8045 lines
318 KiB
JavaScript
8045 lines
318 KiB
JavaScript
/*! @azure/msal-common v16.6.2 2026-05-19 */
|
|
'use strict';
|
|
'use strict';
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* AuthErrorMessage class containing string constants used by error codes and messages.
|
|
*/
|
|
const unexpectedError = "unexpected_error";
|
|
const postRequestFailed = "post_request_failed";
|
|
|
|
var AuthErrorCodes = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
postRequestFailed: postRequestFailed,
|
|
unexpectedError: unexpectedError
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
function getDefaultErrorMessage(code) {
|
|
return `See https://aka.ms/msal.js.errors#${code} for details`;
|
|
}
|
|
/**
|
|
* General error class thrown by the MSAL.js library.
|
|
*/
|
|
class AuthError extends Error {
|
|
constructor(errorCode, errorMessage, suberror) {
|
|
const message = errorMessage ||
|
|
(errorCode ? getDefaultErrorMessage(errorCode) : "");
|
|
const errorString = message ? `${errorCode}: ${message}` : errorCode;
|
|
super(errorString);
|
|
Object.setPrototypeOf(this, AuthError.prototype);
|
|
this.errorCode = errorCode || "";
|
|
this.errorMessage = message || "";
|
|
this.subError = suberror || "";
|
|
this.name = "AuthError";
|
|
}
|
|
setCorrelationId(correlationId) {
|
|
this.correlationId = correlationId;
|
|
}
|
|
}
|
|
function createAuthError(code, additionalMessage) {
|
|
return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const clientInfoDecodingError = "client_info_decoding_error";
|
|
const clientInfoEmptyError = "client_info_empty_error";
|
|
const tokenParsingError = "token_parsing_error";
|
|
const nullOrEmptyToken = "null_or_empty_token";
|
|
const endpointResolutionError = "endpoints_resolution_error";
|
|
const networkError = "network_error";
|
|
const openIdConfigError = "openid_config_error";
|
|
const hashNotDeserialized = "hash_not_deserialized";
|
|
const invalidState = "invalid_state";
|
|
const stateMismatch = "state_mismatch";
|
|
const stateNotFound = "state_not_found";
|
|
const nonceMismatch = "nonce_mismatch";
|
|
const authTimeNotFound = "auth_time_not_found";
|
|
const maxAgeTranspired = "max_age_transpired";
|
|
const multipleMatchingTokens = "multiple_matching_tokens";
|
|
const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
|
|
const requestCannotBeMade = "request_cannot_be_made";
|
|
const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
|
|
const cannotAppendScopeSet = "cannot_append_scopeset";
|
|
const emptyInputScopeSet = "empty_input_scopeset";
|
|
const noAccountInSilentRequest = "no_account_in_silent_request";
|
|
const invalidCacheRecord = "invalid_cache_record";
|
|
const invalidCacheEnvironment = "invalid_cache_environment";
|
|
const noAccountFound = "no_account_found";
|
|
const noCryptoObject = "no_crypto_object";
|
|
const unexpectedCredentialType = "unexpected_credential_type";
|
|
const tokenRefreshRequired = "token_refresh_required";
|
|
const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
|
|
const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
|
|
const bindingKeyNotRemoved = "binding_key_not_removed";
|
|
const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
|
|
const keyIdMissing = "key_id_missing";
|
|
const noNetworkConnectivity = "no_network_connectivity";
|
|
const userCanceled = "user_canceled";
|
|
const methodNotImplemented = "method_not_implemented";
|
|
const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
|
|
const platformBrokerError = "platform_broker_error";
|
|
const resourceParameterRequired = "resource_parameter_required";
|
|
const misplacedResourceParam = "misplaced_resource_parameter";
|
|
|
|
var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
authTimeNotFound: authTimeNotFound,
|
|
authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,
|
|
bindingKeyNotRemoved: bindingKeyNotRemoved,
|
|
cannotAppendScopeSet: cannotAppendScopeSet,
|
|
cannotRemoveEmptyScope: cannotRemoveEmptyScope,
|
|
clientInfoDecodingError: clientInfoDecodingError,
|
|
clientInfoEmptyError: clientInfoEmptyError,
|
|
emptyInputScopeSet: emptyInputScopeSet,
|
|
endSessionEndpointNotSupported: endSessionEndpointNotSupported,
|
|
endpointResolutionError: endpointResolutionError,
|
|
hashNotDeserialized: hashNotDeserialized,
|
|
invalidCacheEnvironment: invalidCacheEnvironment,
|
|
invalidCacheRecord: invalidCacheRecord,
|
|
invalidState: invalidState,
|
|
keyIdMissing: keyIdMissing,
|
|
maxAgeTranspired: maxAgeTranspired,
|
|
methodNotImplemented: methodNotImplemented,
|
|
misplacedResourceParam: misplacedResourceParam,
|
|
multipleMatchingAppMetadata: multipleMatchingAppMetadata,
|
|
multipleMatchingTokens: multipleMatchingTokens,
|
|
nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,
|
|
networkError: networkError,
|
|
noAccountFound: noAccountFound,
|
|
noAccountInSilentRequest: noAccountInSilentRequest,
|
|
noCryptoObject: noCryptoObject,
|
|
noNetworkConnectivity: noNetworkConnectivity,
|
|
nonceMismatch: nonceMismatch,
|
|
nullOrEmptyToken: nullOrEmptyToken,
|
|
openIdConfigError: openIdConfigError,
|
|
platformBrokerError: platformBrokerError,
|
|
requestCannotBeMade: requestCannotBeMade,
|
|
resourceParameterRequired: resourceParameterRequired,
|
|
stateMismatch: stateMismatch,
|
|
stateNotFound: stateNotFound,
|
|
tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
|
|
tokenParsingError: tokenParsingError,
|
|
tokenRefreshRequired: tokenRefreshRequired,
|
|
unexpectedCredentialType: unexpectedCredentialType,
|
|
userCanceled: userCanceled
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* ClientAuthErrorMessage class containing string constants used by error codes and messages.
|
|
*/
|
|
/**
|
|
* Error thrown when there is an error in the client code running on the browser.
|
|
*/
|
|
class ClientAuthError extends AuthError {
|
|
constructor(errorCode, additionalMessage) {
|
|
super(errorCode, additionalMessage);
|
|
this.name = "ClientAuthError";
|
|
Object.setPrototypeOf(this, ClientAuthError.prototype);
|
|
}
|
|
}
|
|
function createClientAuthError(errorCode, additionalMessage) {
|
|
return new ClientAuthError(errorCode, additionalMessage);
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Extract token by decoding the rawToken
|
|
*
|
|
* @param encodedToken
|
|
*/
|
|
function extractTokenClaims(encodedToken, base64Decode) {
|
|
const jswPayload = getJWSPayload(encodedToken);
|
|
// token will be decoded to get the username
|
|
try {
|
|
// base64Decode() should throw an error if there is an issue
|
|
const base64Decoded = base64Decode(jswPayload);
|
|
return JSON.parse(base64Decoded);
|
|
}
|
|
catch (err) {
|
|
throw createClientAuthError(tokenParsingError);
|
|
}
|
|
}
|
|
/**
|
|
* Check if the signin_state claim contains "kmsi"
|
|
* @param idTokenClaims
|
|
* @returns
|
|
*/
|
|
function isKmsi(idTokenClaims) {
|
|
if (!idTokenClaims.signin_state) {
|
|
return false;
|
|
}
|
|
/**
|
|
* Signin_state claim known values:
|
|
* dvc_mngd - device is managed
|
|
* dvc_dmjd - device is domain joined
|
|
* kmsi - user opted to "keep me signed in"
|
|
* inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
|
|
*/
|
|
const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
|
|
return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
|
|
}
|
|
/**
|
|
* decode a JWT
|
|
*
|
|
* @param authToken
|
|
*/
|
|
function getJWSPayload(authToken) {
|
|
if (!authToken) {
|
|
throw createClientAuthError(nullOrEmptyToken);
|
|
}
|
|
const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
|
|
const matches = tokenPartsRegex.exec(authToken);
|
|
if (!matches || matches.length < 4) {
|
|
throw createClientAuthError(tokenParsingError);
|
|
}
|
|
/**
|
|
* const crackedToken = {
|
|
* header: matches[1],
|
|
* JWSPayload: matches[2],
|
|
* JWSSig: matches[3],
|
|
* };
|
|
*/
|
|
return matches[2];
|
|
}
|
|
/**
|
|
* Determine if the token's max_age has transpired
|
|
*/
|
|
function checkMaxAge(authTime, maxAge) {
|
|
/*
|
|
* per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
|
* To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
|
|
* provide a value of 0 for the max_age parameter and the AS will force a fresh login.
|
|
*/
|
|
const fiveMinuteSkew = 300000; // five minutes in milliseconds
|
|
if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
|
|
throw createClientAuthError(maxAgeTranspired);
|
|
}
|
|
}
|
|
|
|
var AuthToken = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
checkMaxAge: checkMaxAge,
|
|
extractTokenClaims: extractTokenClaims,
|
|
getJWSPayload: getJWSPayload,
|
|
isKmsi: isKmsi
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Authority types supported by MSAL.
|
|
*/
|
|
const AuthorityType = {
|
|
Default: 0,
|
|
Adfs: 1,
|
|
Dsts: 2,
|
|
Ciam: 3,
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
function isOpenIdConfigResponse(response) {
|
|
return (response.hasOwnProperty("authorization_endpoint") &&
|
|
response.hasOwnProperty("token_endpoint") &&
|
|
response.hasOwnProperty("issuer") &&
|
|
response.hasOwnProperty("jwks_uri"));
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const redirectUriEmpty = "redirect_uri_empty";
|
|
const claimsRequestParsingError = "claims_request_parsing_error";
|
|
const authorityUriInsecure = "authority_uri_insecure";
|
|
const urlParseError = "url_parse_error";
|
|
const urlEmptyError = "empty_url_error";
|
|
const emptyInputScopesError = "empty_input_scopes_error";
|
|
const invalidClaims = "invalid_claims";
|
|
const tokenRequestEmpty = "token_request_empty";
|
|
const logoutRequestEmpty = "logout_request_empty";
|
|
const invalidCodeChallengeMethod = "invalid_code_challenge_method";
|
|
const pkceParamsMissing = "pkce_params_missing";
|
|
const invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
|
|
const invalidAuthorityMetadata = "invalid_authority_metadata";
|
|
const untrustedAuthority = "untrusted_authority";
|
|
const missingSshJwk = "missing_ssh_jwk";
|
|
const missingSshKid = "missing_ssh_kid";
|
|
const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
|
|
const invalidAuthenticationHeader = "invalid_authentication_header";
|
|
const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
|
|
const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
|
|
const authorityMismatch = "authority_mismatch";
|
|
const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
|
|
const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
|
|
const issuerValidationFailed = "issuer_validation_failed";
|
|
|
|
var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
authorityMismatch: authorityMismatch,
|
|
authorityUriInsecure: authorityUriInsecure,
|
|
cannotAllowPlatformBroker: cannotAllowPlatformBroker,
|
|
cannotSetOIDCOptions: cannotSetOIDCOptions,
|
|
claimsRequestParsingError: claimsRequestParsingError,
|
|
emptyInputScopesError: emptyInputScopesError,
|
|
invalidAuthenticationHeader: invalidAuthenticationHeader,
|
|
invalidAuthorityMetadata: invalidAuthorityMetadata,
|
|
invalidClaims: invalidClaims,
|
|
invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
|
|
invalidCodeChallengeMethod: invalidCodeChallengeMethod,
|
|
invalidPlatformBrokerConfiguration: invalidPlatformBrokerConfiguration,
|
|
invalidRequestMethodForEAR: invalidRequestMethodForEAR,
|
|
issuerValidationFailed: issuerValidationFailed,
|
|
logoutRequestEmpty: logoutRequestEmpty,
|
|
missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
|
|
missingSshJwk: missingSshJwk,
|
|
missingSshKid: missingSshKid,
|
|
pkceParamsMissing: pkceParamsMissing,
|
|
redirectUriEmpty: redirectUriEmpty,
|
|
tokenRequestEmpty: tokenRequestEmpty,
|
|
untrustedAuthority: untrustedAuthority,
|
|
urlEmptyError: urlEmptyError,
|
|
urlParseError: urlParseError
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Error thrown when there is an error in configuration of the MSAL.js library.
|
|
*/
|
|
class ClientConfigurationError extends AuthError {
|
|
constructor(errorCode) {
|
|
super(errorCode);
|
|
this.name = "ClientConfigurationError";
|
|
Object.setPrototypeOf(this, ClientConfigurationError.prototype);
|
|
}
|
|
}
|
|
function createClientConfigurationError(errorCode) {
|
|
return new ClientConfigurationError(errorCode);
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* @hidden
|
|
*/
|
|
class StringUtils {
|
|
/**
|
|
* Check if stringified object is empty
|
|
* @param strObj
|
|
*/
|
|
static isEmptyObj(strObj) {
|
|
if (strObj) {
|
|
try {
|
|
const obj = JSON.parse(strObj);
|
|
return Object.keys(obj).length === 0;
|
|
}
|
|
catch (e) { }
|
|
}
|
|
return true;
|
|
}
|
|
static startsWith(str, search) {
|
|
return str.indexOf(search) === 0;
|
|
}
|
|
static endsWith(str, search) {
|
|
return (str.length >= search.length &&
|
|
str.lastIndexOf(search) === str.length - search.length);
|
|
}
|
|
/**
|
|
* Parses string into an object.
|
|
*
|
|
* @param query
|
|
*/
|
|
static queryStringToObject(query) {
|
|
const obj = {};
|
|
const params = query.split("&");
|
|
const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
|
|
params.forEach((pair) => {
|
|
if (pair.trim()) {
|
|
const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
|
|
if (key && value) {
|
|
obj[decode(key)] = decode(value);
|
|
}
|
|
}
|
|
});
|
|
return obj;
|
|
}
|
|
/**
|
|
* Trims entries in an array.
|
|
*
|
|
* @param arr
|
|
*/
|
|
static trimArrayEntries(arr) {
|
|
return arr.map((entry) => entry.trim());
|
|
}
|
|
/**
|
|
* Removes empty strings from array
|
|
* @param arr
|
|
*/
|
|
static removeEmptyStringsFromArray(arr) {
|
|
return arr.filter((entry) => {
|
|
return !!entry;
|
|
});
|
|
}
|
|
/**
|
|
* Attempts to parse a string into JSON
|
|
* @param str
|
|
*/
|
|
static jsonParseHelper(str) {
|
|
try {
|
|
return JSON.parse(str);
|
|
}
|
|
catch (e) {
|
|
return null;
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const SKU = "msal.js.common";
|
|
// default authority
|
|
const DEFAULT_AUTHORITY = "https://login.microsoftonline.com/common/";
|
|
const DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
|
|
const DEFAULT_COMMON_TENANT = "common";
|
|
// ADFS String
|
|
const ADFS = "adfs";
|
|
const DSTS = "dstsv2";
|
|
// Default AAD Instance Discovery Endpoint
|
|
const AAD_INSTANCE_DISCOVERY_ENDPT = `${DEFAULT_AUTHORITY}discovery/instance?api-version=1.1&authorization_endpoint=`;
|
|
// CIAM URL
|
|
const CIAM_AUTH_URL = ".ciamlogin.com";
|
|
const AAD_TENANT_DOMAIN_SUFFIX = ".onmicrosoft.com";
|
|
// Resource delimiter - used for certain cache entries
|
|
const RESOURCE_DELIM = "|";
|
|
// Consumer UTID
|
|
const CONSUMER_UTID = "9188040d-6c67-4c5b-b112-36a304b66dad";
|
|
// Default scopes
|
|
const OPENID_SCOPE = "openid";
|
|
const PROFILE_SCOPE = "profile";
|
|
const OFFLINE_ACCESS_SCOPE = "offline_access";
|
|
const EMAIL_SCOPE = "email";
|
|
const CODE_GRANT_TYPE = "authorization_code";
|
|
const S256_CODE_CHALLENGE_METHOD = "S256";
|
|
const URL_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded;charset=utf-8";
|
|
const AUTHORIZATION_PENDING = "authorization_pending";
|
|
const NOT_APPLICABLE = "N/A";
|
|
const NOT_AVAILABLE = "Not Available";
|
|
const FORWARD_SLASH = "/";
|
|
const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
|
|
const IMDS_VERSION = "2020-06-01";
|
|
const IMDS_TIMEOUT = 2000;
|
|
const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
|
|
const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
|
|
const KNOWN_PUBLIC_CLOUDS = [
|
|
"login.microsoftonline.com",
|
|
"login.windows.net",
|
|
"login.microsoft.com",
|
|
"sts.windows.net",
|
|
];
|
|
const SHR_NONCE_VALIDITY = 240;
|
|
const INVALID_INSTANCE = "invalid_instance";
|
|
const HTTP_SUCCESS = 200;
|
|
const HTTP_SUCCESS_RANGE_START = 200;
|
|
const HTTP_SUCCESS_RANGE_END = 299;
|
|
const HTTP_REDIRECT = 302;
|
|
const HTTP_CLIENT_ERROR = 400;
|
|
const HTTP_CLIENT_ERROR_RANGE_START = 400;
|
|
const HTTP_BAD_REQUEST = 400;
|
|
const HTTP_UNAUTHORIZED = 401;
|
|
const HTTP_NOT_FOUND = 404;
|
|
const HTTP_REQUEST_TIMEOUT = 408;
|
|
const HTTP_GONE = 410;
|
|
const HTTP_TOO_MANY_REQUESTS = 429;
|
|
const HTTP_CLIENT_ERROR_RANGE_END = 499;
|
|
const HTTP_SERVER_ERROR = 500;
|
|
const HTTP_SERVER_ERROR_RANGE_START = 500;
|
|
const HTTP_SERVICE_UNAVAILABLE = 503;
|
|
const HTTP_GATEWAY_TIMEOUT = 504;
|
|
const HTTP_SERVER_ERROR_RANGE_END = 599;
|
|
const HTTP_MULTI_SIDED_ERROR = 600;
|
|
const HttpMethod = {
|
|
GET: "GET",
|
|
POST: "POST",
|
|
};
|
|
const OIDC_DEFAULT_SCOPES = [
|
|
OPENID_SCOPE,
|
|
PROFILE_SCOPE,
|
|
OFFLINE_ACCESS_SCOPE,
|
|
];
|
|
const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, EMAIL_SCOPE];
|
|
/**
|
|
* Request header names
|
|
*/
|
|
const HeaderNames = {
|
|
CONTENT_TYPE: "Content-Type",
|
|
CONTENT_LENGTH: "Content-Length",
|
|
RETRY_AFTER: "Retry-After",
|
|
CCS_HEADER: "X-AnchorMailbox",
|
|
WWWAuthenticate: "WWW-Authenticate",
|
|
AuthenticationInfo: "Authentication-Info",
|
|
X_MS_REQUEST_ID: "x-ms-request-id",
|
|
X_MS_HTTP_VERSION: "x-ms-httpver",
|
|
};
|
|
/**
|
|
* Persistent cache keys MSAL which stay while user is logged in.
