoImpl
+                        .removeTokenBindingKey(kid, correlationId)
+                        .catch(() => {
+                            this.commonLogger.error(
+                                `Failed to remove token binding key '${kid}'`,
+                                correlationId
+                            );
+                            this.performanceClient?.incrementFields(
+                                { removeTokenBindingKeyFailure: 1 },
+                                correlationId
+                            );
+                        });
+                }
+            }
         }
     }
 
@@ -1048,14 +1111,16 @@ export abstract class CacheManager implements ICacheManager {
         account: AccountInfo,
         correlationId: string,
         tokenKeys?: TokenKeys,
-        targetRealm?: string,
-        performanceClient?: IPerformanceClient
+        targetRealm?: string
     ): IdTokenEntity | null {
-        this.commonLogger.trace("CacheManager - getIdToken called");
+        this.commonLogger.trace(
+            "CacheManager - getIdToken called",
+            correlationId
+        );
         const idTokenFilter: CredentialFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
-            credentialType: CredentialType.ID_TOKEN,
+            credentialType: Constants.CredentialType.ID_TOKEN,
             clientId: this.clientId,
             realm: targetRealm,
         };
@@ -1069,7 +1134,10 @@ export abstract class CacheManager implements ICacheManager {
         const numIdTokens = idTokenMap.size;
 
         if (numIdTokens < 1) {
-            this.commonLogger.info("CacheManager:getIdToken - No token found");
+            this.commonLogger.info(
+                "CacheManager:getIdToken - No token found",
+                correlationId
+            );
             return null;
         } else if (numIdTokens > 1) {
             let tokensToBeRemoved: Map<string, IdTokenEntity> = idTokenMap;
@@ -1087,14 +1155,16 @@ export abstract class CacheManager implements ICacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info(
-                        "CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result"
+                        "CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result",
+                        correlationId
                     );
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 } else if (numHomeIdTokens === 1) {
                     this.commonLogger.info(
-                        "CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile"
+                        "CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile",
+                        correlationId
                     );
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 } else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
                     tokensToBeRemoved = homeIdTokenMap;
@@ -1102,22 +1172,24 @@ export abstract class CacheManager implements ICacheManager {
             }
             // Multiple tokens for a single tenant profile, remove all and return null
             this.commonLogger.info(
-                "CacheManager:getIdToken - Multiple matching ID tokens found, clearing them"
+                "CacheManager:getIdToken - Multiple matching ID tokens found, clearing them",
+                correlationId
             );
             tokensToBeRemoved.forEach((idToken, key) => {
                 this.removeIdToken(key, correlationId);
             });
-            if (performanceClient && correlationId) {
-                performanceClient.addFields(
-                    { multiMatchedID: idTokenMap.size },
-                    correlationId
-                );
-            }
+            this.performanceClient.addFields(
+                { multiMatchedID: idTokenMap.size },
+                correlationId
+            );
             return null;
         }
 
-        this.commonLogger.info("CacheManager:getIdToken - Returning ID token");
-        return idTokenMap.values().next().value;
+        this.commonLogger.info(
+            "CacheManager:getIdToken - Returning ID token",
+            correlationId
+        );
+        return idTokenMap.values().next().value ?? null;
     }
 
     /**
@@ -1147,7 +1219,10 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
             const idToken = this.getIdTokenCredential(key, correlationId);
-            if (idToken && this.credentialMatchesFilter(idToken, filter)) {
+            if (
+                idToken &&
+                this.credentialMatchesFilter(idToken, filter, correlationId)
+            ) {
                 idTokens.set(key, idToken);
             }
         });
@@ -1203,7 +1278,6 @@ export abstract class CacheManager implements ICacheManager {
      * Retrieve AccessTokenEntity from cache
      * @param account {AccountInfo}
      * @param request {BaseAuthRequest}
-     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
      */
@@ -1220,7 +1294,8 @@ export abstract class CacheManager implements ICacheManager {
         );
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme =
-            request.authenticationScheme || AuthenticationScheme.BEARER;
+            request.authenticationScheme ||
+            Constants.AuthenticationScheme.BEARER;
         /*
          * Distinguish between Bearer and PoP/SSH token cache types
          * Cast to lowercase to handle "bearer" from ADFS
@@ -1228,9 +1303,9 @@ export abstract class CacheManager implements ICacheManager {
         const credentialType =
             authScheme &&
             authScheme.toLowerCase() !==
-                AuthenticationScheme.BEARER.toLowerCase()
-                ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
-                : CredentialType.ACCESS_TOKEN;
+                Constants.AuthenticationScheme.BEARER.toLowerCase()
+                ? Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
+                : Constants.CredentialType.ACCESS_TOKEN;
 