|
|
*/
|
|
const PersistentCacheKeys = {
|
|
ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
|
|
};
|
|
/**
|
|
* String constants related to AAD Authority
|
|
*/
|
|
const AADAuthority = {
|
|
COMMON: "common",
|
|
ORGANIZATIONS: "organizations",
|
|
CONSUMERS: "consumers",
|
|
};
|
|
/**
|
|
* Claims request keys
|
|
*/
|
|
const ClaimsRequestKeys = {
|
|
ACCESS_TOKEN: "access_token",
|
|
XMS_CC: "xms_cc",
|
|
};
|
|
/**
|
|
* we considered making this "enum" in the request instead of string, however it looks like the allowed list of
|
|
* prompt values kept changing over past couple of years. There are some undocumented prompt values for some
|
|
* internal partners too, hence the choice of generic "string" type instead of the "enum"
|
|
*/
|
|
const PromptValue = {
|
|
LOGIN: "login",
|
|
SELECT_ACCOUNT: "select_account",
|
|
CONSENT: "consent",
|
|
NONE: "none",
|
|
CREATE: "create",
|
|
NO_SESSION: "no_session",
|
|
};
|
|
/**
|
|
* allowed values for codeVerifier
|
|
*/
|
|
const CodeChallengeMethodValues = {
|
|
PLAIN: "plain",
|
|
S256: "S256",
|
|
};
|
|
/**
|
|
* Allowed values for response_type
|
|
*/
|
|
const OAuthResponseType = {
|
|
CODE: "code",
|
|
IDTOKEN_TOKEN: "id_token token",
|
|
IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token",
|
|
};
|
|
/**
|
|
* allowed values for response_mode
|
|
*/
|
|
const ResponseMode = {
|
|
QUERY: "query",
|
|
FRAGMENT: "fragment",
|
|
FORM_POST: "form_post",
|
|
};
|
|
/**
|
|
* allowed grant_type
|
|
*/
|
|
const GrantType = {
|
|
IMPLICIT_GRANT: "implicit",
|
|
AUTHORIZATION_CODE_GRANT: "authorization_code",
|
|
CLIENT_CREDENTIALS_GRANT: "client_credentials",
|
|
RESOURCE_OWNER_PASSWORD_GRANT: "password",
|
|
REFRESH_TOKEN_GRANT: "refresh_token",
|
|
DEVICE_CODE_GRANT: "device_code",
|
|
JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
|
|
};
|
|
/**
|
|
* Account types in Cache
|
|
*/
|
|
const CACHE_ACCOUNT_TYPE_MSSTS = "MSSTS";
|
|
const CACHE_ACCOUNT_TYPE_ADFS = "ADFS";
|
|
const CACHE_ACCOUNT_TYPE_MSAV1 = "MSA";
|
|
const CACHE_ACCOUNT_TYPE_GENERIC = "Generic";
|
|
/**
|
|
* Separators used in cache
|
|
*/
|
|
const CACHE_KEY_SEPARATOR = "-";
|
|
const CLIENT_INFO_SEPARATOR = ".";
|
|
/**
|
|
* Credential Type stored in the cache
|
|
*/
|
|
const CredentialType = {
|
|
ID_TOKEN: "IdToken",
|
|
ACCESS_TOKEN: "AccessToken",
|
|
ACCESS_TOKEN_WITH_AUTH_SCHEME: "AccessToken_With_AuthScheme",
|
|
REFRESH_TOKEN: "RefreshToken",
|
|
};
|
|
/**
|
|
* Combine all cache types
|
|
*/
|
|
const CacheType = {
|
|
ADFS: 1001,
|
|
MSA: 1002,
|
|
MSSTS: 1003,
|
|
GENERIC: 1004,
|
|
ACCESS_TOKEN: 2001,
|
|
REFRESH_TOKEN: 2002,
|
|
ID_TOKEN: 2003,
|
|
APP_METADATA: 3001,
|
|
UNDEFINED: 9999,
|
|
};
|
|
/**
|
|
* More Cache related constants
|
|
*/
|
|
const APP_METADATA = "appmetadata";
|
|
const CLIENT_INFO$1 = "client_info";
|
|
const THE_FAMILY_ID = "1";
|
|
const AUTHORITY_METADATA_CACHE_KEY = "authority-metadata";
|
|
const AUTHORITY_METADATA_REFRESH_TIME_SECONDS = 3600 * 24; // 24 Hours
|
|
const AuthorityMetadataSource = {
|
|
CONFIG: "config",
|
|
CACHE: "cache",
|
|
NETWORK: "network",
|
|
HARDCODED_VALUES: "hardcoded_values",
|
|
};
|
|
const SERVER_TELEM_SCHEMA_VERSION = 5;
|
|
const SERVER_TELEM_MAX_CUR_HEADER_BYTES = 80; // ESTS limit is 100B, set to 80 to provide a 20B buffer
|
|
const SERVER_TELEM_MAX_LAST_HEADER_BYTES = 330; // ESTS limit is 350B, set to 330 to provide a 20B buffer,
|
|
const SERVER_TELEM_MAX_CACHED_ERRORS = 50; // Limit the number of errors that can be stored to prevent uncontrolled size gains
|
|
const SERVER_TELEM_CACHE_KEY = "server-telemetry";
|
|
const SERVER_TELEM_CATEGORY_SEPARATOR = "|";
|
|
const SERVER_TELEM_VALUE_SEPARATOR = ",";
|
|
const SERVER_TELEM_OVERFLOW_TRUE = "1";
|
|
const SERVER_TELEM_OVERFLOW_FALSE = "0";
|
|
const SERVER_TELEM_UNKNOWN_ERROR = "unknown_error";
|
|
/**
|
|
* Type of the authentication request
|
|
*/
|
|
const AuthenticationScheme = {
|
|
BEARER: "Bearer",
|
|
POP: "pop",
|
|
SSH: "ssh-cert",
|
|
};
|
|
/**
|
|
* Constants related to throttling
|
|
*/
|
|
const DEFAULT_THROTTLE_TIME_SECONDS = 60;
|
|
// Default maximum time to throttle in seconds, overrides what the server sends back
|
|
const DEFAULT_MAX_THROTTLE_TIME_SECONDS = 3600;
|
|
// Prefix for storing throttling entries
|
|
const THROTTLING_PREFIX = "throttling";
|
|
// Value assigned to the x-ms-lib-capability header to indicate to the server the library supports throttling
|
|
const X_MS_LIB_CAPABILITY_VALUE = "retry-after, h429";
|
|
/**
|
|
* Errors
|
|
*/
|
|
const INVALID_GRANT_ERROR = "invalid_grant";
|
|
const CLIENT_MISMATCH_ERROR = "client_mismatch";
|
|
/**
|
|
* Password grant parameters
|
|
*/
|
|
const PasswordGrantConstants = {
|
|
username: "username",
|
|
password: "password",
|
|
};
|
|
/**
|
|
* Region Discovery Sources
|
|
*/
|
|
const RegionDiscoverySources = {
|
|
FAILED_AUTO_DETECTION: "1",
|
|
INTERNAL_CACHE: "2",
|
|
ENVIRONMENT_VARIABLE: "3",
|
|
IMDS: "4",
|
|
};
|
|
/**
|
|
* Region Discovery Outcomes
|
|
*/
|
|
const RegionDiscoveryOutcomes = {
|
|
CONFIGURED_MATCHES_DETECTED: "1",
|
|
CONFIGURED_NO_AUTO_DETECTION: "2",
|
|
CONFIGURED_NOT_DETECTED: "3",
|
|
AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
|
|
AUTO_DETECTION_REQUESTED_FAILED: "5",
|
|
};
|
|
/**
|
|
* Specifies the reason for fetching the access token from the identity provider
|
|
*/
|
|
const CacheOutcome = {
|
|
// When a token is found in the cache or the cache is not supposed to be hit when making the request
|
|
NOT_APPLICABLE: "0",
|
|
// When the token request goes to the identity provider because force_refresh was set to true. Also occurs if claims were requested
|
|
FORCE_REFRESH_OR_CLAIMS: "1",
|
|
// When the token request goes to the identity provider because no cached access token exists
|
|
NO_CACHED_ACCESS_TOKEN: "2",
|
|
// When the token request goes to the identity provider because cached access token expired
|
|
CACHED_ACCESS_TOKEN_EXPIRED: "3",
|
|
// When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
|
|
PROACTIVELY_REFRESHED: "4",
|
|
};
|
|
const JsonWebTokenTypes = {
|
|
Jwt: "JWT",
|
|
Jwk: "JWK",
|
|
Pop: "pop",
|
|
};
|
|
const ONE_DAY_IN_MS = 86400000;
|
|
// Token renewal offset default in seconds
|
|
const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
|
|
const EncodingTypes = {
|
|
BASE64: "base64",
|
|
HEX: "hex",
|
|
UTF8: "utf-8",
|
|
};
|
|
|
|
var Constants = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
AADAuthority: AADAuthority,
|
|
AAD_INSTANCE_DISCOVERY_ENDPT: AAD_INSTANCE_DISCOVERY_ENDPT,
|
|
AAD_TENANT_DOMAIN_SUFFIX: AAD_TENANT_DOMAIN_SUFFIX,
|
|
ADFS: ADFS,
|
|
APP_METADATA: APP_METADATA,
|
|
AUTHORITY_METADATA_CACHE_KEY: AUTHORITY_METADATA_CACHE_KEY,
|
|
AUTHORITY_METADATA_REFRESH_TIME_SECONDS: AUTHORITY_METADATA_REFRESH_TIME_SECONDS,
|
|
AUTHORIZATION_PENDING: AUTHORIZATION_PENDING,
|
|
AZURE_REGION_AUTO_DISCOVER_FLAG: AZURE_REGION_AUTO_DISCOVER_FLAG,
|
|
AuthenticationScheme: AuthenticationScheme,
|
|
AuthorityMetadataSource: AuthorityMetadataSource,
|
|
CACHE_ACCOUNT_TYPE_ADFS: CACHE_ACCOUNT_TYPE_ADFS,
|
|
CACHE_ACCOUNT_TYPE_GENERIC: CACHE_ACCOUNT_TYPE_GENERIC,
|
|
CACHE_ACCOUNT_TYPE_MSAV1: CACHE_ACCOUNT_TYPE_MSAV1,
|
|
CACHE_ACCOUNT_TYPE_MSSTS: CACHE_ACCOUNT_TYPE_MSSTS,
|
|
CACHE_KEY_SEPARATOR: CACHE_KEY_SEPARATOR,
|
|
CIAM_AUTH_URL: CIAM_AUTH_URL,
|
|
CLIENT_INFO: CLIENT_INFO$1,
|
|
CLIENT_INFO_SEPARATOR: CLIENT_INFO_SEPARATOR,
|
|
CLIENT_MISMATCH_ERROR: CLIENT_MISMATCH_ERROR,
|
|
CODE_GRANT_TYPE: CODE_GRANT_TYPE,
|
|
CONSUMER_UTID: CONSUMER_UTID,
|
|
CacheOutcome: CacheOutcome,
|
|
CacheType: CacheType,
|
|
ClaimsRequestKeys: ClaimsRequestKeys,
|
|
CodeChallengeMethodValues: CodeChallengeMethodValues,
|
|
CredentialType: CredentialType,
|
|
DEFAULT_AUTHORITY: DEFAULT_AUTHORITY,
|
|
DEFAULT_AUTHORITY_HOST: DEFAULT_AUTHORITY_HOST,
|
|
DEFAULT_COMMON_TENANT: DEFAULT_COMMON_TENANT,
|
|
DEFAULT_MAX_THROTTLE_TIME_SECONDS: DEFAULT_MAX_THROTTLE_TIME_SECONDS,
|
|
DEFAULT_THROTTLE_TIME_SECONDS: DEFAULT_THROTTLE_TIME_SECONDS,
|
|
DEFAULT_TOKEN_RENEWAL_OFFSET_SEC: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
|
|
DSTS: DSTS,
|
|
EMAIL_SCOPE: EMAIL_SCOPE,
|
|
EncodingTypes: EncodingTypes,
|
|
FORWARD_SLASH: FORWARD_SLASH,
|
|
GrantType: GrantType,
|
|
HTTP_BAD_REQUEST: HTTP_BAD_REQUEST,
|
|
HTTP_CLIENT_ERROR: HTTP_CLIENT_ERROR,
|
|
HTTP_CLIENT_ERROR_RANGE_END: HTTP_CLIENT_ERROR_RANGE_END,
|
|
HTTP_CLIENT_ERROR_RANGE_START: HTTP_CLIENT_ERROR_RANGE_START,
|
|
HTTP_GATEWAY_TIMEOUT: HTTP_GATEWAY_TIMEOUT,
|
|
HTTP_GONE: HTTP_GONE,
|
|
HTTP_MULTI_SIDED_ERROR: HTTP_MULTI_SIDED_ERROR,
|
|
HTTP_NOT_FOUND: HTTP_NOT_FOUND,
|
|
HTTP_REDIRECT: HTTP_REDIRECT,
|
|
HTTP_REQUEST_TIMEOUT: HTTP_REQUEST_TIMEOUT,
|
|
HTTP_SERVER_ERROR: HTTP_SERVER_ERROR,
|
|
HTTP_SERVER_ERROR_RANGE_END: HTTP_SERVER_ERROR_RANGE_END,
|
|
HTTP_SERVER_ERROR_RANGE_START: HTTP_SERVER_ERROR_RANGE_START,
|
|
HTTP_SERVICE_UNAVAILABLE: HTTP_SERVICE_UNAVAILABLE,
|
|
HTTP_SUCCESS: HTTP_SUCCESS,
|
|
HTTP_SUCCESS_RANGE_END: HTTP_SUCCESS_RANGE_END,
|
|
HTTP_SUCCESS_RANGE_START: HTTP_SUCCESS_RANGE_START,
|
|
HTTP_TOO_MANY_REQUESTS: HTTP_TOO_MANY_REQUESTS,
|
|
HTTP_UNAUTHORIZED: HTTP_UNAUTHORIZED,
|
|
HeaderNames: HeaderNames,
|
|
HttpMethod: HttpMethod,
|
|
IMDS_ENDPOINT: IMDS_ENDPOINT,
|
|
IMDS_TIMEOUT: IMDS_TIMEOUT,
|
|
IMDS_VERSION: IMDS_VERSION,
|
|
INVALID_GRANT_ERROR: INVALID_GRANT_ERROR,
|
|
INVALID_INSTANCE: INVALID_INSTANCE,
|
|
JsonWebTokenTypes: JsonWebTokenTypes,
|
|
KNOWN_PUBLIC_CLOUDS: KNOWN_PUBLIC_CLOUDS,
|
|
NOT_APPLICABLE: NOT_APPLICABLE,
|
|
NOT_AVAILABLE: NOT_AVAILABLE,
|
|
OAuthResponseType: OAuthResponseType,
|
|
OFFLINE_ACCESS_SCOPE: OFFLINE_ACCESS_SCOPE,
|
|
OIDC_DEFAULT_SCOPES: OIDC_DEFAULT_SCOPES,
|
|
OIDC_SCOPES: OIDC_SCOPES,
|
|
ONE_DAY_IN_MS: ONE_DAY_IN_MS,
|
|
OPENID_SCOPE: OPENID_SCOPE,
|
|
PROFILE_SCOPE: PROFILE_SCOPE,
|
|
PasswordGrantConstants: PasswordGrantConstants,
|
|
PersistentCacheKeys: PersistentCacheKeys,
|
|
PromptValue: PromptValue,
|
|
REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX,
|
|
RESOURCE_DELIM: RESOURCE_DELIM,
|
|
RegionDiscoveryOutcomes: RegionDiscoveryOutcomes,
|
|
RegionDiscoverySources: RegionDiscoverySources,
|
|
ResponseMode: ResponseMode,
|
|
S256_CODE_CHALLENGE_METHOD: S256_CODE_CHALLENGE_METHOD,
|
|
SERVER_TELEM_CACHE_KEY: SERVER_TELEM_CACHE_KEY,
|
|
SERVER_TELEM_CATEGORY_SEPARATOR: SERVER_TELEM_CATEGORY_SEPARATOR,
|
|
SERVER_TELEM_MAX_CACHED_ERRORS: SERVER_TELEM_MAX_CACHED_ERRORS,
|
|
SERVER_TELEM_MAX_CUR_HEADER_BYTES: SERVER_TELEM_MAX_CUR_HEADER_BYTES,
|
|
SERVER_TELEM_MAX_LAST_HEADER_BYTES: SERVER_TELEM_MAX_LAST_HEADER_BYTES,
|
|
SERVER_TELEM_OVERFLOW_FALSE: SERVER_TELEM_OVERFLOW_FALSE,
|
|
SERVER_TELEM_OVERFLOW_TRUE: SERVER_TELEM_OVERFLOW_TRUE,
|
|
SERVER_TELEM_SCHEMA_VERSION: SERVER_TELEM_SCHEMA_VERSION,
|
|
SERVER_TELEM_UNKNOWN_ERROR: SERVER_TELEM_UNKNOWN_ERROR,
|
|
SERVER_TELEM_VALUE_SEPARATOR: SERVER_TELEM_VALUE_SEPARATOR,
|
|
SHR_NONCE_VALIDITY: SHR_NONCE_VALIDITY,
|
|
SKU: SKU,
|
|
THE_FAMILY_ID: THE_FAMILY_ID,
|
|
THROTTLING_PREFIX: THROTTLING_PREFIX,
|
|
URL_FORM_CONTENT_TYPE: URL_FORM_CONTENT_TYPE,
|
|
X_MS_LIB_CAPABILITY_VALUE: X_MS_LIB_CAPABILITY_VALUE
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Url object class which can perform various transformations on url strings.
|
|
*/
|
|
class UrlString {
|
|
get urlString() {
|
|
return this._urlString;
|
|
}
|
|
constructor(url) {
|
|
this._urlString = url;
|
|
if (!this._urlString) {
|
|
// Throws error if url is empty
|
|
throw createClientConfigurationError(urlEmptyError);
|
|
}
|
|
if (!url.includes("#")) {
|
|
this._urlString = UrlString.canonicalizeUri(url);
|
|
}
|
|
}
|
|
/**
|
|
* Ensure urls are lower case and end with a / character.
|
|
* @param url
|
|
*/
|
|
static canonicalizeUri(url) {
|
|
if (url) {
|
|
let lowerCaseUrl = url.toLowerCase();
|
|
if (StringUtils.endsWith(lowerCaseUrl, "?")) {
|
|
lowerCaseUrl = lowerCaseUrl.slice(0, -1);
|
|
}
|
|
else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
|
|
lowerCaseUrl = lowerCaseUrl.slice(0, -2);
|
|
}
|
|
if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
|
|
lowerCaseUrl += "/";
|
|
}
|
|
return lowerCaseUrl;
|
|
}
|
|
return url;
|
|
}
|
|
/**
|
|
* Throws if urlString passed is not a valid authority URI string.
|
|
*/
|
|
validateAsUri() {
|
|
// Attempts to parse url for uri components
|
|
let components;
|
|
try {
|
|
components = this.getUrlComponents();
|
|
}
|
|
catch (e) {
|
|
throw createClientConfigurationError(urlParseError);
|
|
}
|
|
// Throw error if URI or path segments are not parseable.
|
|
if (!components.HostNameAndPort || !components.PathSegments) {
|
|
throw createClientConfigurationError(urlParseError);
|
|
}
|
|
// Throw error if uri is insecure.
|
|
if (!components.Protocol ||
|
|
components.Protocol.toLowerCase() !== "https:") {
|
|
throw createClientConfigurationError(authorityUriInsecure);
|
|
}
|
|
}
|
|
/**
|
|
* Given a url and a query string return the url with provided query string appended
|
|
* @param url
|
|
* @param queryString
|
|
*/
|
|
static appendQueryString(url, queryString) {
|
|
if (!queryString) {
|
|
return url;
|
|
}
|
|
return url.indexOf("?") < 0
|
|
? `${url}?${queryString}`
|
|
: `${url}&${queryString}`;
|
|
}
|
|
/**
|
|
* Returns a url with the hash removed
|
|
* @param url
|
|
*/
|
|
static removeHashFromUrl(url) {
|
|
return UrlString.canonicalizeUri(url.split("#")[0]);
|
|
}
|
|
/**
|
|
* Given a url like https://a:b/common/d?e=f#g, and a tenantId, returns https://a:b/tenantId/d
|
|
* @param href The url
|
|
* @param tenantId The tenant id to replace
|
|
*/
|
|
replaceTenantPath(tenantId) {
|
|
const urlObject = this.getUrlComponents();
|
|
const pathArray = urlObject.PathSegments;
|
|
if (tenantId &&
|
|
pathArray.length !== 0 &&
|
|
(pathArray[0] === AADAuthority.COMMON ||
|
|
pathArray[0] === AADAuthority.ORGANIZATIONS)) {
|
|
pathArray[0] = tenantId;
|
|
}
|
|
return UrlString.constructAuthorityUriFromObject(urlObject);
|
|
}
|
|
/**
|
|
* Parses out the components from a url string.
|
|
* @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
|
|
*/
|
|
getUrlComponents() {
|
|
// https://gist.github.com/curtisz/11139b2cfcaef4a261e0
|
|
const regEx = RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?");
|
|
// If url string does not match regEx, we throw an error
|
|
const match = this.urlString.match(regEx);
|
|
if (!match) {
|
|
throw createClientConfigurationError(urlParseError);
|
|
}
|
|
// Url component object
|
|
const urlComponents = {
|
|
Protocol: match[1],
|
|
HostNameAndPort: match[4],
|
|
AbsolutePath: match[5],
|
|
QueryString: match[7],
|
|
};
|
|
let pathSegments = urlComponents.AbsolutePath.split("/");
|
|
pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
|
|
urlComponents.PathSegments = pathSegments;
|
|
if (urlComponents.QueryString &&
|
|
urlComponents.QueryString.endsWith("/")) {
|
|
urlComponents.QueryString = urlComponents.QueryString.substring(0, urlComponents.QueryString.length - 1);
|
|
}
|
|
return urlComponents;
|
|
}
|
|
static getDomainFromUrl(url) {
|
|
const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
|
|
const match = url.match(regEx);
|
|
if (!match) {
|
|
throw createClientConfigurationError(urlParseError);
|
|
}
|
|
return match[2];
|
|
}
|
|
static getAbsoluteUrl(relativeUrl, baseUrl) {
|
|
if (relativeUrl[0] === FORWARD_SLASH) {
|
|
const url = new UrlString(baseUrl);
|
|
const baseComponents = url.getUrlComponents();
|
|
return (baseComponents.Protocol +
|
|
"//" +
|
|
baseComponents.HostNameAndPort +
|
|
relativeUrl);
|
|
}
|
|
return relativeUrl;
|
|
}
|
|
static constructAuthorityUriFromObject(urlObject) {
|
|
return new UrlString(urlObject.Protocol +
|
|
"//" +
|
|
urlObject.HostNameAndPort +
|
|
"/" +
|
|
urlObject.PathSegments.join("/"));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
// Build endpoint metadata dynamically to avoid string duplication
|
|
const endpointHosts = [
|
|
{ host: "login.microsoftonline.com" },
|
|
{
|
|
host: "login.chinacloudapi.cn",
|
|
issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
|
|
},
|
|
{ host: "login.microsoftonline.us" },
|
|
{ host: "login.sovcloud-identity.fr" },
|
|
{ host: "login.sovcloud-identity.de" },
|
|
{ host: "login.sovcloud-identity.sg" },
|
|
];
|
|
function buildOpenIdConfig(host, issuerHost) {
|
|
return {
|
|
token_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/token`,
|
|
jwks_uri: `https://${host}/{tenantid}/discovery/v2.0/keys`,
|
|
issuer: `https://${issuerHost}/{tenantid}/v2.0`,
|
|
authorization_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/authorize`,
|
|
end_session_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/logout`,
|
|
};
|
|
}
|
|
const dynamicEndpointMetadata = endpointHosts.reduce((acc, { host, issuerHost }) => {
|
|
acc[host] = buildOpenIdConfig(host, issuerHost || host);
|
|
return acc;
|
|
}, {});
|
|
const rawMetdataJSON = {
|
|
endpointMetadata: dynamicEndpointMetadata,
|
|
instanceDiscoveryMetadata: {
|
|
metadata: [
|
|
{
|
|
preferred_network: "login.microsoftonline.com",
|
|
preferred_cache: "login.windows.net",
|
|
aliases: [
|
|
"login.microsoftonline.com",
|
|
"login.windows.net",
|
|
"login.microsoft.com",
|
|
"sts.windows.net",
|
|
],
|
|
},
|
|
{
|
|
preferred_network: "login.partner.microsoftonline.cn",
|
|
preferred_cache: "login.partner.microsoftonline.cn",
|
|
aliases: [
|
|
"login.partner.microsoftonline.cn",
|
|
"login.chinacloudapi.cn",
|
|
],
|
|
},
|
|
{
|
|
preferred_network: "login.microsoftonline.de",
|
|
preferred_cache: "login.microsoftonline.de",
|
|
aliases: ["login.microsoftonline.de"],
|
|
},
|
|
{
|
|
preferred_network: "login.microsoftonline.us",
|
|
preferred_cache: "login.microsoftonline.us",
|
|
aliases: [
|
|
"login.microsoftonline.us",
|
|
"login.usgovcloudapi.net",
|
|
],
|
|
},
|
|
{
|
|
preferred_network: "login-us.microsoftonline.com",
|
|
preferred_cache: "login-us.microsoftonline.com",
|
|
aliases: ["login-us.microsoftonline.com"],
|
|
},
|
|
{
|
|
preferred_network: "login.sovcloud-identity.fr",
|
|
preferred_cache: "login.sovcloud-identity.fr",
|
|
aliases: ["login.sovcloud-identity.fr"],
|
|
},
|
|
{
|
|
preferred_network: "login.sovcloud-identity.de",
|
|
preferred_cache: "login.sovcloud-identity.de",
|
|
aliases: ["login.sovcloud-identity.de"],
|
|
},
|
|
{
|
|
preferred_network: "login.sovcloud-identity.sg",
|
|
preferred_cache: "login.sovcloud-identity.sg",
|
|
aliases: ["login.sovcloud-identity.sg"],
|
|
},
|
|
{
|
|
preferred_network: "login.windows-ppe.net",
|
|
preferred_cache: "login.windows-ppe.net",
|
|
aliases: [
|
|
"login.windows-ppe.net",
|
|
"sts.windows-ppe.net",
|
|
"login.microsoft-ppe.com",
|
|
],
|
|
},
|
|
],
|
|
},
|
|
};
|
|
const EndpointMetadata = rawMetdataJSON.endpointMetadata;
|
|
const InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
|
|
const InstanceDiscoveryMetadataAliases = new Set();
|
|
InstanceDiscoveryMetadata.metadata.forEach((metadataEntry) => {
|
|
metadataEntry.aliases.forEach((alias) => {
|
|
InstanceDiscoveryMetadataAliases.add(alias);
|
|
});
|
|
});
|
|
/**
|
|
* Attempts to get an aliases array from the static authority metadata sources based on the canonical authority host
|
|
* @param staticAuthorityOptions
|
|
* @param logger
|
|
* @returns
|
|
*/
|
|
function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlationId) {
|
|
let staticAliases;
|
|
const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
|
|
if (canonicalAuthority) {
|
|
const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
|
|
staticAliases =
|
|
getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
|
|
getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
|
|
staticAuthorityOptions.knownAuthorities;
|
|
}
|
|
return staticAliases || [];
|
|
}
|
|
/**
|
|
* Returns aliases for from the raw cloud discovery metadata passed in
|
|
* @param authorityHost
|
|
* @param rawCloudDiscoveryMetadata
|
|
* @returns
|
|
*/
|
|
function getAliasesFromMetadata(logger, correlationId, authorityHost, cloudDiscoveryMetadata, source) {
|
|
logger.trace(`getAliasesFromMetadata called with source: '${source}'`, correlationId);
|
|
if (authorityHost && cloudDiscoveryMetadata) {
|
|
const metadata = getCloudDiscoveryMetadataFromNetworkResponse(cloudDiscoveryMetadata, authorityHost);
|
|
if (metadata) {
|
|
logger.trace(`getAliasesFromMetadata: found cloud discovery metadata in '${source}', returning aliases`, correlationId);
|
|
return metadata.aliases;
|
|
}
|
|
else {
|
|
logger.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in '${source}'`, correlationId);
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Get cloud discovery metadata for common authorities
|
|
*/
|
|
function getCloudDiscoveryMetadataFromHardcodedValues(authorityHost) {
|
|
const metadata = getCloudDiscoveryMetadataFromNetworkResponse(InstanceDiscoveryMetadata.metadata, authorityHost);
|
|
return metadata;
|
|
}
|
|
/**
|
|
* Searches instance discovery network response for the entry that contains the host in the aliases list
|
|
* @param response
|
|
* @param authority
|
|
*/
|
|
function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
|
|
for (let i = 0; i < response.length; i++) {
|
|
const metadata = response[i];
|
|
if (metadata.aliases.includes(authorityHost)) {
|
|
return metadata;
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Protocol modes supported by MSAL.