         const accessTokenFilter: CredentialFilter = {
             homeAccountId: account.homeAccountId,
@@ -1241,7 +1316,6 @@ export abstract class CacheManager implements ICacheManager {
             target: scopes,
             tokenType: authScheme,
             keyId: request.sshKid,
-            requestedClaimsHash: request.requestedClaimsHash,
         };
 
         const accessTokenKeys =
@@ -1262,7 +1336,11 @@ export abstract class CacheManager implements ICacheManager {
                 // Validate value
                 if (
                     accessToken &&
-                    this.credentialMatchesFilter(accessToken, accessTokenFilter)
+                    this.credentialMatchesFilter(
+                        accessToken,
+                        accessTokenFilter,
+                        correlationId
+                    )
                 ) {
                     accessTokens.push(accessToken);
                 }
@@ -1332,13 +1410,6 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
-        if (
-            filter.requestedClaimsHash &&
-            key.indexOf(filter.requestedClaimsHash.toLowerCase()) === -1
-        ) {
-            return false;
-        }
-
         if (filter.target) {
             const scopes = filter.target.asArray();
             for (let i = 0; i < scopes.length; i++) {
@@ -1384,7 +1455,7 @@ export abstract class CacheManager implements ICacheManager {
             );
             if (
                 accessToken &&
-                this.credentialMatchesFilter(accessToken, filter)
+                this.credentialMatchesFilter(accessToken, filter, correlationId)
             ) {
                 accessTokens.push(accessToken);
             }
@@ -1397,23 +1468,25 @@ export abstract class CacheManager implements ICacheManager {
      * Helper to retrieve the appropriate refresh token from cache
      * @param account {AccountInfo}
      * @param familyRT {boolean}
-     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getRefreshToken(
         account: AccountInfo,
         familyRT: boolean,
         correlationId: string,
-        tokenKeys?: TokenKeys,
-        performanceClient?: IPerformanceClient
+        tokenKeys?: TokenKeys
     ): RefreshTokenEntity | null {
-        this.commonLogger.trace("CacheManager - getRefreshToken called");
-        const id = familyRT ? THE_FAMILY_ID : undefined;
+        this.commonLogger.trace(
+            "CacheManager - getRefreshToken called",
+            correlationId
+        );
+        const id = familyRT ? Constants.THE_FAMILY_ID : undefined;
         const refreshTokenFilter: CredentialFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
-            credentialType: CredentialType.REFRESH_TOKEN,
+            credentialType: Constants.CredentialType.REFRESH_TOKEN,
             clientId: this.clientId,
             familyId: id,
         };
@@ -1435,7 +1508,8 @@ export abstract class CacheManager implements ICacheManager {
                     refreshToken &&
                     this.credentialMatchesFilter(
                         refreshToken,
-                        refreshTokenFilter
+                        refreshTokenFilter,
+                        correlationId
                     )
                 ) {
                     refreshTokens.push(refreshToken);
@@ -1446,21 +1520,23 @@ export abstract class CacheManager implements ICacheManager {
         const numRefreshTokens = refreshTokens.length;
         if (numRefreshTokens < 1) {
             this.commonLogger.info(
-                "CacheManager:getRefreshToken - No refresh token found."
+                "CacheManager:getRefreshToken - No refresh token found.",
+                correlationId
             );
             return null;
         }
         // address the else case after remove functions address environment aliases
 
-        if (numRefreshTokens > 1 && performanceClient && correlationId) {
-            performanceClient.addFields(
+        if (numRefreshTokens > 1) {
+            this.performanceClient.addFields(
                 { multiMatchedRT: numRefreshTokens },
                 correlationId
             );
         }
 
         this.commonLogger.info(
-            "CacheManager:getRefreshToken - returning refresh token"
+            "CacheManager:getRefreshToken - returning refresh token",
+            correlationId
         );
         return refreshTokens[0] as RefreshTokenEntity;
     }
@@ -1504,14 +1580,19 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * Retrieve AppMetadataEntity from cache
      */
-    readAppMetadataFromCache(environment: string): AppMetadataEntity | null {
+    readAppMetadataFromCache(
+        environment: string,
+        correlationId: string
+    ): AppMetadataEntity | null {
         const appMetadataFilter: AppMetadataFilter = {
             environment,
             clientId: this.clientId,
         };
 