|
|
*/
|
|
const ProtocolMode = {
|
|
/**
|
|
* Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
|
|
*/
|
|
AAD: "AAD",
|
|
/**
|
|
* Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
|
|
* Support is limited for this mode.
|
|
*/
|
|
OIDC: "OIDC",
|
|
/**
|
|
* Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
|
|
*/
|
|
EAR: "EAR",
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const AzureCloudInstance = {
|
|
// AzureCloudInstance is not specified.
|
|
None: "none",
|
|
// Microsoft Azure public cloud
|
|
AzurePublic: "https://login.microsoftonline.com",
|
|
// Microsoft PPE
|
|
AzurePpe: "https://login.windows-ppe.net",
|
|
// Microsoft Chinese national/regional cloud
|
|
AzureChina: "https://login.chinacloudapi.cn",
|
|
// Microsoft German national/regional cloud ("Black Forest")
|
|
AzureGermany: "https://login.microsoftonline.de",
|
|
// US Government cloud
|
|
AzureUsGovernment: "https://login.microsoftonline.us",
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
function isCloudInstanceDiscoveryResponse(response) {
|
|
return (response.hasOwnProperty("tenant_discovery_endpoint") &&
|
|
response.hasOwnProperty("metadata"));
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
function isCloudInstanceDiscoveryErrorResponse(response) {
|
|
return (response.hasOwnProperty("error") &&
|
|
response.hasOwnProperty("error_description"));
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Time spent sending/waiting for the response of a request to the token endpoint
|
|
*/
|
|
const NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
|
|
const RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
|
|
const AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
|
|
/**
|
|
* Time spent on the network for refresh token acquisition
|
|
*/
|
|
const RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";
|
|
/**
|
|
* Time taken for acquiring refresh token , records RT size
|
|
*/
|
|
const RefreshTokenClientAcquireToken = "refreshTokenClientAcquireToken";
|
|
/**
|
|
* Time taken for acquiring cached refresh token
|
|
*/
|
|
const RefreshTokenClientAcquireTokenWithCachedRefreshToken = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
|
|
/**
|
|
* Helper function to create token request body in RefreshTokenClient (msal-common).
|
|
*/
|
|
const RefreshTokenClientCreateTokenRequestBody = "refreshTokenClientCreateTokenRequestBody";
|
|
const SilentFlowClientGenerateResultFromCacheRecord = "silentFlowClientGenerateResultFromCacheRecord";
|
|
/**
|
|
* getAuthCodeUrl API (msal-browser and msal-node).
|
|
*/
|
|
const GetAuthCodeUrl = "getAuthCodeUrl";
|
|
/**
|
|
* Functions from InteractionHandler (msal-browser)
|
|
*/
|
|
const HandleCodeResponseFromServer = "handleCodeResponseFromServer";
|
|
/**
|
|
* APIs in Authorization Code Client (msal-common)
|
|
*/
|
|
const AuthClientExecuteTokenRequest = "authClientExecuteTokenRequest";
|
|
const AuthClientCreateTokenRequestBody = "authClientCreateTokenRequestBody";
|
|
const UpdateTokenEndpointAuthority = "updateTokenEndpointAuthority";
|
|
/**
|
|
* Generate functions in PopTokenGenerator (msal-common)
|
|
*/
|
|
const PopTokenGenerateCnf = "popTokenGenerateCnf";
|
|
/**
|
|
* handleServerTokenResponse API in ResponseHandler (msal-common)
|
|
*/
|
|
const HandleServerTokenResponse = "handleServerTokenResponse";
|
|
/**
|
|
* Authority functions
|
|
*/
|
|
const AuthorityResolveEndpointsAsync = "authorityResolveEndpointsAsync";
|
|
const AuthorityGetCloudDiscoveryMetadataFromNetwork = "authorityGetCloudDiscoveryMetadataFromNetwork";
|
|
const AuthorityUpdateCloudDiscoveryMetadata = "authorityUpdateCloudDiscoveryMetadata";
|
|
const AuthorityGetEndpointMetadataFromNetwork = "authorityGetEndpointMetadataFromNetwork";
|
|
const AuthorityUpdateEndpointMetadata = "authorityUpdateEndpointMetadata";
|
|
const AuthorityUpdateMetadataWithRegionalInformation = "authorityUpdateMetadataWithRegionalInformation";
|
|
/**
|
|
* Region Discovery functions
|
|
*/
|
|
const RegionDiscoveryDetectRegion = "regionDiscoveryDetectRegion";
|
|
const RegionDiscoveryGetRegionFromIMDS = "regionDiscoveryGetRegionFromIMDS";
|
|
const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
|
|
/**
|
|
* Cache operations
|
|
*/
|
|
const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
|
|
const SetUserData = "setUserData";
|
|
|
|
var PerformanceEvents = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
AuthClientCreateTokenRequestBody: AuthClientCreateTokenRequestBody,
|
|
AuthClientExecuteTokenRequest: AuthClientExecuteTokenRequest,
|
|
AuthorityGetCloudDiscoveryMetadataFromNetwork: AuthorityGetCloudDiscoveryMetadataFromNetwork,
|
|
AuthorityGetEndpointMetadataFromNetwork: AuthorityGetEndpointMetadataFromNetwork,
|
|
AuthorityResolveEndpointsAsync: AuthorityResolveEndpointsAsync,
|
|
AuthorityUpdateCloudDiscoveryMetadata: AuthorityUpdateCloudDiscoveryMetadata,
|
|
AuthorityUpdateEndpointMetadata: AuthorityUpdateEndpointMetadata,
|
|
AuthorityUpdateMetadataWithRegionalInformation: AuthorityUpdateMetadataWithRegionalInformation,
|
|
AuthorizationCodeClientExecutePostToTokenEndpoint: AuthorizationCodeClientExecutePostToTokenEndpoint,
|
|
CacheManagerGetRefreshToken: CacheManagerGetRefreshToken,
|
|
GetAuthCodeUrl: GetAuthCodeUrl,
|
|
HandleCodeResponseFromServer: HandleCodeResponseFromServer,
|
|
HandleServerTokenResponse: HandleServerTokenResponse,
|
|
NetworkClientSendPostRequestAsync: NetworkClientSendPostRequestAsync,
|
|
PopTokenGenerateCnf: PopTokenGenerateCnf,
|
|
RefreshTokenClientAcquireToken: RefreshTokenClientAcquireToken,
|
|
RefreshTokenClientAcquireTokenWithCachedRefreshToken: RefreshTokenClientAcquireTokenWithCachedRefreshToken,
|
|
RefreshTokenClientCreateTokenRequestBody: RefreshTokenClientCreateTokenRequestBody,
|
|
RefreshTokenClientExecutePostToTokenEndpoint: RefreshTokenClientExecutePostToTokenEndpoint,
|
|
RefreshTokenClientExecuteTokenRequest: RefreshTokenClientExecuteTokenRequest,
|
|
RegionDiscoveryDetectRegion: RegionDiscoveryDetectRegion,
|
|
RegionDiscoveryGetCurrentVersion: RegionDiscoveryGetCurrentVersion,
|
|
RegionDiscoveryGetRegionFromIMDS: RegionDiscoveryGetRegionFromIMDS,
|
|
SetUserData: SetUserData,
|
|
SilentFlowClientGenerateResultFromCacheRecord: SilentFlowClientGenerateResultFromCacheRecord,
|
|
UpdateTokenEndpointAuthority: UpdateTokenEndpointAuthority
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Wraps a function with a performance measurement.
|
|
* Usage: invoke(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
|
|
* @param callback
|
|
* @param eventName
|
|
* @param logger
|
|
* @param telemetryClient
|
|
* @param correlationId
|
|
* @returns
|
|
* @internal
|
|
*/
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
const invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
|
|
return (...args) => {
|
|
logger.trace(`Executing function '${eventName}'`, correlationId);
|
|
const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
|
|
if (correlationId) {
|
|
// Track number of times this API is called in a single request
|
|
telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
|
|
}
|
|
try {
|
|
const result = callback(...args);
|
|
inProgressEvent.end({
|
|
success: true,
|
|
});
|
|
logger.trace(`Returning result from '${eventName}'`, correlationId);
|
|
return result;
|
|
}
|
|
catch (e) {
|
|
logger.trace(`Error occurred in '${eventName}'`, correlationId);
|
|
try {
|
|
logger.trace(JSON.stringify(e), correlationId);
|
|
}
|
|
catch (e) {
|
|
logger.trace("Unable to print error message.", correlationId);
|
|
}
|
|
inProgressEvent.end({
|
|
success: false,
|
|
}, e);
|
|
throw e;
|
|
}
|
|
};
|
|
};
|
|
/**
|
|
* Wraps an async function with a performance measurement.
|
|
* Usage: invokeAsync(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
|
|
* @param callback
|
|
* @param eventName
|
|
* @param logger
|
|
* @param telemetryClient
|
|
* @param correlationId
|
|
* @returns
|
|
* @internal
|
|
*
|
|
*/
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
|
|
return (...args) => {
|
|
logger.trace(`Executing function '${eventName}'`, correlationId);
|
|
const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
|
|
if (correlationId) {
|
|
// Track number of times this API is called in a single request
|
|
telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
|
|
}
|
|
return callback(...args)
|
|
.then((response) => {
|
|
logger.trace(`Returning result from '${eventName}'`, correlationId);
|
|
inProgressEvent.end({
|
|
success: true,
|
|
});
|
|
return response;
|
|
})
|
|
.catch((e) => {
|
|
logger.trace(`Error occurred in '${eventName}'`, correlationId);
|
|
try {
|
|
logger.trace(JSON.stringify(e), correlationId);
|
|
}
|
|
catch (e) {
|
|
logger.trace("Unable to print error message.", correlationId);
|
|
}
|
|
inProgressEvent.end({
|
|
success: false,
|
|
}, e);
|
|
throw e;
|
|
});
|
|
};
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
class RegionDiscovery {
|
|
constructor(networkInterface, logger, performanceClient, correlationId) {
|
|
this.networkInterface = networkInterface;
|
|
this.logger = logger;
|
|
this.performanceClient = performanceClient;
|
|
this.correlationId = correlationId;
|
|
}
|
|
/**
|
|
* Detect the region from the application's environment.
|
|
*
|
|
* @returns Promise<string | null>
|
|
*/
|
|
async detectRegion(environmentRegion, regionDiscoveryMetadata) {
|
|
// Initialize auto detected region with the region from the envrionment
|
|
let autodetectedRegionName = environmentRegion;
|
|
// Check if a region was detected from the environment, if not, attempt to get the region from IMDS
|
|
if (!autodetectedRegionName) {
|
|
const options = RegionDiscovery.IMDS_OPTIONS;
|
|
try {
|
|
const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
|
|
if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
|
|
autodetectedRegionName = localIMDSVersionResponse.body;
|
|
regionDiscoveryMetadata.region_source =
|
|
RegionDiscoverySources.IMDS;
|
|
}
|
|
// If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
|
|
if (localIMDSVersionResponse.status ===
|
|
HTTP_BAD_REQUEST) {
|
|
const currentIMDSVersion = await invokeAsync(this.getCurrentVersion.bind(this), RegionDiscoveryGetCurrentVersion, this.logger, this.performanceClient, this.correlationId)(options);
|
|
if (!currentIMDSVersion) {
|
|
regionDiscoveryMetadata.region_source =
|
|
RegionDiscoverySources.FAILED_AUTO_DETECTION;
|
|
return null;
|
|
}
|
|
const currentIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(currentIMDSVersion, options);
|
|
if (currentIMDSVersionResponse.status ===
|
|
HTTP_SUCCESS) {
|
|
autodetectedRegionName =
|
|
currentIMDSVersionResponse.body;
|
|
regionDiscoveryMetadata.region_source =
|
|
RegionDiscoverySources.IMDS;
|
|
}
|
|
}
|
|
}
|
|
catch (e) {
|
|
regionDiscoveryMetadata.region_source =
|
|
RegionDiscoverySources.FAILED_AUTO_DETECTION;
|
|
return null;
|
|
}
|
|
}
|
|
else {
|
|
regionDiscoveryMetadata.region_source =
|
|
RegionDiscoverySources.ENVIRONMENT_VARIABLE;
|
|
}
|
|
// If no region was auto detected from the environment or from the IMDS endpoint, mark the attempt as a FAILED_AUTO_DETECTION
|
|
if (!autodetectedRegionName) {
|
|
regionDiscoveryMetadata.region_source =
|
|
RegionDiscoverySources.FAILED_AUTO_DETECTION;
|
|
}
|
|
return autodetectedRegionName || null;
|
|
}
|
|
/**
|
|
* Make the call to the IMDS endpoint
|
|
*
|
|
* @param imdsEndpointUrl
|
|
* @returns Promise<NetworkResponse<string>>
|
|
*/
|
|
async getRegionFromIMDS(version, options) {
|
|
return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
|
|
}
|
|
/**
|
|
* Get the most recent version of the IMDS endpoint available
|
|
*
|
|
* @returns Promise<string | null>
|
|
*/
|
|
async getCurrentVersion(options) {
|
|
try {
|
|
const response = await this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?format=json`, options);
|
|
// When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
|
|
if (response.status === HTTP_BAD_REQUEST &&
|
|
response.body &&
|
|
response.body["newest-versions"] &&
|
|
response.body["newest-versions"].length > 0) {
|
|
return response.body["newest-versions"][0];
|
|
}
|
|
return null;
|
|
}
|
|
catch (e) {
|
|
return null;
|
|
}
|
|
}
|
|
}
|
|
// Options for the IMDS endpoint request
|
|
RegionDiscovery.IMDS_OPTIONS = {
|
|
headers: {
|
|
Metadata: "true",
|
|
},
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Utility functions for managing date and time operations.
|
|
*/
|
|
/**
|
|
* return the current time in Unix time (seconds).
|
|
*/
|
|
function nowSeconds() {
|
|
// Date.getTime() returns in milliseconds.
|
|
return Math.round(new Date().getTime() / 1000.0);
|
|
}
|
|
/**
|
|
* Converts JS Date object to seconds
|
|
* @param date Date
|
|
*/
|
|
function toSecondsFromDate(date) {
|
|
// Convert date to seconds
|
|
return date.getTime() / 1000;
|
|
}
|
|
/**
|
|
* Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
|
|
* @param seconds
|
|
*/
|
|
function toDateFromSeconds(seconds) {
|
|
if (seconds) {
|
|
return new Date(Number(seconds) * 1000);
|
|
}
|
|
return new Date();
|
|
}
|
|
/**
|
|
* check if a token is expired based on given UTC time in seconds.
|
|
* @param expiresOn
|
|
*/
|
|
function isTokenExpired(expiresOn, offset) {
|
|
// check for access token expiry
|
|
const expirationSec = Number(expiresOn) || 0;
|
|
const offsetCurrentTimeSec = nowSeconds() + offset;
|
|
// If current time + offset is greater than token expiration time, then token is expired.
|
|
return offsetCurrentTimeSec > expirationSec;
|
|
}
|
|
/**
|
|
* Checks if a cache entry is expired based on the last updated time and cache retention days.
|
|
* @param lastUpdatedAt
|
|
* @param cacheRetentionDays
|
|
* @returns
|
|
*/
|
|
function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
|
|
const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
|
|
return Date.now() > cacheExpirationTimestamp;
|
|
}
|
|
/**
|
|
* If the current time is earlier than the time that a token was cached at, we must discard the token
|
|
* i.e. The system clock was turned back after acquiring the cached token
|
|
* @param cachedAt
|
|
* @param offset
|
|
*/
|
|
function wasClockTurnedBack(cachedAt) {
|
|
const cachedAtSec = Number(cachedAt);
|
|
return cachedAtSec > nowSeconds();
|
|
}
|
|
/**
|
|
* Waits for t number of milliseconds
|
|
* @param t number
|
|
* @param value T
|
|
*/
|
|
function delay(t, value) {
|
|
return new Promise((resolve) => setTimeout(() => resolve(value), t));
|
|
}
|
|
|
|
var TimeUtils = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
delay: delay,
|
|
isCacheExpired: isCacheExpired,
|
|
isTokenExpired: isTokenExpired,
|
|
nowSeconds: nowSeconds,
|
|
toDateFromSeconds: toDateFromSeconds,
|
|
toSecondsFromDate: toSecondsFromDate,
|
|
wasClockTurnedBack: wasClockTurnedBack
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Create IdTokenEntity
|
|
* @param homeAccountId
|
|
* @param authenticationResult
|
|
* @param clientId
|
|
* @param authority
|
|
*/
|
|
function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
|
|
const idTokenEntity = {
|
|
credentialType: CredentialType.ID_TOKEN,
|
|
homeAccountId: homeAccountId,
|
|
environment: environment,
|
|
clientId: clientId,
|
|
secret: idToken,
|
|
realm: tenantId,
|
|
lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
|
|
};
|
|
return idTokenEntity;
|
|
}
|
|
/**
|
|
* Create AccessTokenEntity
|
|
* @param homeAccountId
|
|
* @param environment
|
|
* @param accessToken
|
|
* @param clientId
|
|
* @param tenantId
|
|
* @param scopes
|
|
* @param expiresOn
|
|
* @param extExpiresOn
|
|
*/
|
|
function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
|
|
const atEntity = {
|
|
homeAccountId: homeAccountId,
|
|
credentialType: CredentialType.ACCESS_TOKEN,
|
|
secret: accessToken,
|
|
cachedAt: nowSeconds().toString(),
|
|
expiresOn: expiresOn.toString(),
|
|
extendedExpiresOn: extExpiresOn.toString(),
|
|
environment: environment,
|
|
clientId: clientId,
|
|
realm: tenantId,
|
|
target: scopes,
|
|
tokenType: tokenType || AuthenticationScheme.BEARER,
|
|
lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
|
|
};
|
|
if (userAssertionHash) {
|
|
atEntity.userAssertionHash = userAssertionHash;
|
|
}
|
|
if (refreshOn) {
|
|
atEntity.refreshOn = refreshOn.toString();
|
|
}
|
|
/*
|
|
* Create Access Token With Auth Scheme instead of regular access token
|
|
* Cast to lower to handle "bearer" from ADFS
|
|
*/
|
|
if (atEntity.tokenType?.toLowerCase() !==
|
|
AuthenticationScheme.BEARER.toLowerCase()) {
|
|
atEntity.credentialType =
|
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
|
|
switch (atEntity.tokenType) {
|
|
case AuthenticationScheme.POP:
|
|
// Make sure keyId is present and add it to credential
|
|
const tokenClaims = extractTokenClaims(accessToken, base64Decode);
|
|
if (!tokenClaims?.cnf?.kid) {
|
|
throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
|
|
}
|
|
atEntity.keyId = tokenClaims.cnf.kid;
|
|
break;
|
|
case AuthenticationScheme.SSH:
|
|
atEntity.keyId = keyId;
|
|
}
|
|
}
|
|
return atEntity;
|
|
}
|
|
/**
|
|
* Create RefreshTokenEntity
|
|
* @param homeAccountId
|
|
* @param authenticationResult
|
|
* @param clientId
|
|
* @param authority
|
|
*/
|
|
function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
|
|
const rtEntity = {
|
|
credentialType: CredentialType.REFRESH_TOKEN,
|
|
homeAccountId: homeAccountId,
|
|
environment: environment,
|
|
clientId: clientId,
|
|
secret: refreshToken,
|
|
lastUpdatedAt: Date.now().toString(),
|
|
};
|
|
if (userAssertionHash) {
|
|
rtEntity.userAssertionHash = userAssertionHash;
|
|
}
|
|
if (familyId) {
|
|
rtEntity.familyId = familyId;
|
|
}
|
|
if (expiresOn) {
|
|
rtEntity.expiresOn = expiresOn.toString();
|
|
}
|
|
return rtEntity;
|
|
}
|
|
function isCredentialEntity(entity) {
|
|
return (entity.hasOwnProperty("homeAccountId") &&
|
|
entity.hasOwnProperty("environment") &&
|
|
entity.hasOwnProperty("credentialType") &&
|
|
entity.hasOwnProperty("clientId") &&
|
|
entity.hasOwnProperty("secret"));
|
|
}
|
|
/**
|
|
* Validates an entity: checks for all expected params
|
|
* @param entity
|
|
*/
|
|
function isAccessTokenEntity(entity) {
|
|
if (!entity) {
|
|
return false;
|
|
}
|
|
return (isCredentialEntity(entity) &&
|
|
entity.hasOwnProperty("realm") &&
|
|
entity.hasOwnProperty("target") &&
|
|
(entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
|
|
entity["credentialType"] ===
|
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
|
|
}
|
|
/**
|
|
* Validates an entity: checks for all expected params
|
|
* @param entity
|
|
*/
|
|
function isIdTokenEntity(entity) {
|
|
if (!entity) {
|
|
return false;
|
|
}
|
|
return (isCredentialEntity(entity) &&
|
|
entity.hasOwnProperty("realm") &&
|
|
entity["credentialType"] === CredentialType.ID_TOKEN);
|
|
}
|
|
/**
|
|
* Validates an entity: checks for all expected params
|
|
* @param entity
|
|
*/
|
|
function isRefreshTokenEntity(entity) {
|
|
if (!entity) {
|
|
return false;
|
|
}
|
|
return (isCredentialEntity(entity) &&
|
|
entity["credentialType"] === CredentialType.REFRESH_TOKEN);
|
|
}
|
|
/**
|
|
* validates if a given cache entry is "Telemetry", parses <key,value>
|
|
* @param key
|
|
* @param entity
|
|
*/
|
|
function isServerTelemetryEntity(key, entity) {
|
|
const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
|
|
let validateEntity = true;
|
|
if (entity) {
|
|
validateEntity =
|
|
entity.hasOwnProperty("failedRequests") &&
|
|
entity.hasOwnProperty("errors") &&
|
|
entity.hasOwnProperty("cacheHits");
|
|
}
|
|
return validateKey && validateEntity;
|
|
}
|
|
/**
|
|
* validates if a given cache entry is "Throttling", parses <key,value>
|
|
* @param key
|
|
* @param entity
|
|
*/
|
|
function isThrottlingEntity(key, entity) {
|
|
let validateKey = false;
|
|
if (key) {
|
|
validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
|
|
}
|
|
let validateEntity = true;
|
|
if (entity) {
|
|
validateEntity = entity.hasOwnProperty("throttleTime");
|
|
}
|
|
return validateKey && validateEntity;
|
|
}
|
|
/**
|
|
* Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
|
|
*/
|
|
function generateAppMetadataKey({ environment, clientId, }) {
|
|
const appMetaDataKeyArray = [
|
|
APP_METADATA,
|
|
environment,
|
|
clientId,
|
|
];
|
|
return appMetaDataKeyArray
|
|
.join(CACHE_KEY_SEPARATOR)
|
|
.toLowerCase();
|
|
}
|
|
/*
|
|
* Validates an entity: checks for all expected params
|
|
* @param entity
|
|
*/
|
|
function isAppMetadataEntity(key, entity) {
|
|
if (!entity) {
|
|
return false;
|
|
}
|
|
return (key.indexOf(APP_METADATA) === 0 &&
|
|
entity.hasOwnProperty("clientId") &&
|
|
entity.hasOwnProperty("environment"));
|
|
}
|
|
/**
|
|
* Validates an entity: checks for all expected params
|
|
* @param entity
|
|
*/
|
|
function isAuthorityMetadataEntity(key, entity) {
|
|
if (!entity) {
|
|
return false;
|
|
}
|
|
return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
|
|
entity.hasOwnProperty("aliases") &&
|
|
entity.hasOwnProperty("preferred_cache") &&
|
|
entity.hasOwnProperty("preferred_network") &&
|
|
entity.hasOwnProperty("canonical_authority") &&
|
|
entity.hasOwnProperty("authorization_endpoint") &&
|
|
entity.hasOwnProperty("token_endpoint") &&
|
|
entity.hasOwnProperty("issuer") &&
|
|
entity.hasOwnProperty("aliasesFromNetwork") &&
|
|
entity.hasOwnProperty("endpointsFromNetwork") &&
|
|
entity.hasOwnProperty("expiresAt") &&
|
|
entity.hasOwnProperty("jwks_uri"));
|
|
}
|
|
/**
|
|
* Reset the exiresAt value
|
|
*/
|
|
function generateAuthorityMetadataExpiresAt() {
|
|
return (nowSeconds() +
|
|
AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
|
|
}
|
|
function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
|
|
authorityMetadata.authorization_endpoint =
|
|
updatedValues.authorization_endpoint;
|
|
authorityMetadata.token_endpoint = updatedValues.token_endpoint;
|
|
authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
|
|
authorityMetadata.issuer = updatedValues.issuer;
|
|
authorityMetadata.endpointsFromNetwork = fromNetwork;
|
|
authorityMetadata.jwks_uri = updatedValues.jwks_uri;
|
|
}
|
|
function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
|
|
authorityMetadata.aliases = updatedValues.aliases;
|
|
authorityMetadata.preferred_cache = updatedValues.preferred_cache;
|
|
authorityMetadata.preferred_network = updatedValues.preferred_network;
|
|
authorityMetadata.aliasesFromNetwork = fromNetwork;
|
|
}
|
|
/**
|
|
* Returns whether or not the data needs to be refreshed
|
|
*/
|
|
function isAuthorityMetadataExpired(metadata) {
|
|
return metadata.expiresAt <= nowSeconds();
|
|
}
|
|
|
|
var CacheHelpers = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
createAccessTokenEntity: createAccessTokenEntity,
|
|
createIdTokenEntity: createIdTokenEntity,
|
|
createRefreshTokenEntity: createRefreshTokenEntity,
|
|
generateAppMetadataKey: generateAppMetadataKey,
|
|
generateAuthorityMetadataExpiresAt: generateAuthorityMetadataExpiresAt,
|
|
isAccessTokenEntity: isAccessTokenEntity,
|
|
isAppMetadataEntity: isAppMetadataEntity,
|
|
isAuthorityMetadataEntity: isAuthorityMetadataEntity,
|
|
isAuthorityMetadataExpired: isAuthorityMetadataExpired,
|
|
isCredentialEntity: isCredentialEntity,
|
|
isIdTokenEntity: isIdTokenEntity,
|
|
isRefreshTokenEntity: isRefreshTokenEntity,
|
|
isServerTelemetryEntity: isServerTelemetryEntity,
|
|
isThrottlingEntity: isThrottlingEntity,
|
|
updateAuthorityEndpointMetadata: updateAuthorityEndpointMetadata,
|
|
updateCloudDiscoveryMetadata: updateCloudDiscoveryMetadata
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
|
|
* endpoint. It will store the pertinent config data in this object for use during token calls.
|
|
* @internal
|
|
*/
|
|
class Authority {
|
|
constructor(authority, networkInterface, cacheManager, authorityOptions, logger, correlationId, performanceClient, managedIdentity) {
|
|
this.canonicalAuthority = authority;
|
|
this._canonicalAuthority.validateAsUri();
|
|
this.networkInterface = networkInterface;
|
|
this.cacheManager = cacheManager;
|
|
this.authorityOptions = authorityOptions;
|
|
this.regionDiscoveryMetadata = {
|
|
region_used: undefined,
|
|
region_source: undefined,
|
|
region_outcome: undefined,
|
|
};
|
|
this.logger = logger;
|
|
this.performanceClient = performanceClient;
|
|
this.correlationId = correlationId;
|
|
this.managedIdentity = managedIdentity || false;
|
|
this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
|
|
}
|
|
/**
|
|
* Get {@link AuthorityType}
|
|
* @param authorityUri {@link IUri}
|
|
* @private
|
|
*/
|
|
getAuthorityType(authorityUri) {
|
|
// CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
|
|
if (authorityUri.HostNameAndPort.endsWith(CIAM_AUTH_URL)) {
|
|
return AuthorityType.Ciam;
|
|
}
|
|
const pathSegments = authorityUri.PathSegments;
|
|
if (pathSegments.length) {
|
|
switch (pathSegments[0].toLowerCase()) {
|
|
case ADFS:
|
|
return AuthorityType.Adfs;
|
|
case DSTS:
|
|
return AuthorityType.Dsts;
|
|
}
|
|
}
|
|
return AuthorityType.Default;
|
|
}
|
|
// See above for AuthorityType
|
|
get authorityType() {
|
|
return this.getAuthorityType(this.canonicalAuthorityUrlComponents);
|
|
}
|
|
/**
|
|
* ProtocolMode enum representing the way endpoints are constructed.
|
|
*/
|
|
get protocolMode() {
|
|
return this.authorityOptions.protocolMode;
|
|
}
|
|
/**
|
|
* Returns authorityOptions which can be used to reinstantiate a new authority instance
|
|
*/
|
|
get options() {
|
|
return this.authorityOptions;
|
|
}
|
|
/**
|
|
* A URL that is the authority set by the developer
|
|
*/
|
|
get canonicalAuthority() {
|
|
return this._canonicalAuthority.urlString;
|
|
}
|
|
/**
|
|
* Sets canonical authority.
|
|
*/
|
|
set canonicalAuthority(url) {
|
|
this._canonicalAuthority = new UrlString(url);
|
|
this._canonicalAuthority.validateAsUri();
|
|
this._canonicalAuthorityUrlComponents = null;
|
|
}
|
|
/**
|
|
* Get authority components.
|
|
*/
|
|
get canonicalAuthorityUrlComponents() {
|
|
if (!this._canonicalAuthorityUrlComponents) {
|
|
this._canonicalAuthorityUrlComponents =
|
|
this._canonicalAuthority.getUrlComponents();
|
|
}
|
|
return this._canonicalAuthorityUrlComponents;
|
|
}
|
|
/**
|
|
* Get hostname and port i.e. login.microsoftonline.com
|
|
*/
|
|
get hostnameAndPort() {
|
|
return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase();
|
|
}
|
|
/**
|
|
* Get tenant for authority.
|
|
*/
|
|
get tenant() {
|
|
return this.canonicalAuthorityUrlComponents.PathSegments[0];
|
|
}
|
|
/**
|
|
* OAuth /authorize endpoint for requests
|
|
*/
|
|
get authorizationEndpoint() {
|
|
if (this.discoveryComplete()) {
|
|
return this.replacePath(this.metadata.authorization_endpoint);
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
/**
|
|
* OAuth /token endpoint for requests
|
|
*/
|
|
get tokenEndpoint() {
|
|
if (this.discoveryComplete()) {
|
|
return this.replacePath(this.metadata.token_endpoint);
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
get deviceCodeEndpoint() {
|
|
if (this.discoveryComplete()) {
|
|
return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
/**
|
|
* OAuth logout endpoint for requests
|
|
*/
|
|
get endSessionEndpoint() {
|
|
if (this.discoveryComplete()) {
|
|
// ROPC policies may not have end_session_endpoint set
|
|
if (!this.metadata.end_session_endpoint) {
|
|
throw createClientAuthError(endSessionEndpointNotSupported);
|
|
}
|
|
return this.replacePath(this.metadata.end_session_endpoint);
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
/**
|
|
* OAuth issuer for requests
|
|
*/
|
|
get selfSignedJwtAudience() {
|
|
if (this.discoveryComplete()) {
|
|
return this.replacePath(this.metadata.issuer);
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
/**
|
|
* Jwks_uri for token signing keys
|
|
*/
|
|
get jwksUri() {
|
|
if (this.discoveryComplete()) {
|
|
return this.replacePath(this.metadata.jwks_uri);
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
/**
|
|
* Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
|
|
* @param authorityUri {@link IUri}
|
|
* @private
|
|
*/
|
|
canReplaceTenant(authorityUri) {
|
|
return (authorityUri.PathSegments.length === 1 &&
|
|
!Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
|
|
this.getAuthorityType(authorityUri) === AuthorityType.Default &&
|
|
this.protocolMode !== ProtocolMode.OIDC);
|
|
}
|
|
/**
|
|
* Replaces tenant in url path with current tenant. Defaults to common.
|
|
* @param urlString
|
|
*/
|
|
replaceTenant(urlString) {
|
|
return urlString.replace(/{tenant}|{tenantid}/g, this.tenant);
|
|
}
|
|
/**
|
|
* Replaces path such as tenant or policy with the current tenant or policy.
|
|
* @param urlString
|
|
*/
|
|
replacePath(urlString) {
|
|
let endpoint = urlString;
|
|
const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
|
|
const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
|
|
const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
|
|
const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
|
|
currentAuthorityParts.forEach((currentPart, index) => {
|
|
let cachedPart = cachedAuthorityParts[index];
|
|
if (index === 0 &&
|
|
this.canReplaceTenant(cachedAuthorityUrlComponents)) {
|
|
const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
|
|
/**
|
|
* Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
|
|
* by comparing its first path segment to the corresponding authorization endpoint path segment, which is
|
|
* always resolved with tenant id by OIDC.
|
|
*/
|
|
if (cachedPart !== tenantId) {
|
|
this.logger.verbose(`Replacing tenant domain name '${cachedPart}' with id '${tenantId}'`, this.correlationId);
|
|
cachedPart = tenantId;
|
|
}
|
|
}
|
|
if (currentPart !== cachedPart) {
|
|
endpoint = endpoint.replace(`/${cachedPart}/`, `/${currentPart}/`);
|
|
}
|
|
});
|
|
return this.replaceTenant(endpoint);
|
|
}
|
|
/**
|
|
* The default open id configuration endpoint for any canonical authority.
|
|
*/
|
|
get defaultOpenIdConfigurationEndpoint() {
|
|
const canonicalAuthorityHost = this.hostnameAndPort;
|
|
if (this.canonicalAuthority.endsWith("v2.0/") ||
|
|
this.authorityType === AuthorityType.Adfs ||
|
|
(this.protocolMode === ProtocolMode.OIDC &&
|
|
!this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost))) {
|
|
return `${this.canonicalAuthority}.well-known/openid-configuration`;
|
|
}
|
|
return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
|
|
}
|
|
/**
|
|
* Boolean that returns whether or not tenant discovery has been completed.
|
|
*/
|
|
discoveryComplete() {
|
|
return !!this.metadata;
|
|
}
|
|
/**
|
|
* Perform endpoint discovery to discover aliases, preferred_cache, preferred_network
|
|
* and the /authorize, /token and logout endpoints.
|
|
*/
|
|
async resolveEndpointsAsync() {
|
|
const metadataEntity = this.getCurrentMetadataEntity();
|
|
const cloudDiscoverySource = await invokeAsync(this.updateCloudDiscoveryMetadata.bind(this), AuthorityUpdateCloudDiscoveryMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
|
|
this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);
|
|
const endpointSource = await invokeAsync(this.updateEndpointMetadata.bind(this), AuthorityUpdateEndpointMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
|
|
this.updateCachedMetadata(metadataEntity, cloudDiscoverySource, {
|
|
source: endpointSource,
|
|
});
|
|
this.performanceClient?.addFields({
|
|
cloudDiscoverySource: cloudDiscoverySource,
|
|
authorityEndpointSource: endpointSource,
|
|
}, this.correlationId);
|
|
}
|
|
/**
|
|
* Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
|
|
* from the configured canonical authority
|
|
* @returns
|
|
*/
|
|
getCurrentMetadataEntity() {
|
|
let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort, this.correlationId);
|
|
if (!metadataEntity) {
|
|
metadataEntity = {
|
|
aliases: [],
|
|
preferred_cache: this.hostnameAndPort,
|
|
preferred_network: this.hostnameAndPort,
|
|
canonical_authority: this.canonicalAuthority,
|
|
authorization_endpoint: "",
|
|
token_endpoint: "",
|
|
end_session_endpoint: "",
|
|
issuer: "",
|
|
aliasesFromNetwork: false,
|
|
endpointsFromNetwork: false,
|
|
expiresAt: generateAuthorityMetadataExpiresAt(),
|
|
jwks_uri: "",
|
|
};
|
|
}
|
|
return metadataEntity;
|
|
}
|
|
/**
|
|
* Updates cached metadata based on metadata source and sets the instance's metadata
|
|
* property to the same value
|
|
* @param metadataEntity
|
|
* @param cloudDiscoverySource
|
|
* @param endpointMetadataResult
|
|
*/
|
|
updateCachedMetadata(metadataEntity, cloudDiscoverySource, endpointMetadataResult) {
|
|
if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE &&
|
|
endpointMetadataResult?.source !==
|
|
AuthorityMetadataSource.CACHE) {
|
|
// Reset the expiration time unless both values came from a successful cache lookup
|
|
metadataEntity.expiresAt =
|
|
generateAuthorityMetadataExpiresAt();
|
|
metadataEntity.canonical_authority = this.canonicalAuthority;
|
|
}
|
|
const cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(metadataEntity.preferred_cache, this.correlationId);
|
|
this.cacheManager.setAuthorityMetadata(cacheKey, metadataEntity, this.correlationId);
|
|
this.metadata = metadataEntity;
|
|
}
|
|
/**
|
|
* Update AuthorityMetadataEntity with new endpoints and return where the information came from
|
|
* @param metadataEntity
|
|
*/
|
|
async updateEndpointMetadata(metadataEntity) {
|
|
const localMetadata = this.updateEndpointMetadataFromLocalSources(metadataEntity);
|
|
// Further update may be required for hardcoded metadata if regional metadata is preferred
|
|
if (localMetadata) {
|
|
if (localMetadata.source ===
|
|
AuthorityMetadataSource.HARDCODED_VALUES) {
|
|
// If the user prefers to use an azure region replace the global endpoints with regional information.
|
|
if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
|
|
if (localMetadata.metadata) {
|
|
const hardcodedMetadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(localMetadata.metadata);
|
|
updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
|
|
metadataEntity.canonical_authority =
|
|
this.canonicalAuthority;
|
|
}
|
|
}
|
|
}
|
|
return localMetadata.source;
|
|
}
|
|
// Get metadata from network if local sources aren't available
|
|
let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
|
|
if (metadata) {
|
|
// Validate the issuer returned by the OIDC discovery document.
|
|
this.validateIssuer(metadata.issuer);
|
|
// If the user prefers to use an azure region replace the global endpoints with regional information.
|
|
if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
|
|
metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
|
|
}
|
|
updateAuthorityEndpointMetadata(metadataEntity, metadata, true);
|
|
return AuthorityMetadataSource.NETWORK;
|
|
}
|
|
else {
|
|
// Metadata could not be obtained from the config, cache, network or hardcoded values
|
|
throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
|
|
}
|
|
}
|
|
/**
|
|
* Updates endpoint metadata from local sources and returns where the information was retrieved from and the metadata config
|
|
* response if the source is hardcoded metadata
|
|
* @param metadataEntity
|
|
* @returns
|
|
*/
|
|
updateEndpointMetadataFromLocalSources(metadataEntity) {
|
|
this.logger.verbose("Attempting to get endpoint metadata from authority configuration", this.correlationId);
|
|
const configMetadata = this.getEndpointMetadataFromConfig();
|
|
if (configMetadata) {
|
|
this.logger.verbose("Found endpoint metadata in authority configuration", this.correlationId);
|
|
updateAuthorityEndpointMetadata(metadataEntity, configMetadata, false);
|
|
return {
|
|
source: AuthorityMetadataSource.CONFIG,
|
|
};
|
|
}
|
|
this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.", this.correlationId);
|
|
const hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
|
|
if (hardcodedMetadata) {
|
|
updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
|
|
return {
|
|
source: AuthorityMetadataSource.HARDCODED_VALUES,
|
|
metadata: hardcodedMetadata,
|
|
};
|
|
}
|
|
else {
|
|
this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.", this.correlationId);
|
|
}
|
|
// Check cached metadata entity expiration status
|
|
const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
|
|
if (this.isAuthoritySameType(metadataEntity) &&
|
|
metadataEntity.endpointsFromNetwork &&
|
|
!metadataEntityExpired) {
|
|
// No need to update
|
|
this.logger.verbose("Found endpoint metadata in the cache.", "");
|
|
return { source: AuthorityMetadataSource.CACHE };
|
|
}
|
|
else if (metadataEntityExpired) {
|
|
this.logger.verbose("The metadata entity is expired.", "");
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Compares the number of url components after the domain to determine if the cached
|
|
* authority metadata can be used for the requested authority. Protects against same domain different
|
|
* authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
|
|
* @param metadataEntity
|
|
*/
|
|
isAuthoritySameType(metadataEntity) {
|
|
const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
|
|
const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
|
|
return (cachedParts.length ===
|
|
this.canonicalAuthorityUrlComponents.PathSegments.length);
|
|
}
|
|
/**
|
|
* Parse authorityMetadata config option
|
|
*/
|
|
getEndpointMetadataFromConfig() {
|
|
if (this.authorityOptions.authorityMetadata) {
|
|
try {
|
|
return JSON.parse(this.authorityOptions.authorityMetadata);
|
|
}
|
|
catch (e) {
|
|
throw createClientConfigurationError(invalidAuthorityMetadata);
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Gets OAuth endpoints from the given OpenID configuration endpoint.
|
|
*
|
|
* @param hasHardcodedMetadata boolean
|
|
*/
|
|
async getEndpointMetadataFromNetwork() {
|
|
const options = {};
|
|
/*
|
|
* TODO: Add a timeout if the authority exists in our library's
|
|
* hardcoded list of metadata
|
|
*/
|
|
const openIdConfigurationEndpoint = this.defaultOpenIdConfigurationEndpoint;
|
|
this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from '${openIdConfigurationEndpoint}'`, this.correlationId);
|
|
try {
|
|
const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
|
|
const isValidResponse = isOpenIdConfigResponse(response.body);
|
|
if (isValidResponse) {
|
|
return response.body;
|
|
}
|
|
else {
|
|
this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`, this.correlationId);
|
|
return null;
|
|
}
|
|
}
|
|
catch (e) {
|
|
this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: '${e}'`, this.correlationId);
|
|
return null;
|
|
}
|
|
}
|
|
/**
|
|
* Get OAuth endpoints for common authorities.