-        const appMetadata: AppMetadataCache =
-            this.getAppMetadataFilteredBy(appMetadataFilter);
+        const appMetadata: AppMetadataCache = this.getAppMetadataFilteredBy(
+            appMetadataFilter,
+            correlationId
+        );
         const appMetadataEntries: AppMetadataEntity[] = Object.keys(
             appMetadata
         ).map((key) => appMetadata[key]);
@@ -1533,9 +1614,14 @@ export abstract class CacheManager implements ICacheManager {
      * @param environment
      * @param clientId
      */
-    isAppMetadataFOCI(environment: string): boolean {
-        const appMetadata = this.readAppMetadataFromCache(environment);
-        return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);
+    isAppMetadataFOCI(environment: string, correlationId: string): boolean {
+        const appMetadata = this.readAppMetadataFromCache(
+            environment,
+            correlationId
+        );
+        return !!(
+            appMetadata && appMetadata.familyId === Constants.THE_FAMILY_ID
+        );
     }
 
     /**
@@ -1601,6 +1687,23 @@ export abstract class CacheManager implements ICacheManager {
         );
     }
 
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    private matchLoginHintWithTenantProfile(
+        tenantProfile: TenantProfile,
+        loginHintFilter: string
+    ): boolean {
+        return (
+            tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter
+        );
+    }
+
     /**
      * helper to match assertion
      * @param value
@@ -1623,13 +1726,15 @@ export abstract class CacheManager implements ICacheManager {
      */
     private matchEnvironment(
         entity: AccountEntity | CredentialEntity | AppMetadataEntity,
-        environment: string
+        environment: string,
+        correlationId: string
     ): boolean {
         // Check static authority options first for cases where authority metadata has not been resolved and cached yet
         if (this.staticAuthorityOptions) {
             const staticAliases = getAliasesFromStaticSources(
                 this.staticAuthorityOptions,
-                this.commonLogger
+                this.commonLogger,
+                correlationId
             );
             if (
                 staticAliases.includes(environment) &&
@@ -1640,7 +1745,10 @@ export abstract class CacheManager implements ICacheManager {
         }
 
         // Query metadata cache if no static authority configuration has aliases that match enviroment
-        const cloudMetadata = this.getAuthorityMetadataByAlias(environment);
+        const cloudMetadata = this.getAuthorityMetadataByAlias(
+            environment,
+            correlationId
+        );
         if (
             cloudMetadata &&
             cloudMetadata.aliases.indexOf(entity.environment) > -1
@@ -1741,6 +1849,11 @@ export abstract class CacheManager implements ICacheManager {
             return true;
         }
 
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
+
         return false;
     }
 
@@ -1771,9 +1884,9 @@ export abstract class CacheManager implements ICacheManager {
      */
     private matchTarget(entity: CredentialEntity, target: ScopeSet): boolean {
         const isNotAccessTokenCredential =
-            entity.credentialType !== CredentialType.ACCESS_TOKEN &&
+            entity.credentialType !== Constants.CredentialType.ACCESS_TOKEN &&
             entity.credentialType !==
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+                Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
 
         if (isNotAccessTokenCredential || !entity.target) {
             return false;
@@ -1791,7 +1904,7 @@ export abstract class CacheManager implements ICacheManager {
      */
     private matchTokenType(
         entity: CredentialEntity,
-        tokenType: AuthenticationScheme
+        tokenType: Constants.AuthenticationScheme
     ): boolean {
         return !!(entity.tokenType && entity.tokenType === tokenType);
     }
@@ -1810,7 +1923,7 @@ export abstract class CacheManager implements ICacheManager {
      * @param key
      */
     private isAppMetadata(key: string): boolean {
-        return key.indexOf(APP_METADATA) !== -1;
+        return key.indexOf(Constants.APP_METADATA) !== -1;
     }
 
     /**
@@ -1818,14 +1931,14 @@ export abstract class CacheManager implements ICacheManager {
      * @param key
      */
     protected isAuthorityMetadata(key: string): boolean {
-        return key.indexOf(AUTHORITY_METADATA_CONSTANTS.CACHE_KEY) !== -1;
+        return key.indexOf(Constants.AUTHORITY_METADATA_CACHE_KEY) !== -1;
     }
 
     /**
      * returns cache key used for cloud instance metadata
      */
     generateAuthorityMetadataCacheKey(authority: string): string {
-        return `${AUTHORITY_METADATA_CONSTANTS.CACHE_KEY}-${this.clientId}-${authority}`;
+        return `${Constants.AUTHORITY_METADATA_CACHE_KEY}-${this.clientId}-${authority}`;
     }
 
     /**