|
|
*/
|
|
getEndpointMetadataFromHardcodedValues() {
|
|
if (this.hostnameAndPort in EndpointMetadata) {
|
|
return EndpointMetadata[this.hostnameAndPort];
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Update the retrieved metadata with regional information.
|
|
* User selected Azure region will be used if configured.
|
|
*/
|
|
async updateMetadataWithRegionalInformation(metadata) {
|
|
const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
|
|
if (userConfiguredAzureRegion) {
|
|
if (userConfiguredAzureRegion !==
|
|
AZURE_REGION_AUTO_DISCOVER_FLAG) {
|
|
this.regionDiscoveryMetadata.region_outcome =
|
|
RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
|
|
this.regionDiscoveryMetadata.region_used =
|
|
userConfiguredAzureRegion;
|
|
return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
|
|
}
|
|
const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
|
|
?.environmentRegion, this.regionDiscoveryMetadata);
|
|
if (autodetectedRegionName) {
|
|
this.regionDiscoveryMetadata.region_outcome =
|
|
RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
|
|
this.regionDiscoveryMetadata.region_used =
|
|
autodetectedRegionName;
|
|
return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
|
|
}
|
|
this.regionDiscoveryMetadata.region_outcome =
|
|
RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
|
|
}
|
|
return metadata;
|
|
}
|
|
/**
|
|
* Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
|
|
* and returns where the information was retrieved from
|
|
* @param metadataEntity
|
|
* @returns AuthorityMetadataSource
|
|
*/
|
|
async updateCloudDiscoveryMetadata(metadataEntity) {
|
|
const localMetadataSource = this.updateCloudDiscoveryMetadataFromLocalSources(metadataEntity);
|
|
if (localMetadataSource) {
|
|
return localMetadataSource;
|
|
}
|
|
// Fallback to network as metadata source
|
|
const metadata = await invokeAsync(this.getCloudDiscoveryMetadataFromNetwork.bind(this), AuthorityGetCloudDiscoveryMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
|
|
if (metadata) {
|
|
updateCloudDiscoveryMetadata(metadataEntity, metadata, true);
|
|
return AuthorityMetadataSource.NETWORK;
|
|
}
|
|
// Metadata could not be obtained from the config, cache, network or hardcoded values
|
|
throw createClientConfigurationError(untrustedAuthority);
|
|
}
|
|
updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
|
|
this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
|
|
this.logger.verbosePii(`Known Authorities: '${this.authorityOptions.knownAuthorities ||
|
|
NOT_APPLICABLE}'`, this.correlationId);
|
|
this.logger.verbosePii(`Authority Metadata: '${this.authorityOptions.authorityMetadata ||
|
|
NOT_APPLICABLE}'`, this.correlationId);
|
|
this.logger.verbosePii(`Canonical Authority: '${metadataEntity.canonical_authority || NOT_APPLICABLE}'`, this.correlationId);
|
|
const metadata = this.getCloudDiscoveryMetadataFromConfig();
|
|
if (metadata) {
|
|
this.logger.verbose("Found cloud discovery metadata in authority configuration", this.correlationId);
|
|
updateCloudDiscoveryMetadata(metadataEntity, metadata, false);
|
|
return AuthorityMetadataSource.CONFIG;
|
|
}
|
|
// If the cached metadata came from config but that config was not passed to this instance, we must go to hardcoded values
|
|
this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.", this.correlationId);
|
|
const hardcodedMetadata = getCloudDiscoveryMetadataFromHardcodedValues(this.hostnameAndPort);
|
|
if (hardcodedMetadata) {
|
|
this.logger.verbose("Found cloud discovery metadata from hardcoded values.", this.correlationId);
|
|
updateCloudDiscoveryMetadata(metadataEntity, hardcodedMetadata, false);
|
|
return AuthorityMetadataSource.HARDCODED_VALUES;
|
|
}
|
|
this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.", this.correlationId);
|
|
const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
|
|
if (this.isAuthoritySameType(metadataEntity) &&
|
|
metadataEntity.aliasesFromNetwork &&
|
|
!metadataEntityExpired) {
|
|
this.logger.verbose("Found cloud discovery metadata in the cache.", "");
|
|
// No need to update
|
|
return AuthorityMetadataSource.CACHE;
|
|
}
|
|
else if (metadataEntityExpired) {
|
|
this.logger.verbose("The metadata entity is expired.", "");
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Parse cloudDiscoveryMetadata config or check knownAuthorities
|
|
*/
|
|
getCloudDiscoveryMetadataFromConfig() {
|
|
// CIAM does not support cloud discovery metadata
|
|
if (this.authorityType === AuthorityType.Ciam) {
|
|
this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host.", this.correlationId);
|
|
return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
|
|
}
|
|
// Check if network response was provided in config
|
|
if (this.authorityOptions.cloudDiscoveryMetadata) {
|
|
this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.", this.correlationId);
|
|
try {
|
|
this.logger.verbose("Attempting to parse the cloud discovery metadata.", this.correlationId);
|
|
const parsedResponse = JSON.parse(this.authorityOptions.cloudDiscoveryMetadata);
|
|
const metadata = getCloudDiscoveryMetadataFromNetworkResponse(parsedResponse.metadata, this.hostnameAndPort);
|
|
this.logger.verbose("Parsed the cloud discovery metadata.", "");
|
|
if (metadata) {
|
|
this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata.", this.correlationId);
|
|
return metadata;
|
|
}
|
|
else {
|
|
this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.", this.correlationId);
|
|
}
|
|
}
|
|
catch (e) {
|
|
this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.", this.correlationId);
|
|
throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
|
|
}
|
|
}
|
|
// If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
|
|
if (this.isInKnownAuthorities()) {
|
|
this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host.", this.correlationId);
|
|
return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
|
|
*
|
|
* @param hasHardcodedMetadata boolean
|
|
*/
|
|
async getCloudDiscoveryMetadataFromNetwork() {
|
|
const instanceDiscoveryEndpoint = `${AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`;
|
|
const options = {};
|
|
/*
|
|
* TODO: Add a timeout if the authority exists in our library's
|
|
* hardcoded list of metadata
|
|
*/
|
|
let match = null;
|
|
try {
|
|
const response = await this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options);
|
|
let typedResponseBody;
|
|
let metadata;
|
|
if (isCloudInstanceDiscoveryResponse(response.body)) {
|
|
typedResponseBody =
|
|
response.body;
|
|
metadata = typedResponseBody.metadata;
|
|
this.logger.verbosePii(`tenant_discovery_endpoint is: '${typedResponseBody.tenant_discovery_endpoint}'`, this.correlationId);
|
|
}
|
|
else if (isCloudInstanceDiscoveryErrorResponse(response.body)) {
|
|
this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: '${response.status}'`, this.correlationId);
|
|
typedResponseBody =
|
|
response.body;
|
|
if (typedResponseBody.error === INVALID_INSTANCE) {
|
|
this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance.", this.correlationId);
|
|
return null;
|
|
}
|
|
this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is '${typedResponseBody.error}'`, this.correlationId);
|
|
this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is '${typedResponseBody.error_description}'`, this.correlationId);
|
|
this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network, correlationId) to []", this.correlationId);
|
|
metadata = [];
|
|
}
|
|
else {
|
|
this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse", this.correlationId);
|
|
return null;
|
|
}
|
|
this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
|
|
match = getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
|
|
}
|
|
catch (error) {
|
|
if (error instanceof AuthError) {
|
|
this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata.\nError: '${error.errorCode}'\nError Description: '${error.errorMessage}'`, this.correlationId);
|
|
}
|
|
else {
|
|
const typedError = error;
|
|
this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata.\nError: '${typedError.name}'\nError Description: '${typedError.message}'`, this.correlationId);
|
|
}
|
|
return null;
|
|
}
|
|
// Custom Domain scenario, host is trusted because Instance Discovery call succeeded
|
|
if (!match) {
|
|
this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
|
|
this.logger.verbose("Creating custom Authority for custom domain scenario.", this.correlationId);
|
|
match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
|
|
}
|
|
return match;
|
|
}
|
|
/**
|
|
* Helper function to determine if this host is included in the knownAuthorities config option
|
|
*/
|
|
isInKnownAuthorities() {
|
|
const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
|
|
return (authority &&
|
|
UrlString.getDomainFromUrl(authority).toLowerCase() ===
|
|
this.hostnameAndPort);
|
|
});
|
|
return matches.length > 0;
|
|
}
|
|
/**
|
|
* helper function to populate the authority based on azureCloudOptions
|
|
* @param authorityString
|
|
* @param azureCloudOptions
|
|
*/
|
|
static generateAuthority(authorityString, azureCloudOptions) {
|
|
let authorityAzureCloudInstance;
|
|
if (azureCloudOptions &&
|
|
azureCloudOptions.azureCloudInstance !== AzureCloudInstance.None) {
|
|
const tenant = azureCloudOptions.tenant
|
|
? azureCloudOptions.tenant
|
|
: DEFAULT_COMMON_TENANT;
|
|
authorityAzureCloudInstance = `${azureCloudOptions.azureCloudInstance}/${tenant}/`;
|
|
}
|
|
return authorityAzureCloudInstance
|
|
? authorityAzureCloudInstance
|
|
: authorityString;
|
|
}
|
|
/**
|
|
* Creates cloud discovery metadata object from a given host
|
|
* @param host
|
|
*/
|
|
static createCloudDiscoveryMetadataFromHost(host) {
|
|
return {
|
|
preferred_network: host,
|
|
preferred_cache: host,
|
|
aliases: [host],
|
|
};
|
|
}
|
|
/**
|
|
* helper function to generate environment from authority object
|
|
*/
|
|
getPreferredCache() {
|
|
if (this.managedIdentity) {
|
|
return DEFAULT_AUTHORITY_HOST;
|
|
}
|
|
else if (this.discoveryComplete()) {
|
|
return this.metadata.preferred_cache;
|
|
}
|
|
else {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
/**
|
|
* Returns whether or not the provided host is an alias of this authority instance
|
|
* @param host
|
|
*/
|
|
isAlias(host) {
|
|
return this.metadata.aliases.indexOf(host) > -1;
|
|
}
|
|
/**
|
|
* Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
|
|
* @param host
|
|
*/
|
|
isAliasOfKnownMicrosoftAuthority(host) {
|
|
return InstanceDiscoveryMetadataAliases.has(host);
|
|
}
|
|
/**
|
|
* Validates the `issuer` returned by an OIDC discovery document against
|
|
* this authority, per
|
|
* https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
|
|
*
|
|
* The issuer is accepted when ANY of the following holds:
|
|
* 1. The issuer scheme + host + port match the authority's (path may
|
|
* differ). Applies to all authorities.
|
|
* 2. The authority is a Microsoft cloud authority (public, sovereign,
|
|
* or CIAM), the issuer is HTTPS, and the issuer host is in the known
|
|
* Microsoft authority host set.
|
|
* 3. Same as (2), but the issuer host is a single-label regional variant
|
|
* of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
|
|
* 4. Same as (2), but the issuer host matches the CIAM tenant pattern
|
|
* `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
|
|
* path.
|
|
*
|
|
* @param issuer The `issuer` value returned in the OIDC discovery document.
|
|
* @throws ClientConfigurationError("issuer_validation_failed") on failure.
|
|
*/
|
|
validateIssuer(issuer) {
|
|
if (!issuer) {
|
|
throw createClientConfigurationError(issuerValidationFailed);
|
|
}
|
|
// Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
|
|
let issuerUrl;
|
|
try {
|
|
issuerUrl = new URL(issuer);
|
|
}
|
|
catch {
|
|
throw createClientConfigurationError(issuerValidationFailed);
|
|
}
|
|
const issuerScheme = issuerUrl.protocol;
|
|
const issuerHost = issuerUrl.host;
|
|
const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
|
|
const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
|
|
// Rule 1: Same scheme and host
|
|
const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
|
|
// Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
|
|
const matchesKnownMicrosoftHost = issuerScheme === "https:" &&
|
|
this.isAliasOfKnownMicrosoftAuthority(issuerHost);
|
|
/*
|
|
* Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
|
|
* (HTTPS only). E.g. westus2.login.microsoft.com
|
|
*/
|
|
const matchesRegionalMicrosoftHost = issuerScheme === "https:" &&
|
|
this.matchesRegionalMicrosoftHost(issuerHost);
|
|
/*
|
|
* Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
|
|
* have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
|
|
*/
|
|
const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
|
|
// Each rule is an independent boolean; the issuer is valid if ANY rule matches.
|
|
if (matchesAuthorityOrigin ||
|
|
matchesKnownMicrosoftHost ||
|
|
matchesRegionalMicrosoftHost ||
|
|
matchesCiamTenantPattern) {
|
|
return;
|
|
}
|
|
// issuer validation fails if none of the above rules are satisfied
|
|
throw createClientConfigurationError(issuerValidationFailed);
|
|
}
|
|
/**
|
|
* Rule 1: The issuer scheme + host (and port) match the authority's. Path
|
|
* may differ. Applies to all authorities.
|
|
*/
|
|
matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
|
|
return issuerScheme === authorityScheme && issuerHost === authorityHost;
|
|
}
|
|
/**
|
|
* Rule 3: The issuer host is a regional variant
|
|
* (`{region}.{host}`) of a known Microsoft authority host.
|
|
* E.g. `westus2.login.microsoft.com`.
|
|
*/
|
|
matchesRegionalMicrosoftHost(issuerHost) {
|
|
const firstDot = issuerHost.indexOf(".");
|
|
if (firstDot > 0 && firstDot < issuerHost.length - 1) {
|
|
const hostWithoutRegion = issuerHost.substring(firstDot + 1);
|
|
return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
|
|
}
|
|
return false;
|
|
}
|
|
/**
|
|
* Rule 4: The issuer matches one of the well-known CIAM tenant patterns
|
|
* (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
|
|
*
|
|
* The bare tenant name is extracted from the authority's first path segment
|
|
* when available (stripping the `.onmicrosoft.com` suffix that
|
|
* `transformCIAMAuthority` adds), or otherwise from the leftmost label of
|
|
* the authority host (to support CIAM custom domain scenarios).
|
|
*
|
|
* Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
|
|
* because the OIDC issuer may use either form depending on the authority URL
|
|
* that was used to trigger discovery.
|
|
*/
|
|
matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
|
|
/*
|
|
* authorityPathSegments[0] is the first path segment of the *authority
|
|
* URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
|
|
* Additional CIAM issuer path segments such as "/v2.0" are part of the
|
|
* issuer string, not the authority URL's PathSegments.
|
|
*/
|
|
const pathSegment = authorityPathSegments[0];
|
|
/*
|
|
* Extract the bare tenant name: strip the .onmicrosoft.com suffix when
|
|
* present (introduced by transformCIAMAuthority), or fall back to the
|
|
* first label of the authority hostname for non-transformed/custom-domain
|
|
* CIAM authorities.
|
|
*/
|
|
const tenantName = pathSegment
|
|
? pathSegment.endsWith(AAD_TENANT_DOMAIN_SUFFIX)
|
|
? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length)
|
|
: pathSegment
|
|
: authorityHost.split(".")[0];
|
|
if (!tenantName) {
|
|
return false;
|
|
}
|
|
const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
|
|
const validCiamPatterns = [
|
|
ciamBaseURL,
|
|
`${ciamBaseURL}/${tenantName}`,
|
|
`${ciamBaseURL}/${tenantName}/v2.0`,
|
|
`${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
|
|
`${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
|
|
];
|
|
/*
|
|
* Compose the canonical issuer string from URL components and strip any
|
|
* trailing slashes from the path so it can be compared to the pattern set.
|
|
*/
|
|
const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
|
|
const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
|
|
return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
|
|
}
|
|
/**
|
|
* Checks whether the provided host is that of a public cloud authority
|
|
*
|
|
* @param authority string
|
|
* @returns bool
|
|
*/
|
|
static isPublicCloudAuthority(host) {
|
|
return KNOWN_PUBLIC_CLOUDS.indexOf(host) >= 0;
|
|
}
|
|
/**
|
|
* Rebuild the authority string with the region
|
|
*
|
|
* @param host string
|
|
* @param region string
|
|
*/
|
|
static buildRegionalAuthorityString(host, region, queryString) {
|
|
// Create and validate a Url string object with the initial authority string
|
|
const authorityUrlInstance = new UrlString(host);
|
|
authorityUrlInstance.validateAsUri();
|
|
const authorityUrlParts = authorityUrlInstance.getUrlComponents();
|
|
let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
|
|
if (this.isPublicCloudAuthority(authorityUrlParts.HostNameAndPort)) {
|
|
hostNameAndPort = `${region}.${REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`;
|
|
}
|
|
// Include the query string portion of the url
|
|
const url = UrlString.constructAuthorityUriFromObject({
|
|
...authorityUrlInstance.getUrlComponents(),
|
|
HostNameAndPort: hostNameAndPort,
|
|
}).urlString;
|
|
// Add the query string if a query string was provided
|
|
if (queryString)
|
|
return `${url}?${queryString}`;
|
|
return url;
|
|
}
|
|
/**
|
|
* Replace the endpoints in the metadata object with their regional equivalents.
|
|
*
|
|
* @param metadata OpenIdConfigResponse
|
|
* @param azureRegion string
|
|
*/
|
|
static replaceWithRegionalInformation(metadata, azureRegion) {
|
|
const regionalMetadata = { ...metadata };
|
|
regionalMetadata.authorization_endpoint =
|
|
Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
|
|
regionalMetadata.token_endpoint =
|
|
Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
|
|
if (regionalMetadata.end_session_endpoint) {
|
|
regionalMetadata.end_session_endpoint =
|
|
Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
|
|
}
|
|
return regionalMetadata;
|
|
}
|
|
/**
|
|
* Transform CIAM_AUTHORIY as per the below rules:
|
|
* If no path segments found and it is a CIAM authority (hostname ends with .ciamlogin.com), then transform it
|
|
*
|
|
* NOTE: The transformation path should go away once STS supports CIAM with the format: `tenantIdorDomain.ciamlogin.com`
|
|
* `ciamlogin.com` can also change in the future and we should accommodate the same
|
|
*
|
|
* @param authority
|
|
*/
|
|
static transformCIAMAuthority(authority) {
|
|
let ciamAuthority = authority;
|
|
const authorityUrl = new UrlString(authority);
|
|
const authorityUrlComponents = authorityUrl.getUrlComponents();
|
|
// check if transformation is needed
|
|
if (authorityUrlComponents.PathSegments.length === 0 &&
|
|
authorityUrlComponents.HostNameAndPort.endsWith(CIAM_AUTH_URL)) {
|
|
const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
|
|
ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${AAD_TENANT_DOMAIN_SUFFIX}`;
|
|
}
|
|
return ciamAuthority;
|
|
}
|
|
}
|
|
// Reserved tenant domain names that will not be replaced with tenant id
|
|
Authority.reservedTenantDomains = new Set([
|
|
"{tenant}",
|
|
"{tenantid}",
|
|
AADAuthority.COMMON,
|
|
AADAuthority.CONSUMERS,
|
|
AADAuthority.ORGANIZATIONS,
|
|
]);
|
|
/**
|
|
* Extract tenantId from authority
|
|
*/
|
|
function getTenantFromAuthorityString(authority) {
|
|
const authorityUrl = new UrlString(authority);
|
|
const authorityUrlComponents = authorityUrl.getUrlComponents();
|
|
/**
|
|
* For credential matching purposes, tenantId is the last path segment of the authority URL:
|
|
* AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
|
|
* B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
|
|
* tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
|
|
*
|
|
* Note that we may not have any path segments in certain OIDC scenarios.
|
|
*/
|
|
const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0]?.toLowerCase();
|
|
switch (tenantId) {
|
|
case AADAuthority.COMMON:
|
|
case AADAuthority.ORGANIZATIONS:
|
|
case AADAuthority.CONSUMERS:
|
|
return undefined;
|
|
default:
|
|
return tenantId;
|
|
}
|
|
}
|
|
function formatAuthorityUri(authorityUri) {
|
|
return authorityUri.endsWith(FORWARD_SLASH)
|
|
? authorityUri
|
|
: `${authorityUri}${FORWARD_SLASH}`;
|
|
}
|
|
function buildStaticAuthorityOptions(authOptions) {
|
|
const rawCloudDiscoveryMetadata = authOptions.cloudDiscoveryMetadata;
|
|
let cloudDiscoveryMetadata = undefined;
|
|
if (rawCloudDiscoveryMetadata) {
|
|
try {
|
|
cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
|
|
}
|
|
catch (e) {
|
|
throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
|
|
}
|
|
}
|
|
return {
|
|
canonicalAuthority: authOptions.authority
|
|
? formatAuthorityUri(authOptions.authority)
|
|
: undefined,
|
|
knownAuthorities: authOptions.knownAuthorities,
|
|
cloudDiscoveryMetadata: cloudDiscoveryMetadata,
|
|
};
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Create an authority object of the correct type based on the url
|
|
* Performs basic authority validation - checks to see if the authority is of a valid type (i.e. aad, b2c, adfs)
|
|
*
|
|
* Also performs endpoint discovery.
|
|
*
|
|
* @param authorityUri
|
|
* @param networkClient
|
|
* @param cacheManager
|
|
* @param authorityOptions
|
|
* @param logger
|
|
* @param correlationId
|
|
* @param performanceClient
|
|
* @internal
|
|
*/
|
|
async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
|
|
const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
|
|
// Initialize authority and perform discovery endpoint check.
|
|
const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
|
|
try {
|
|
await invokeAsync(acquireTokenAuthority.resolveEndpointsAsync.bind(acquireTokenAuthority), AuthorityResolveEndpointsAsync, logger, performanceClient, correlationId)();
|
|
return acquireTokenAuthority;
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(endpointResolutionError);
|
|
}
|
|
}
|
|
|
|
var AuthorityFactory = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
createDiscoveredInstance: createDiscoveredInstance
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Canonicalizes a URL by making it lowercase and ensuring it ends with /
|
|
* Inlined version of UrlString.canonicalizeUri to avoid circular dependency
|
|
* @param url - URL to canonicalize
|
|
* @returns Canonicalized URL
|
|
*/
|
|
function canonicalizeUrl(url) {
|
|
if (!url) {
|
|
return url;
|
|
}
|
|
let lowerCaseUrl = url.toLowerCase();
|
|
if (StringUtils.endsWith(lowerCaseUrl, "?")) {
|
|
lowerCaseUrl = lowerCaseUrl.slice(0, -1);
|
|
}
|
|
else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
|
|
lowerCaseUrl = lowerCaseUrl.slice(0, -2);
|
|
}
|
|
if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
|
|
lowerCaseUrl += "/";
|
|
}
|
|
return lowerCaseUrl;
|
|
}
|
|
/**
|
|
* Parses hash string from given string. Returns empty string if no hash symbol is found.
|
|
* @param hashString
|
|
*/
|
|
function stripLeadingHashOrQuery(responseString) {
|
|
if (responseString.startsWith("#/")) {
|
|
return responseString.substring(2);
|
|
}
|
|
else if (responseString.startsWith("#") ||
|
|
responseString.startsWith("?")) {
|
|
return responseString.substring(1);
|
|
}
|
|
return responseString;
|
|
}
|
|
/**
|
|
* Returns URL hash as server auth code response object.
|
|
*/
|
|
function getDeserializedResponse(responseString) {
|
|
// Check if given hash is empty
|
|
if (!responseString || responseString.indexOf("=") < 0) {
|
|
return null;
|
|
}
|
|
try {
|
|
// Strip the # or ? symbol if present
|
|
const normalizedResponse = stripLeadingHashOrQuery(responseString);
|
|
// If # symbol was not present, above will return empty string, so give original hash value
|
|
const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
|
|
// Check for known response properties
|
|
if (deserializedHash.code ||
|
|
deserializedHash.ear_jwe ||
|
|
deserializedHash.error ||
|
|
deserializedHash.error_description ||
|
|
deserializedHash.state) {
|
|
return deserializedHash;
|
|
}
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(hashNotDeserialized);
|
|
}
|
|
return null;
|
|
}
|
|
/**
|
|
* Utility to create a URL from the params map
|
|
*/
|
|
function mapToQueryString(parameters) {
|
|
const queryParameterArray = new Array();
|
|
parameters.forEach((value, key) => {
|
|
queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
|
|
});
|
|
return queryParameterArray.join("&");
|
|
}
|
|
/**
|
|
* Normalizes URLs for comparison by removing hash, canonicalizing,
|
|
* and ensuring consistent URL encoding in query parameters.
|
|
* This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
|
|
* @param url - URL to normalize
|
|
* @returns Normalized URL string for comparison
|
|
*/
|
|
function normalizeUrlForComparison(url) {
|
|
if (!url) {
|
|
return url;
|
|
}
|
|
// Remove hash first
|
|
const urlWithoutHash = url.split("#")[0];
|
|
try {
|
|
// Parse the URL to handle encoding consistently
|
|
const urlObj = new URL(urlWithoutHash);
|
|
/*
|
|
* Reconstruct the URL with properly decoded query parameters
|
|
* This ensures that %27 and ' are treated as equivalent
|
|
*/
|
|
const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
|
|
// Apply canonicalization logic inline to avoid circular dependency
|
|
return canonicalizeUrl(normalizedUrl);
|
|
}
|
|
catch (e) {
|
|
// Fallback to original logic if URL parsing fails
|
|
return canonicalizeUrl(urlWithoutHash);
|
|
}
|
|
}
|
|
|
|
var UrlUtils = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
getDeserializedResponse: getDeserializedResponse,
|
|
mapToQueryString: mapToQueryString,
|
|
normalizeUrlForComparison: normalizeUrlForComparison,
|
|
stripLeadingHashOrQuery: stripLeadingHashOrQuery
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const CLIENT_ID = "client_id";
|
|
const REDIRECT_URI = "redirect_uri";
|
|
const RESPONSE_TYPE = "response_type";
|
|
const RESPONSE_MODE = "response_mode";
|
|
const GRANT_TYPE = "grant_type";
|
|
const CLAIMS = "claims";
|
|
const SCOPE = "scope";
|
|
const ERROR = "error";
|
|
const ERROR_DESCRIPTION = "error_description";
|
|
const ACCESS_TOKEN = "access_token";
|
|
const ID_TOKEN = "id_token";
|
|
const REFRESH_TOKEN = "refresh_token";
|
|
const EXPIRES_IN = "expires_in";
|
|
const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
|
|
const STATE = "state";
|
|
const NONCE = "nonce";
|
|
const PROMPT = "prompt";
|
|
const SESSION_STATE = "session_state";
|
|
const CLIENT_INFO = "client_info";
|
|
const CODE = "code";
|
|
const CODE_CHALLENGE = "code_challenge";
|
|
const CODE_CHALLENGE_METHOD = "code_challenge_method";
|
|
const CODE_VERIFIER = "code_verifier";
|
|
const CLIENT_REQUEST_ID = "client-request-id";
|
|
const X_CLIENT_SKU = "x-client-SKU";
|
|
const X_CLIENT_VER = "x-client-VER";
|
|
const X_CLIENT_OS = "x-client-OS";
|
|
const X_CLIENT_CPU = "x-client-CPU";
|
|
const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
|
|
const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
|
|
const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
|
|
const X_APP_NAME = "x-app-name";
|
|
const X_APP_VER = "x-app-ver";
|
|
const POST_LOGOUT_URI = "post_logout_redirect_uri";
|
|
const ID_TOKEN_HINT = "id_token_hint";
|
|
const DEVICE_CODE = "device_code";
|
|
const CLIENT_SECRET = "client_secret";
|
|
const CLIENT_ASSERTION = "client_assertion";
|
|
const CLIENT_ASSERTION_TYPE = "client_assertion_type";
|
|
const TOKEN_TYPE = "token_type";
|
|
const REQ_CNF = "req_cnf";
|
|
const OBO_ASSERTION = "assertion";
|
|
const REQUESTED_TOKEN_USE = "requested_token_use";
|
|
const ON_BEHALF_OF = "on_behalf_of";
|
|
const FOCI = "foci";
|
|
const CCS_HEADER = "X-AnchorMailbox";
|
|
const RETURN_SPA_CODE = "return_spa_code";
|
|
const NATIVE_BROKER = "nativebroker";
|
|
const LOGOUT_HINT = "logout_hint";
|
|
const SID = "sid";
|
|
const LOGIN_HINT = "login_hint";
|
|
const DOMAIN_HINT = "domain_hint";
|
|
const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
|
|
const BROKER_CLIENT_ID = "brk_client_id";
|
|
const BROKER_REDIRECT_URI = "brk_redirect_uri";
|
|
const INSTANCE_AWARE = "instance_aware";
|
|
const EAR_JWK = "ear_jwk";
|
|
const EAR_JWE_CRYPTO = "ear_jwe_crypto";
|
|
const RESOURCE = "resource";
|
|
const CLI_DATA = "clidata";
|
|
|
|
var AADServerParamKeys = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
ACCESS_TOKEN: ACCESS_TOKEN,
|
|
BROKER_CLIENT_ID: BROKER_CLIENT_ID,
|
|
BROKER_REDIRECT_URI: BROKER_REDIRECT_URI,
|
|
CCS_HEADER: CCS_HEADER,
|
|
CLAIMS: CLAIMS,
|
|
CLIENT_ASSERTION: CLIENT_ASSERTION,
|
|
CLIENT_ASSERTION_TYPE: CLIENT_ASSERTION_TYPE,
|
|
CLIENT_ID: CLIENT_ID,
|
|
CLIENT_INFO: CLIENT_INFO,
|
|
CLIENT_REQUEST_ID: CLIENT_REQUEST_ID,
|
|
CLIENT_SECRET: CLIENT_SECRET,
|
|
CLI_DATA: CLI_DATA,
|
|
CODE: CODE,
|
|
CODE_CHALLENGE: CODE_CHALLENGE,
|
|
CODE_CHALLENGE_METHOD: CODE_CHALLENGE_METHOD,
|
|
CODE_VERIFIER: CODE_VERIFIER,
|
|
DEVICE_CODE: DEVICE_CODE,
|
|
DOMAIN_HINT: DOMAIN_HINT,
|
|
EAR_JWE_CRYPTO: EAR_JWE_CRYPTO,
|
|
EAR_JWK: EAR_JWK,
|
|
ERROR: ERROR,
|
|
ERROR_DESCRIPTION: ERROR_DESCRIPTION,
|
|
EXPIRES_IN: EXPIRES_IN,
|
|
FOCI: FOCI,
|
|
GRANT_TYPE: GRANT_TYPE,
|
|
ID_TOKEN: ID_TOKEN,
|
|
ID_TOKEN_HINT: ID_TOKEN_HINT,
|
|
INSTANCE_AWARE: INSTANCE_AWARE,
|
|
LOGIN_HINT: LOGIN_HINT,
|
|
LOGOUT_HINT: LOGOUT_HINT,
|
|
NATIVE_BROKER: NATIVE_BROKER,
|
|
NONCE: NONCE,
|
|
OBO_ASSERTION: OBO_ASSERTION,
|
|
ON_BEHALF_OF: ON_BEHALF_OF,
|
|
POST_LOGOUT_URI: POST_LOGOUT_URI,
|
|
PROMPT: PROMPT,
|
|
REDIRECT_URI: REDIRECT_URI,
|
|
REFRESH_TOKEN: REFRESH_TOKEN,
|
|
REFRESH_TOKEN_EXPIRES_IN: REFRESH_TOKEN_EXPIRES_IN,
|
|
REQUESTED_TOKEN_USE: REQUESTED_TOKEN_USE,
|
|
REQ_CNF: REQ_CNF,
|
|
RESOURCE: RESOURCE,
|
|
RESPONSE_MODE: RESPONSE_MODE,
|
|
RESPONSE_TYPE: RESPONSE_TYPE,
|
|
RETURN_SPA_CODE: RETURN_SPA_CODE,
|
|
SCOPE: SCOPE,
|
|
SESSION_STATE: SESSION_STATE,
|
|
SID: SID,
|
|
STATE: STATE,
|
|
TOKEN_TYPE: TOKEN_TYPE,
|
|
X_APP_NAME: X_APP_NAME,
|
|
X_APP_VER: X_APP_VER,
|
|
X_CLIENT_CPU: X_CLIENT_CPU,
|
|
X_CLIENT_CURR_TELEM: X_CLIENT_CURR_TELEM,
|
|
X_CLIENT_EXTRA_SKU: X_CLIENT_EXTRA_SKU,
|
|
X_CLIENT_LAST_TELEM: X_CLIENT_LAST_TELEM,
|
|
X_CLIENT_OS: X_CLIENT_OS,
|
|
X_CLIENT_SKU: X_CLIENT_SKU,
|
|
X_CLIENT_VER: X_CLIENT_VER,
|
|
X_MS_LIB_CAPABILITY: X_MS_LIB_CAPABILITY
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Function to build a client info object from server clientInfo string
|
|
* @param rawClientInfo
|
|
* @param crypto
|
|
*/
|
|
function buildClientInfo(rawClientInfo, base64Decode) {
|
|
if (!rawClientInfo) {
|
|
throw createClientAuthError(clientInfoEmptyError);
|
|
}
|
|
try {
|
|
const decodedClientInfo = base64Decode(rawClientInfo);
|
|
return JSON.parse(decodedClientInfo);
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(clientInfoDecodingError);
|
|
}
|
|
}
|
|
/**
|
|
* Function to build a client info object from cached homeAccountId string
|
|
* @param homeAccountId
|
|
*/
|
|
function buildClientInfoFromHomeAccountId(homeAccountId) {
|
|
if (!homeAccountId) {
|
|
throw createClientAuthError(clientInfoDecodingError);
|
|
}
|
|
const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
|
|
return {
|
|
uid: clientInfoParts[0],
|
|
utid: clientInfoParts.length < 2 ? "" : clientInfoParts[1],
|
|
};
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Returns true if tenantId matches the utid portion of homeAccountId
|
|
* @param tenantId
|
|
* @param homeAccountId
|
|
* @returns
|
|
*/
|
|
function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
|
|
return (!!tenantId &&
|
|
!!homeAccountId &&
|
|
tenantId === homeAccountId.split(".")[1]);
|
|
}
|
|
/**
|
|
* Build tenant profile
|
|
* @param homeAccountId - Home account identifier for this account object
|
|
* @param localAccountId - Local account identifer for this account object
|
|
* @param tenantId - Full tenant or organizational id that this account belongs to
|
|
* @param idTokenClaims - Claims from the ID token
|
|
* @returns
|
|
*/
|
|
function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
|
|
if (idTokenClaims) {
|
|
const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
|
|
/**
|
|
* Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
|
|
* tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
|
|
* tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
|
|
* acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
|
|
*/
|
|
const tenantId = tid || tfp || acr || "";
|
|
return {
|
|
tenantId: tenantId,
|
|
localAccountId: oid || sub || "",
|
|
name: name,
|
|
username: preferred_username || upn || "",
|
|
loginHint: login_hint,
|
|
isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
|
|
upn: upn,
|
|
};
|
|
}
|
|
else {
|
|
return {
|
|
tenantId,
|
|
localAccountId,
|
|
username: "",
|
|
isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
|
|
};
|
|
}
|
|
}
|
|
/**
|
|
* Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
|
|
* @param baseAccountInfo
|
|
* @param idTokenClaims
|
|
* @returns
|
|
*/
|
|
function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {
|
|
let updatedAccountInfo = baseAccountInfo;
|
|
// Tenant Profile overrides passed in account info
|
|
if (tenantProfile) {
|
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
|
const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
|
|
updatedAccountInfo = { ...baseAccountInfo, ...tenantProfileOverride };
|
|
}
|
|
// ID token claims override passed in account info and tenant profile
|
|
if (idTokenClaims) {
|
|
// Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
|
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
|
const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
|
|
updatedAccountInfo = {
|
|
...updatedAccountInfo,
|
|
...claimsSourcedTenantProfile,
|
|
idTokenClaims: idTokenClaims,
|
|
idToken: idTokenSecret,
|
|
};
|
|
return updatedAccountInfo;
|
|
}
|
|
return updatedAccountInfo;
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Gets tenantId from available ID token claims to set as credential realm with the following precedence:
|
|
* 1. tid - if the token is acquired from an Azure AD tenant tid will be present
|
|
* 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
|
|
* 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
|
|
* Downcased to match the realm case-insensitive comparison requirements
|
|
* @param idTokenClaims
|
|
* @returns
|
|
*/
|
|
function getTenantIdFromIdTokenClaims(idTokenClaims) {
|
|
if (idTokenClaims) {
|
|
const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
|
|
return tenantId || null;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Generate Account Id key component as per the schema: <home_account_id>-<environment>
|
|
*/
|
|
function generateAccountId(accountEntity) {
|
|
const accountId = [
|
|
accountEntity.homeAccountId,
|
|
accountEntity.environment,
|
|
];
|
|
return accountId.join(CACHE_KEY_SEPARATOR).toLowerCase();
|
|
}
|
|
/**
|
|
* Returns the AccountInfo interface for this account.
|
|
*/
|
|
function getAccountInfo(accountEntity) {
|
|
const tenantProfiles = accountEntity.tenantProfiles || [];
|
|
// Ensure at least the home tenant profile exists
|
|
if (tenantProfiles.length === 0 &&
|
|
accountEntity.realm &&
|
|
accountEntity.localAccountId) {
|
|
tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
|
|
}
|
|
return {
|
|
homeAccountId: accountEntity.homeAccountId,
|
|
environment: accountEntity.environment,
|
|
tenantId: accountEntity.realm,
|
|
username: accountEntity.username,
|
|
localAccountId: accountEntity.localAccountId,
|
|
loginHint: accountEntity.loginHint,
|
|
name: accountEntity.name,
|
|
nativeAccountId: accountEntity.nativeAccountId,
|
|
authorityType: accountEntity.authorityType,
|
|
// Deserialize tenant profiles array into a Map
|
|
tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
|
|
return [tenantProfile.tenantId, tenantProfile];
|
|
})),
|
|
dataBoundary: accountEntity.dataBoundary,
|
|
};
|
|
}
|
|
/**
|
|
* Returns true if the account entity is in single tenant format (outdated), false otherwise
|
|
*/
|
|
function isSingleTenant(accountEntity) {
|
|
return !accountEntity.tenantProfiles;
|
|
}
|
|
/**
|
|
* Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
|
|
* @param accountDetails
|
|
*/
|
|
function createAccountEntity(accountDetails, authority, base64Decode) {
|
|
let authorityType;
|
|
if (authority.authorityType === AuthorityType.Adfs) {
|
|
authorityType = CACHE_ACCOUNT_TYPE_ADFS;
|
|
}
|
|
else if (authority.protocolMode === ProtocolMode.OIDC) {
|
|
authorityType = CACHE_ACCOUNT_TYPE_GENERIC;
|
|
}
|
|
else {
|
|
authorityType = CACHE_ACCOUNT_TYPE_MSSTS;
|
|
}
|
|
let clientInfo;
|
|
let dataBoundary;
|
|
if (accountDetails.clientInfo && base64Decode) {
|
|
clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
|
|
if (clientInfo.xms_tdbr) {
|
|
dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
|
|
}
|
|
}
|
|
const env = accountDetails.environment ||
|
|
(authority && authority.getPreferredCache());
|
|
if (!env) {
|
|
throw createClientAuthError(invalidCacheEnvironment);
|
|
}
|
|
/*
|
|
* In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
|
|
* In most cases it will contain a single email. This field should not be relied upon if a custom
|
|
* policy is configured to return more than 1 email.
|
|
*/
|
|
const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
|
|
accountDetails.idTokenClaims?.upn;
|
|
const email = accountDetails.idTokenClaims?.emails
|
|
? accountDetails.idTokenClaims.emails[0]
|
|
: null;
|
|
const username = preferredUsername || email || "";
|
|
const loginHint = accountDetails.idTokenClaims?.login_hint;
|
|
const realm = clientInfo?.utid ||
|
|
getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
|
|
""; // non-AAD scenarios can have empty realm
|
|
// How do you account for MSA CID here?
|
|
const localAccountId = clientInfo?.uid ||
|
|
accountDetails.idTokenClaims?.oid ||
|
|
accountDetails.idTokenClaims?.sub ||
|
|
"";
|
|
let tenantProfiles;
|
|
if (accountDetails.tenantProfiles) {
|
|
tenantProfiles = accountDetails.tenantProfiles;
|
|
}
|
|
else {
|
|
const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
|
|
tenantProfiles = [tenantProfile];
|
|
}
|
|
return {
|
|
homeAccountId: accountDetails.homeAccountId,
|
|
environment: env,
|
|
realm: realm,
|
|
localAccountId: localAccountId,
|
|
username: username,
|
|
authorityType: authorityType,
|
|
loginHint: loginHint,
|
|
clientInfo: accountDetails.clientInfo,
|
|
name: accountDetails.idTokenClaims?.name || "",
|
|
lastModificationTime: undefined,
|
|
lastModificationApp: undefined,
|
|
cloudGraphHostName: accountDetails.cloudGraphHostName,
|
|
msGraphHost: accountDetails.msGraphHost,
|
|
nativeAccountId: accountDetails.nativeAccountId,
|
|
tenantProfiles: tenantProfiles,
|
|
dataBoundary,
|
|
};
|
|
}
|
|
/**
|
|
* Creates an AccountEntity object from AccountInfo
|
|
* @param accountInfo
|
|
* @param cloudGraphHostName
|
|
* @param msGraphHost
|
|
* @returns
|
|
*/
|
|
function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
|
|
// Serialize tenant profiles map into an array
|
|
const tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
|
|
// Ensure at least the home tenant profile exists
|
|
if (tenantProfiles.length === 0 &&
|
|
accountInfo.tenantId &&
|
|
accountInfo.localAccountId) {
|
|
tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
|
|
}
|
|
return {
|
|
authorityType: accountInfo.authorityType || CACHE_ACCOUNT_TYPE_GENERIC,
|
|
homeAccountId: accountInfo.homeAccountId,
|
|
localAccountId: accountInfo.localAccountId,
|
|
nativeAccountId: accountInfo.nativeAccountId,
|
|
realm: accountInfo.tenantId,
|
|
environment: accountInfo.environment,
|
|
username: accountInfo.username,
|
|
loginHint: accountInfo.loginHint,
|
|
name: accountInfo.name,
|
|
cloudGraphHostName: cloudGraphHostName,
|
|
msGraphHost: msGraphHost,
|
|
tenantProfiles: tenantProfiles,
|
|
dataBoundary: accountInfo.dataBoundary,
|
|
};
|
|
}
|
|
/**
|
|
* Generate HomeAccountId from server response
|
|
* @param serverClientInfo
|
|
* @param authType
|
|
*/
|
|
function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, correlationId, idTokenClaims) {
|
|
// since ADFS/DSTS do not have tid and does not set client_info
|
|
if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
|
|
// for cases where there is clientInfo
|
|
if (serverClientInfo) {
|
|
try {
|
|
const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
|
|
if (clientInfo.uid && clientInfo.utid) {
|
|
return `${clientInfo.uid}.${clientInfo.utid}`;
|
|
}
|
|
}
|
|
catch (e) { }
|
|
}
|
|
logger.warning("No client info in response", correlationId);
|
|
}
|
|
// default to "sub" claim
|
|
return idTokenClaims?.sub || "";
|
|
}
|
|
/**
|
|
* Validates an entity: checks for all expected params
|
|
* @param entity
|
|
*/
|
|
function isAccountEntity(entity) {
|
|
if (!entity) {
|
|
return false;
|
|
}
|
|
return (entity.hasOwnProperty("homeAccountId") &&
|
|
entity.hasOwnProperty("environment") &&
|
|
entity.hasOwnProperty("realm") &&
|
|
entity.hasOwnProperty("localAccountId") &&
|
|
entity.hasOwnProperty("username") &&
|
|
entity.hasOwnProperty("authorityType"));
|
|
}
|
|
|
|
var AccountEntityUtils = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
createAccountEntity: createAccountEntity,
|
|
createAccountEntityFromAccountInfo: createAccountEntityFromAccountInfo,
|
|
generateAccountId: generateAccountId,
|
|
generateHomeAccountId: generateHomeAccountId,
|
|
getAccountInfo: getAccountInfo,
|
|
isAccountEntity: isAccountEntity,
|
|
isSingleTenant: isSingleTenant
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
|
|
* the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
|
|
* to ensure uniqueness of strings.
|
|
*/
|
|
class ScopeSet {
|
|
constructor(inputScopes) {
|
|
// Filter empty string and null/undefined array items
|
|
const scopeArr = inputScopes
|
|
? StringUtils.trimArrayEntries([...inputScopes])
|
|
: [];
|
|
const filteredInput = scopeArr
|
|
? StringUtils.removeEmptyStringsFromArray(scopeArr)
|
|
: [];
|
|
// Check if scopes array has at least one member
|
|
if (!filteredInput || !filteredInput.length) {
|
|
throw createClientConfigurationError(emptyInputScopesError);
|
|
}
|
|
this.scopes = new Set(); // Iterator in constructor not supported by IE11
|
|
filteredInput.forEach((scope) => this.scopes.add(scope));
|
|
}
|
|
/**
|
|
* Factory method to create ScopeSet from space-delimited string
|
|
* @param inputScopeString
|
|
* @param appClientId
|
|
* @param scopesRequired
|
|
*/
|
|
static fromString(inputScopeString) {
|
|
const scopeString = inputScopeString || "";
|
|
const inputScopes = scopeString.split(" ");
|
|
return new ScopeSet(inputScopes);
|
|
}
|
|
/**
|
|
* Creates the set of scopes to search for in cache lookups
|
|
* @param inputScopeString
|
|
* @returns
|
|
*/
|
|
static createSearchScopes(inputScopeString) {
|
|
// Handle empty scopes by using default OIDC scopes for cache lookup
|
|
const scopesToUse = inputScopeString && inputScopeString.length > 0
|
|
? inputScopeString
|
|
: [...OIDC_DEFAULT_SCOPES];
|
|
const scopeSet = new ScopeSet(scopesToUse);
|
|
if (!scopeSet.containsOnlyOIDCScopes()) {
|
|
scopeSet.removeOIDCScopes();
|
|
}
|
|
else {
|
|
scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
|
|
}
|
|
return scopeSet;
|
|
}
|
|
/**
|
|
* Check if a given scope is present in this set of scopes.
|
|
* @param scope
|
|
*/
|
|
containsScope(scope) {
|
|
const lowerCaseScopes = this.printScopesLowerCase().split(" ");
|
|
const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
|
|
// compare lowercase scopes
|
|
return scope
|
|
? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
|
|
: false;
|
|
}
|
|
/**
|
|
* Check if a set of scopes is present in this set of scopes.
|
|
* @param scopeSet
|
|
*/
|
|
containsScopeSet(scopeSet) {
|
|
if (!scopeSet || scopeSet.scopes.size <= 0) {
|
|
return false;
|
|
}
|
|
return (this.scopes.size >= scopeSet.scopes.size &&
|
|
scopeSet.asArray().every((scope) => this.containsScope(scope)));
|
|
}
|
|
/**
|
|
* Check if set of scopes contains only the defaults
|
|
*/
|
|
containsOnlyOIDCScopes() {
|
|
let defaultScopeCount = 0;
|
|
OIDC_SCOPES.forEach((defaultScope) => {
|
|
if (this.containsScope(defaultScope)) {
|
|
defaultScopeCount += 1;
|
|
}
|
|
});
|
|
return this.scopes.size === defaultScopeCount;
|
|
}
|
|
/**
|
|
* Appends single scope if passed
|
|
* @param newScope
|
|
*/
|
|
appendScope(newScope) {
|
|
if (newScope) {
|
|
this.scopes.add(newScope.trim());
|
|
}
|
|
}
|
|
/**
|
|
* Appends multiple scopes if passed
|
|
* @param newScopes
|
|
*/
|
|
appendScopes(newScopes) {
|
|
try {
|
|
newScopes.forEach((newScope) => this.appendScope(newScope));
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(cannotAppendScopeSet);
|
|
}
|
|
}
|
|
/**
|
|
* Removes element from set of scopes.
|
|
* @param scope
|
|
*/
|
|
removeScope(scope) {
|
|
if (!scope) {
|
|
throw createClientAuthError(cannotRemoveEmptyScope);
|
|
}
|
|
this.scopes.delete(scope.trim());
|
|
}
|
|
/**
|
|
* Removes default scopes from set of scopes
|
|
* Primarily used to prevent cache misses if the default scopes are not returned from the server
|
|
*/
|
|
removeOIDCScopes() {
|
|
OIDC_SCOPES.forEach((defaultScope) => {
|
|
this.scopes.delete(defaultScope);
|
|
});
|
|
}
|
|
/**
|
|
* Combines an array of scopes with the current set of scopes.
|
|
* @param otherScopes
|
|
*/
|
|
unionScopeSets(otherScopes) {
|
|
if (!otherScopes) {
|
|
throw createClientAuthError(emptyInputScopeSet);
|
|
}
|
|
const unionScopes = new Set(); // Iterator in constructor not supported in IE11
|
|
otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
|
|
this.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
|
|
return unionScopes;
|
|
}
|
|
/**
|
|
* Check if scopes intersect between this set and another.
|
|
* @param otherScopes
|
|
*/
|
|
intersectingScopeSets(otherScopes) {
|
|
if (!otherScopes) {
|
|
throw createClientAuthError(emptyInputScopeSet);
|
|
}
|
|
// Do not allow OIDC scopes to be the only intersecting scopes
|
|
if (!otherScopes.containsOnlyOIDCScopes()) {
|
|
otherScopes.removeOIDCScopes();
|
|
}
|
|
const unionScopes = this.unionScopeSets(otherScopes);
|
|
const sizeOtherScopes = otherScopes.getScopeCount();
|
|
const sizeThisScopes = this.getScopeCount();
|
|
const sizeUnionScopes = unionScopes.size;
|
|
return sizeUnionScopes < sizeThisScopes + sizeOtherScopes;
|
|
}
|
|
/**
|
|
* Returns size of set of scopes.
|
|
*/
|
|
getScopeCount() {
|
|
return this.scopes.size;
|
|
}
|
|
/**
|
|
* Returns the scopes as an array of string values
|
|
*/
|
|
asArray() {
|
|
const array = [];
|
|
this.scopes.forEach((val) => array.push(val));
|
|
return array;
|
|
}
|
|
/**
|
|
* Prints scopes into a space-delimited string
|
|
*/
|
|
printScopes() {
|
|
if (this.scopes) {
|
|
const scopeArr = this.asArray();
|
|
return scopeArr.join(" ");
|
|
}
|
|
return "";
|
|
}
|
|
/**
|
|
* Prints scopes into a space-delimited lower-case string (used for caching)
|
|
*/
|
|
printScopesLowerCase() {
|
|
return this.printScopes().toLowerCase();
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
function instrumentBrokerParams(parameters, correlationId, performanceClient) {
|
|
if (!correlationId) {
|
|
return;
|
|
}
|
|
const clientId = parameters.get(CLIENT_ID);
|
|
if (clientId && parameters.has(BROKER_CLIENT_ID)) {
|
|
performanceClient?.addFields({
|
|
embeddedClientId: clientId,
|
|
embeddedRedirectUri: parameters.get(REDIRECT_URI),
|
|
}, correlationId);
|
|
}
|
|
}
|
|
/**
|
|
* Add the given response_type
|
|
* @param parameters
|
|
* @param responseType
|
|
*/
|
|
function addResponseType(parameters, responseType) {
|
|
parameters.set(RESPONSE_TYPE, responseType);
|
|
}
|
|
/**
|
|
* add response_mode. defaults to query.
|
|
* @param responseMode
|
|
*/
|
|
function addResponseMode(parameters, responseMode) {
|
|
parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
|
|
}
|
|
/**
|
|
* Add flag to indicate STS should attempt to use WAM if available
|
|
*/
|
|
function addNativeBroker(parameters) {
|
|
parameters.set(NATIVE_BROKER, "1");
|
|
}
|
|
/**
|
|
* add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
|
|
* @param scopeSet
|
|
* @param addOidcScopes
|
|
*/
|
|
function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
|
|
// Always add openid to the scopes when adding OIDC scopes
|
|
if (addOidcScopes &&
|
|
!defaultScopes.includes("openid") &&
|
|
!scopes.includes("openid")) {
|
|
defaultScopes.push("openid");
|
|
}
|
|
const requestScopes = addOidcScopes
|
|
? [...(scopes || []), ...defaultScopes]
|
|
: scopes || [];
|
|
const scopeSet = new ScopeSet(requestScopes);
|
|
parameters.set(SCOPE, scopeSet.printScopes());
|
|
}
|
|
/**
|
|
* add clientId
|
|
* @param clientId
|
|
*/
|
|
function addClientId(parameters, clientId) {
|
|
parameters.set(CLIENT_ID, clientId);
|
|
}
|
|
/**
|
|
* add redirect_uri
|
|
* @param redirectUri
|
|
*/
|
|
function addRedirectUri(parameters, redirectUri) {
|
|
parameters.set(REDIRECT_URI, redirectUri);
|
|
}
|
|
/**
|
|
* add post logout redirectUri
|
|
* @param redirectUri
|
|
*/
|
|
function addPostLogoutRedirectUri(parameters, redirectUri) {
|
|
parameters.set(POST_LOGOUT_URI, redirectUri);
|
|
}
|
|
/**
|
|
* add id_token_hint to logout request
|
|
* @param idTokenHint
|
|
*/
|
|
function addIdTokenHint(parameters, idTokenHint) {
|
|
parameters.set(ID_TOKEN_HINT, idTokenHint);
|
|
}
|
|
/**
|
|
* add domain_hint
|
|
* @param domainHint
|
|
*/
|
|
function addDomainHint(parameters, domainHint) {
|
|
parameters.set(DOMAIN_HINT, domainHint);
|
|
}
|
|
/**
|
|
* add login_hint
|
|
* @param loginHint
|
|
*/
|
|
function addLoginHint(parameters, loginHint) {
|
|
parameters.set(LOGIN_HINT, loginHint);
|
|
}
|
|
/**
|
|
* Adds the CCS (Cache Credential Service) query parameter for login_hint
|
|
* @param loginHint
|
|
*/
|
|
function addCcsUpn(parameters, loginHint) {
|
|
parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
|
|
}
|
|
/**
|
|
* Adds the CCS (Cache Credential Service) query parameter for account object
|
|
* @param loginHint
|
|
*/
|
|
function addCcsOid(parameters, clientInfo) {
|
|
parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
|
|
}
|
|
/**
|
|
* add sid
|
|
* @param sid
|
|
*/
|
|
function addSid(parameters, sid) {
|
|
parameters.set(SID, sid);
|
|
}
|
|
/**
|
|
* Adds claims to request parameters, conditionally excluding clientCapabilities
|
|
* when skipBrokerClaims is true and a brokered flow is in effect.
|
|
* @param parameters - The request parameters map
|
|
* @param claims - The claims string from the request
|
|
* @param clientCapabilities - The client capabilities from configuration
|
|
* @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
|
|
*/
|
|
function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
|
|
// Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
|
|
const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
|
|
? undefined
|
|
: clientCapabilities;
|
|
if (!StringUtils.isEmptyObj(claims) ||
|
|
(configClaims && configClaims.length > 0)) {
|
|
const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
|
|
try {
|
|
JSON.parse(mergedClaims);
|
|
}
|
|
catch (e) {
|
|
throw createClientConfigurationError(invalidClaims);
|
|
}
|
|
parameters.set(CLAIMS, mergedClaims);
|
|
}
|
|
}
|
|
/**
|
|
* add correlationId
|
|
* @param correlationId
|
|
*/
|
|
function addCorrelationId(parameters, correlationId) {
|
|
parameters.set(CLIENT_REQUEST_ID, correlationId);
|
|
}
|
|
/**
|
|
* add library info query params
|
|
* @param libraryInfo
|
|
*/
|
|
function addLibraryInfo(parameters, libraryInfo) {
|
|
// Telemetry Info
|
|
parameters.set(X_CLIENT_SKU, libraryInfo.sku);
|
|
parameters.set(X_CLIENT_VER, libraryInfo.version);
|
|
if (libraryInfo.os) {
|
|
parameters.set(X_CLIENT_OS, libraryInfo.os);
|
|
}
|
|
if (libraryInfo.cpu) {
|
|
parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
|
|
}
|
|
}
|
|
/**
|
|
* Add client telemetry parameters
|
|
* @param appTelemetry
|
|
*/
|
|
function addApplicationTelemetry(parameters, appTelemetry) {
|
|
if (appTelemetry?.appName) {
|
|
parameters.set(X_APP_NAME, appTelemetry.appName);
|
|
}
|
|
if (appTelemetry?.appVersion) {
|
|
parameters.set(X_APP_VER, appTelemetry.appVersion);
|
|
}
|
|
}
|
|
/**
|
|
* add prompt
|
|
* @param prompt
|
|
*/
|
|
function addPrompt(parameters, prompt) {
|
|
parameters.set(PROMPT, prompt);
|
|
}
|
|
/**
|
|
* add state
|
|
* @param state
|
|
*/
|
|
function addState(parameters, state) {
|
|
if (state) {
|
|
parameters.set(STATE, state);
|
|
}
|
|
}
|
|
/**
|
|
* add nonce
|
|
* @param nonce
|
|
*/
|
|
function addNonce(parameters, nonce) {
|
|
parameters.set(NONCE, nonce);
|
|
}
|
|
/**
|
|
* add code_challenge and code_challenge_method
|
|
* - throw if either of them are not passed
|
|
* @param codeChallenge
|
|
* @param codeChallengeMethod
|
|
*/
|
|
function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
|
|
if (codeChallenge && codeChallengeMethod) {
|
|
parameters.set(CODE_CHALLENGE, codeChallenge);
|
|
parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
|
|
}
|
|
else {
|
|
throw createClientConfigurationError(pkceParamsMissing);
|
|
}
|
|
}
|
|
/**
|
|
* add the `authorization_code` passed by the user to exchange for a token
|
|
* @param code
|
|
*/
|
|
function addAuthorizationCode(parameters, code) {
|
|
parameters.set(CODE, code);
|
|
}
|
|
/**
|
|
* add the `authorization_code` passed by the user to exchange for a token
|
|
* @param code
|
|
*/
|
|
function addDeviceCode(parameters, code) {
|
|
parameters.set(DEVICE_CODE, code);
|
|
}
|
|
/**
|
|
* add the `refreshToken` passed by the user
|
|
* @param refreshToken
|
|
*/
|
|
function addRefreshToken(parameters, refreshToken) {
|
|
parameters.set(REFRESH_TOKEN, refreshToken);
|
|
}
|
|
/**
|
|
* add the `code_verifier` passed by the user to exchange for a token
|
|
* @param codeVerifier
|
|
*/
|
|
function addCodeVerifier(parameters, codeVerifier) {
|
|
parameters.set(CODE_VERIFIER, codeVerifier);
|
|
}
|
|
/**
|
|
* add client_secret
|
|
* @param clientSecret
|
|
*/
|
|
function addClientSecret(parameters, clientSecret) {
|
|
parameters.set(CLIENT_SECRET, clientSecret);
|
|
}
|
|
/**
|
|
* add clientAssertion for confidential client flows
|
|
* @param clientAssertion
|
|
*/
|
|
function addClientAssertion(parameters, clientAssertion) {
|
|
if (clientAssertion) {
|
|
parameters.set(CLIENT_ASSERTION, clientAssertion);
|
|
}
|
|
}
|
|
/**
|
|
* add clientAssertionType for confidential client flows
|
|
* @param clientAssertionType
|
|
*/
|
|
function addClientAssertionType(parameters, clientAssertionType) {
|
|
if (clientAssertionType) {
|
|
parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
|
|
}
|
|
}
|
|
/**
|
|
* add OBO assertion for confidential client flows
|
|
* @param clientAssertion
|
|
*/
|
|
function addOboAssertion(parameters, oboAssertion) {
|
|
parameters.set(OBO_ASSERTION, oboAssertion);
|
|
}
|
|
/**
|
|
* add grant type
|
|
* @param grantType
|
|
*/
|
|
function addRequestTokenUse(parameters, tokenUse) {
|
|
parameters.set(REQUESTED_TOKEN_USE, tokenUse);
|
|
}
|
|
/**
|
|
* add grant type
|
|
* @param grantType
|
|
*/
|
|
function addGrantType(parameters, grantType) {
|
|
parameters.set(GRANT_TYPE, grantType);
|
|
}
|
|
/**
|
|
* add client info
|
|
*
|
|
*/
|
|
function addClientInfo(parameters) {
|
|
parameters.set(CLIENT_INFO$1, "1");
|
|
}
|
|
/**
|
|
* add clidata=1 to request to indicate client data support
|
|
*/
|
|
function addCliData(parameters) {
|
|
parameters.set(CLI_DATA, "1");
|
|
}
|
|
function addInstanceAware(parameters) {
|
|
if (!parameters.has(INSTANCE_AWARE)) {
|
|
parameters.set(INSTANCE_AWARE, "true");
|
|
}
|
|
}
|
|
/**
|
|
* Add extraParameters
|
|
* @param extraParams - String dictionary containing extra parameters to be added.
|
|
*/
|
|
function addExtraParameters(parameters, extraParams) {
|
|
Object.entries(extraParams).forEach(([key, value]) => {
|
|
if (!parameters.has(key) && value) {
|
|
parameters.set(key, value);
|
|
}
|
|
});
|
|
}
|
|
function addClientCapabilitiesToClaims(claims, clientCapabilities) {
|
|
let mergedClaims;
|
|
// Parse provided claims into JSON object or initialize empty object
|
|
if (!claims) {
|
|
mergedClaims = {};
|
|
}
|
|
else {
|
|
try {
|
|
mergedClaims = JSON.parse(claims);
|
|
}
|
|
catch (e) {
|
|
throw createClientConfigurationError(invalidClaims);
|
|
}
|
|
}
|
|
if (clientCapabilities && clientCapabilities.length > 0) {
|
|
if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
|
|
// Add access_token key to claims object
|
|
mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
|
|
}
|
|
// Add xms_cc claim with provided clientCapabilities to access_token key
|
|
mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
|
|
values: clientCapabilities,
|
|
};
|
|
}
|
|
return JSON.stringify(mergedClaims);
|
|
}
|
|
/**
|
|
* adds `username` for Password Grant flow
|
|
* @param username
|
|
*/
|
|
function addUsername(parameters, username) {
|
|
parameters.set(PasswordGrantConstants.username, username);
|
|
}
|
|
/**
|
|
* adds `password` for Password Grant flow
|
|
* @param password
|
|
*/
|
|
function addPassword(parameters, password) {
|
|
parameters.set(PasswordGrantConstants.password, password);
|
|
}
|
|
/**
|
|
* add pop_jwk to query params
|
|
* @param cnfString
|
|
*/
|
|
function addPopToken(parameters, cnfString) {
|
|
if (cnfString) {
|
|
parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
|
|
parameters.set(REQ_CNF, cnfString);
|
|
}
|
|
}
|
|
/**
|
|
* add SSH JWK and key ID to query params
|
|
*/
|
|
function addSshJwk(parameters, sshJwkString) {
|
|
if (sshJwkString) {
|
|
parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
|
|
parameters.set(REQ_CNF, sshJwkString);
|
|
}
|
|
}
|
|
/**
|
|
* add server telemetry fields
|
|
* @param serverTelemetryManager
|
|
*/
|
|
function addServerTelemetry(parameters, serverTelemetryManager) {
|
|
parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
|
|
parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
|
|
}
|
|
/**
|
|
* Adds parameter that indicates to the server that throttling is supported
|
|
*/
|
|
function addThrottling(parameters) {
|
|
parameters.set(X_MS_LIB_CAPABILITY, X_MS_LIB_CAPABILITY_VALUE);
|
|
}
|
|
/**
|
|
* Adds logout_hint parameter for "silent" logout which prevent server account picker
|
|
*/
|
|
function addLogoutHint(parameters, logoutHint) {
|
|
parameters.set(LOGOUT_HINT, logoutHint);
|
|
}
|
|
function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
|
|
if (!parameters.has(BROKER_CLIENT_ID)) {
|
|
parameters.set(BROKER_CLIENT_ID, brokerClientId);
|
|
}
|
|
if (!parameters.has(BROKER_REDIRECT_URI)) {
|
|
parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
|
|
}
|
|
}
|
|
/**
|
|
* Add EAR (Encrypted Authorize Response) request parameters
|
|
* @param parameters
|
|
* @param jwk
|
|
*/
|
|
function addEARParameters(parameters, jwk) {
|
|
parameters.set(EAR_JWK, encodeURIComponent(jwk));
|
|
// ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
|
|
const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
|
|
parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
|
|
}
|
|
function addResource(parameters, resource) {
|
|
if (resource) {
|
|
parameters.set(RESOURCE, resource);
|
|
}
|
|
}
|
|
|
|
var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
addApplicationTelemetry: addApplicationTelemetry,
|
|
addAuthorizationCode: addAuthorizationCode,
|
|
addBrokerParameters: addBrokerParameters,
|
|
addCcsOid: addCcsOid,
|
|
addCcsUpn: addCcsUpn,
|
|
addClaims: addClaims,
|
|
addCliData: addCliData,
|
|
addClientAssertion: addClientAssertion,
|
|
addClientAssertionType: addClientAssertionType,
|
|
addClientCapabilitiesToClaims: addClientCapabilitiesToClaims,
|
|
addClientId: addClientId,
|
|
addClientInfo: addClientInfo,
|
|
addClientSecret: addClientSecret,
|
|
addCodeChallengeParams: addCodeChallengeParams,
|
|
addCodeVerifier: addCodeVerifier,
|
|
addCorrelationId: addCorrelationId,
|
|
addDeviceCode: addDeviceCode,
|
|
addDomainHint: addDomainHint,
|
|
addEARParameters: addEARParameters,
|
|
addExtraParameters: addExtraParameters,
|
|
addGrantType: addGrantType,
|
|
addIdTokenHint: addIdTokenHint,
|
|
addInstanceAware: addInstanceAware,
|
|
addLibraryInfo: addLibraryInfo,
|
|
addLoginHint: addLoginHint,
|
|
addLogoutHint: addLogoutHint,
|
|
addNativeBroker: addNativeBroker,
|
|
addNonce: addNonce,
|
|
addOboAssertion: addOboAssertion,
|
|
addPassword: addPassword,
|
|
addPopToken: addPopToken,
|
|
addPostLogoutRedirectUri: addPostLogoutRedirectUri,
|
|
addPrompt: addPrompt,
|
|
addRedirectUri: addRedirectUri,
|
|
addRefreshToken: addRefreshToken,
|
|
addRequestTokenUse: addRequestTokenUse,
|
|
addResource: addResource,
|
|
addResponseMode: addResponseMode,
|
|
addResponseType: addResponseType,
|
|
addScopes: addScopes,
|
|
addServerTelemetry: addServerTelemetry,
|
|
addSid: addSid,
|
|
addSshJwk: addSshJwk,
|
|
addState: addState,
|
|
addThrottling: addThrottling,
|
|
addUsername: addUsername,
|
|
instrumentBrokerParams: instrumentBrokerParams
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const DEFAULT_CRYPTO_IMPLEMENTATION = {
|
|
createNewGuid: () => {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
base64Decode: () => {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
base64Encode: () => {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
base64UrlEncode: () => {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
encodeKid: () => {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
async getPublicKeyThumbprint() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
async removeTokenBindingKey() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
async clearKeystore() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
async signJwt() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
async hashString() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Log message level.
|
|
*/
|
|
exports.LogLevel = void 0;
|
|
(function (LogLevel) {
|
|
LogLevel[LogLevel["Error"] = 0] = "Error";
|
|
LogLevel[LogLevel["Warning"] = 1] = "Warning";
|
|
LogLevel[LogLevel["Info"] = 2] = "Info";
|
|
LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
|
|
LogLevel[LogLevel["Trace"] = 4] = "Trace";
|
|
})(exports.LogLevel || (exports.LogLevel = {}));
|
|
// Shared cache state for better minification - using Map's insertion order for LRU
|
|
const CACHE_CAPACITY = 50;
|
|
const MAX_LOGS_PER_CORRELATION = 500;
|
|
const correlationCache = new Map();
|
|
/**
|
|
* Mark correlation ID as recently used by moving it to end of Map
|
|
* @param correlationId
|
|
* @param {CorrelationLogData} data
|
|
*/
|
|
function markAsRecentlyUsed(correlationId, data) {
|
|
correlationCache.delete(correlationId);
|
|
correlationCache.set(correlationId, data);
|
|
}
|
|
/**
|
|
* Add log message to cache for specific correlation ID
|
|
* @param correlationId
|
|
* @param {LoggedMessage} loggedMessage
|
|
*/
|
|
function addLogToCache(correlationId, loggedMessage) {
|
|
const currentTime = Date.now();
|
|
let data = correlationCache.get(correlationId);
|
|
if (data) {
|
|
// Mark as recently used
|
|
markAsRecentlyUsed(correlationId, data);
|
|
}
|
|
else {
|
|
// Create new entry
|
|
data = { logs: [], firstEventTime: currentTime };
|
|
correlationCache.set(correlationId, data);
|
|
// Remove LRU (first entry) if capacity exceeded
|
|
if (correlationCache.size > CACHE_CAPACITY) {
|
|
const firstKey = correlationCache.keys().next().value;
|
|
if (firstKey) {
|
|
correlationCache.delete(firstKey);
|
|
}
|
|
}
|
|
}
|
|
// Add log to the data, maintaining max logs per correlation
|
|
data.logs.push({
|
|
...loggedMessage,
|
|
milliseconds: currentTime - data.firstEventTime,
|
|
});
|
|
if (data.logs.length > MAX_LOGS_PER_CORRELATION) {
|
|
data.logs.shift(); // Remove oldest log
|
|
}
|
|
}
|
|
/**
|
|
* Get logs for correlation ID and flush them from cache
|
|
* Attaches logs with empty correlation id to the requested correlation logs
|
|
* @param correlationId
|
|
*/
|
|
function getAndFlushLogsFromCache(correlationId) {
|
|
const res = [];
|
|
for (const id of ["", correlationId]) {
|
|
const data = correlationCache.get(id);
|
|
res.push(...(data?.logs ?? []));
|
|
correlationCache.delete(id); // Remove the correlation ID completely from cache
|
|
}
|
|
return res;
|
|
}
|
|
/**
|
|
* Checks if a string is already a hashed logging string (6 alphanumeric characters)
|
|
*/
|
|
function isHashedString(str) {
|
|
if (str.length !== 6) {
|
|
return false;
|
|
}
|
|
for (let i = 0; i < str.length; i++) {
|
|
const char = str[i];
|
|
const isAlphaNumeric = (char >= "a" && char <= "z") ||
|
|
(char >= "A" && char <= "Z") ||
|
|
(char >= "0" && char <= "9");
|
|
if (!isAlphaNumeric) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
/**
|
|
* Class which facilitates logging of messages to a specific place.
|
|
*/
|
|
class Logger {
|
|
constructor(loggerOptions, packageName, packageVersion) {
|
|
// Current log level, defaults to info.
|
|
this.level = exports.LogLevel.Info;
|
|
const defaultLoggerCallback = () => {
|
|
return;
|
|
};
|
|
const setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
|
|
this.localCallback =
|
|
setLoggerOptions.loggerCallback || defaultLoggerCallback;
|
|
this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
|
|
this.level =
|
|
typeof setLoggerOptions.logLevel === "number"
|
|
? setLoggerOptions.logLevel
|
|
: exports.LogLevel.Info;
|
|
this.packageName = packageName || "";
|
|
this.packageVersion = packageVersion || "";
|
|
}
|
|
static createDefaultLoggerOptions() {
|
|
return {
|
|
loggerCallback: () => {
|
|
// allow users to not set loggerCallback
|
|
},
|
|
piiLoggingEnabled: false,
|
|
logLevel: exports.LogLevel.Info,
|
|
};
|
|
}
|
|
/**
|
|
* Create new Logger with existing configurations.
|
|
*/
|
|
clone(packageName, packageVersion) {
|
|
return new Logger({
|
|
loggerCallback: this.localCallback,
|
|
piiLoggingEnabled: this.piiLoggingEnabled,
|
|
logLevel: this.level,
|
|
}, packageName, packageVersion);
|
|
}
|
|
/**
|
|
* Log message with required options.
|
|
*/
|
|
logMessage(logMessage, options) {
|
|
const correlationId = options.correlationId;
|
|
const isHashedInput = isHashedString(logMessage);
|
|
if (isHashedInput) {
|
|
const loggedMessage = {
|
|
hash: logMessage,
|
|
level: options.logLevel,
|
|
containsPii: options.containsPii || false,
|
|
milliseconds: 0, // Will be calculated in addLogToCache
|
|
};
|
|
addLogToCache(correlationId, loggedMessage);
|
|
}
|
|
if (options.logLevel > this.level ||
|
|
(!this.piiLoggingEnabled && options.containsPii)) {
|
|
return;
|
|
}
|
|
const timestamp = new Date().toUTCString();
|
|
// Add correlationId to logs if set, correlationId provided on log messages take precedence
|
|
const logHeader = `[${timestamp}] : [${correlationId}]`;
|
|
const log = `${logHeader} : ${this.packageName}@${this.packageVersion} : ${exports.LogLevel[options.logLevel]} - ${logMessage}`;
|
|
this.executeCallback(options.logLevel, log, options.containsPii || false);
|
|
}
|
|
/**
|
|
* Execute callback with message.
|
|
*/
|
|
executeCallback(level, message, containsPii) {
|
|
if (this.localCallback) {
|
|
this.localCallback(level, message, containsPii);
|
|
}
|
|
}
|
|
/**
|
|
* Logs error messages.
|
|
*/
|
|
error(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Error,
|
|
containsPii: false,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs error messages with PII.
|
|
*/
|
|
errorPii(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Error,
|
|
containsPii: true,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs warning messages.
|
|
*/
|
|
warning(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Warning,
|
|
containsPii: false,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs warning messages with PII.
|
|
*/
|
|
warningPii(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Warning,
|
|
containsPii: true,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs info messages.
|
|
*/
|
|
info(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Info,
|
|
containsPii: false,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs info messages with PII.
|
|
*/
|
|
infoPii(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Info,
|
|
containsPii: true,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs verbose messages.
|
|
*/
|
|
verbose(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Verbose,
|
|
containsPii: false,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs verbose messages with PII.
|
|
*/
|
|
verbosePii(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Verbose,
|
|
containsPii: true,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs trace messages.
|
|
*/
|
|
trace(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Trace,
|
|
containsPii: false,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Logs trace messages with PII.
|
|
*/
|
|
tracePii(message, correlationId) {
|
|
this.logMessage(message, {
|
|
logLevel: exports.LogLevel.Trace,
|
|
containsPii: true,
|
|
correlationId: correlationId,
|
|
});
|
|
}
|
|
/**
|
|
* Returns whether PII Logging is enabled or not.
|
|
*/
|
|
isPiiLoggingEnabled() {
|
|
return this.piiLoggingEnabled || false;
|
|
}
|
|
}
|
|
|
|
/* eslint-disable header/header */
|
|
const name = "@azure/msal-common";
|
|
const version = "16.6.2";
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const cacheQuotaExceeded = "cache_quota_exceeded";
|
|
const cacheErrorUnknown = "cache_error_unknown";
|
|
|
|
var CacheErrorCodes = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
cacheErrorUnknown: cacheErrorUnknown,
|
|
cacheQuotaExceeded: cacheQuotaExceeded
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Error thrown when there is an error with the cache
|
|
*/
|
|
class CacheError extends Error {
|
|
constructor(errorCode, errorMessage) {
|
|
const message = errorMessage || getDefaultErrorMessage(errorCode);
|
|
super(message);
|
|
Object.setPrototypeOf(this, CacheError.prototype);
|
|
this.name = "CacheError";
|
|
this.errorCode = errorCode;
|
|
this.errorMessage = message;
|
|
}
|
|
}
|
|
/**
|
|
* Helper function to wrap browser errors in a CacheError object
|
|
* @param e
|
|
* @returns
|
|
*/
|
|
function createCacheError(e) {
|
|
if (!(e instanceof Error)) {
|
|
return new CacheError(cacheErrorUnknown);
|
|
}
|
|
if (e.name === "QuotaExceededError" ||
|
|
e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
|
|
e.message.includes("exceeded the quota")) {
|
|
return new CacheError(cacheQuotaExceeded);
|
|
}
|
|
else {
|
|
return new CacheError(e.name, e.message);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
|
|
* @internal
|
|
*/
|
|
class CacheManager {
|
|
constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
|
|
this.clientId = clientId;
|
|
this.cryptoImpl = cryptoImpl;
|
|
this.commonLogger = logger.clone(name, version);
|
|
this.staticAuthorityOptions = staticAuthorityOptions;
|
|
this.performanceClient = performanceClient;
|
|
}
|
|
/**
|
|
* Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
|
|
* @param accountFilter - (Optional) filter to narrow down the accounts returned
|
|
* @returns Array of AccountInfo objects in cache
|
|
*/
|
|
getAllAccounts(accountFilter = {}, correlationId) {
|
|
return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
|
|
}
|
|
/**
|
|
* Gets first tenanted AccountInfo object found based on provided filters
|
|
*/
|
|
getAccountInfoFilteredBy(accountFilter, correlationId) {
|
|
if (Object.keys(accountFilter).length === 0 ||
|
|
Object.values(accountFilter).every((value) => value === null || value === undefined || value === "")) {
|
|
this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null", correlationId);
|
|
return null;
|
|
}
|
|
const allAccounts = this.getAllAccounts(accountFilter, correlationId);
|
|
if (allAccounts.length > 1) {
|
|
// If one or more accounts are found, prioritize accounts that have an ID token
|
|
const sortedAccounts = allAccounts.sort((a, b) => {
|
|
const aHasClaims = a.idTokenClaims ? 1 : 0;
|
|
const bHasClaims = b.idTokenClaims ? 1 : 0;
|
|
return bHasClaims - aHasClaims;
|
|
});
|
|
return sortedAccounts[0];
|
|
}
|
|
else if (allAccounts.length === 1) {
|
|
// If only one account is found, return it regardless of whether a matching ID token was found
|
|
return allAccounts[0];
|
|
}
|
|
else {
|
|
return null;
|
|
}
|
|
}
|
|
/**
|
|
* Returns a single matching
|
|
* @param accountFilter
|
|
* @returns
|
|
*/
|
|
getBaseAccountInfo(accountFilter, correlationId) {
|
|
const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
|
|
if (accountEntities.length > 0) {
|
|
return getAccountInfo(accountEntities[0]);
|
|
}
|
|
else {
|
|
return null;
|
|
}
|
|
}
|
|
/**
|
|
* Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
|
|
* and builds the account info objects from the matching ID token's claims
|
|
* @param cachedAccounts
|
|
* @param accountFilter
|
|
* @returns Array of AccountInfo objects that match account and tenant profile filters
|
|
*/
|
|
buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
|
|
return cachedAccounts.flatMap((accountEntity) => {
|
|
return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
|
|
});
|
|
}
|
|
getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
|
|
let tenantedAccountInfo = null;
|
|
let idTokenClaims;
|
|
if (tenantProfileFilter) {
|
|
if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
|
|
return null;
|
|
}
|
|
}
|
|
const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
|
|
if (idToken) {
|
|
idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
|
|
if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
|
|
// ID token sourced claims don't match so this tenant profile is not a match
|
|
return null;
|
|
}
|
|
}
|
|
// Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims
|
|
tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
|
|
return tenantedAccountInfo;
|
|
}
|
|
getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
|
|
const accountInfo = getAccountInfo(accountEntity);
|
|
let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
|
|
const tokenKeys = this.getTokenKeys();
|
|
// If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
|
|
if (targetTenantId) {
|
|
const tenantProfile = searchTenantProfiles.get(targetTenantId);
|
|
if (tenantProfile) {
|
|
// Reduce search field to just this tenant profile
|
|
searchTenantProfiles = new Map([
|
|
[targetTenantId, tenantProfile],
|
|
]);
|
|
}
|
|
else {
|
|
// No tenant profile for search tenant ID, return empty array
|
|
return [];
|
|
}
|
|
}
|
|
const matchingTenantProfiles = [];
|
|
searchTenantProfiles.forEach((tenantProfile) => {
|
|
const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
|
|
if (tenantedAccountInfo) {
|
|
matchingTenantProfiles.push(tenantedAccountInfo);
|
|
}
|
|
});
|
|
return matchingTenantProfiles;
|
|
}
|
|
tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter) {
|
|
if (!!tenantProfileFilter.localAccountId &&
|
|
!this.matchLocalAccountIdFromTenantProfile(tenantProfile, tenantProfileFilter.localAccountId)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.name &&
|
|
!(tenantProfile.name === tenantProfileFilter.name)) {
|
|
return false;
|
|
}
|
|
if (tenantProfileFilter.isHomeTenant !== undefined &&
|
|
!(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.username &&
|
|
!(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
|
|
!this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.loginHint &&
|
|
!this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.upn &&
|
|
!(tenantProfile.upn === tenantProfileFilter.upn)) {
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
|
|
// Tenant Profile filtering
|
|
if (tenantProfileFilter) {
|
|
if (!!tenantProfileFilter.localAccountId &&
|
|
!this.matchLocalAccountIdFromTokenClaims(idTokenClaims, tenantProfileFilter.localAccountId)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.loginHint &&
|
|
!this.matchLoginHintFromTokenClaims(idTokenClaims, tenantProfileFilter.loginHint)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.username &&
|
|
!this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
|
|
!this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.name &&
|
|
!this.matchName(idTokenClaims, tenantProfileFilter.name)) {
|
|
return false;
|
|
}
|
|
if (!!tenantProfileFilter.sid &&
|
|
!this.matchSid(idTokenClaims, tenantProfileFilter.sid)) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
/**
|
|
* saves a cache record
|
|
* @param cacheRecord {CacheRecord}
|
|
* @param storeInCache {?StoreInCache}
|
|
* @param correlationId {?string} correlation id
|
|
*/
|
|
async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
|
|
if (!cacheRecord) {
|
|
throw createClientAuthError(invalidCacheRecord);
|
|
}
|
|
try {
|
|
if (!!cacheRecord.account) {
|
|
await this.setAccount(cacheRecord.account, correlationId, kmsi, apiId);
|
|
}
|
|
if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
|
|
await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
|
|
}
|
|
if (!!cacheRecord.accessToken &&
|
|
storeInCache?.accessToken !== false) {
|
|
await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
|
|
}
|
|
if (!!cacheRecord.refreshToken &&
|
|
storeInCache?.refreshToken !== false) {
|
|
await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
|
|
}
|
|
if (!!cacheRecord.appMetadata) {
|
|
this.setAppMetadata(cacheRecord.appMetadata, correlationId);
|
|
}
|
|
}
|
|
catch (e) {
|
|
this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`, correlationId);
|
|
if (e instanceof AuthError) {
|
|
throw e;
|
|
}
|
|
else {
|
|
throw createCacheError(e);
|
|
}
|
|
}
|
|
}
|
|
/**
|
|
* saves access token credential
|
|
* @param credential
|
|
*/
|
|
async saveAccessToken(credential, correlationId, kmsi) {
|
|
const accessTokenFilter = {
|
|
clientId: credential.clientId,
|
|
credentialType: credential.credentialType,
|
|
environment: credential.environment,
|
|
homeAccountId: credential.homeAccountId,
|
|
realm: credential.realm,
|
|
tokenType: credential.tokenType,
|
|
};
|
|
const tokenKeys = this.getTokenKeys();
|
|
const currentScopes = ScopeSet.fromString(credential.target);
|
|
tokenKeys.accessToken.forEach((key) => {
|
|
if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
|
|
return;
|
|
}
|
|
const tokenEntity = this.getAccessTokenCredential(key, correlationId);
|
|
if (tokenEntity &&
|
|
this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
|
|
const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
|
|
if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
|
|
this.removeAccessToken(key, correlationId);
|
|
}
|
|
}
|
|
});
|
|
await this.setAccessTokenCredential(credential, correlationId, kmsi);
|
|
}
|
|
/**
|
|
* Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
|
|
* Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
|
|
* @param accountFilter - An object containing Account properties to filter by
|
|
*/
|
|
getAccountsFilteredBy(accountFilter, correlationId) {
|
|
const allAccountKeys = this.getAccountKeys();
|
|
const matchingAccounts = [];
|
|
allAccountKeys.forEach((cacheKey) => {
|
|
const entity = this.getAccount(cacheKey, correlationId);
|
|
// Match base account fields
|
|
if (!entity) {
|
|
return;
|
|
}
|
|
if (!!accountFilter.homeAccountId &&
|
|
!this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
|
|
return;
|
|
}
|
|
if (!!accountFilter.environment &&
|
|
!this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
|
|
return;
|
|
}
|
|
if (!!accountFilter.realm &&
|
|
!this.matchRealm(entity, accountFilter.realm)) {
|
|
return;
|
|
}
|
|
if (!!accountFilter.nativeAccountId &&
|
|
!this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
|
|
return;
|
|
}
|
|
if (!!accountFilter.authorityType &&
|
|
!this.matchAuthorityType(entity, accountFilter.authorityType)) {
|
|
return;
|
|
}
|
|
// If at least one tenant profile matches the tenant profile filter, add the account to the list of matching accounts
|
|
const tenantProfileFilter = {
|
|
localAccountId: accountFilter?.localAccountId,
|
|
name: accountFilter?.name,
|
|
username: accountFilter?.username,
|
|
loginHint: accountFilter?.loginHint,
|
|
upn: accountFilter?.upn,
|
|
};
|
|
const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
|
|
return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
|
|
});
|
|
if (matchingTenantProfiles && matchingTenantProfiles.length === 0) {
|
|
// No tenant profile for this account matches filter, don't add to list of matching accounts
|
|
return;
|
|
}
|
|
matchingAccounts.push(entity);
|
|
});
|
|
return matchingAccounts;
|
|
}
|
|
/**
|
|
* Returns whether or not the given credential entity matches the filter
|
|
* @param entity
|
|
* @param filter
|
|
* @param correlationId
|
|
* @returns
|
|
*/
|
|
credentialMatchesFilter(entity, filter, correlationId) {
|
|
if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {
|
|
return false;
|
|
}
|
|
if (!!filter.userAssertionHash &&
|
|
!this.matchUserAssertionHash(entity, filter.userAssertionHash)) {
|
|
return false;
|
|
}
|
|
/*
|
|
* homeAccountId can be undefined, and we want to filter out cached items that have a homeAccountId of ""
|
|
* because we don't want a client_credential request to return a cached token that has a homeAccountId
|
|
*/
|
|
if (typeof filter.homeAccountId === "string" &&
|
|
!this.matchHomeAccountId(entity, filter.homeAccountId)) {
|
|
return false;
|
|
}
|
|
if (!!filter.environment &&
|
|
!this.matchEnvironment(entity, filter.environment, correlationId)) {
|
|
return false;
|
|
}
|
|
if (!!filter.realm && !this.matchRealm(entity, filter.realm)) {
|
|
return false;
|
|
}
|
|
if (!!filter.credentialType &&
|
|
!this.matchCredentialType(entity, filter.credentialType)) {
|
|
return false;
|
|
}
|
|
if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) {
|
|
return false;
|
|
}
|
|
/*
|
|
* idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
|
|
* Resource specific refresh tokens case will be added when the support is deemed necessary
|
|
*/
|
|
if (!!filter.target && !this.matchTarget(entity, filter.target)) {
|
|
return false;
|
|
}
|
|
// Access Token with Auth Scheme specific matching
|
|
if (entity.credentialType ===
|
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
|
|
if (!!filter.tokenType &&
|
|
!this.matchTokenType(entity, filter.tokenType)) {
|
|
return false;
|
|
}
|
|
// KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
|
|
if (filter.tokenType === AuthenticationScheme.SSH) {
|
|
if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
/**
|
|
* retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
|
|
* @param filter
|
|
* @param correlationId
|
|
*/
|
|
getAppMetadataFilteredBy(filter, correlationId) {
|
|
const allCacheKeys = this.getKeys();
|
|
const matchingAppMetadata = {};
|
|
allCacheKeys.forEach((cacheKey) => {
|
|
// don't parse any non-appMetadata type cache entities
|
|
if (!this.isAppMetadata(cacheKey)) {
|
|
return;
|
|
}
|
|
// Attempt retrieval
|
|
const entity = this.getAppMetadata(cacheKey, correlationId);
|
|
if (!entity) {
|
|
return;
|
|
}
|
|
if (!!filter.environment &&
|
|
!this.matchEnvironment(entity, filter.environment, correlationId)) {
|
|
return;
|
|
}
|
|
if (!!filter.clientId &&
|
|
!this.matchClientId(entity, filter.clientId)) {
|
|
return;
|
|
}
|
|
matchingAppMetadata[cacheKey] = entity;
|
|
});
|
|
return matchingAppMetadata;
|
|
}
|
|
/**
|
|
* retrieve authorityMetadata that contains a matching alias
|
|
* @param host
|
|
* @param correlationId
|
|
*/
|
|
getAuthorityMetadataByAlias(host, correlationId) {
|
|
const allCacheKeys = this.getAuthorityMetadataKeys();
|
|
let matchedEntity = null;
|
|
allCacheKeys.forEach((cacheKey) => {
|
|
// don't parse any non-authorityMetadata type cache entities
|
|
if (!this.isAuthorityMetadata(cacheKey) ||
|
|
cacheKey.indexOf(this.clientId) === -1) {
|
|
return;
|
|
}
|
|
// Attempt retrieval
|
|
const entity = this.getAuthorityMetadata(cacheKey, correlationId);
|
|
if (!entity) {
|
|
return;
|
|
}
|
|
if (entity.aliases.indexOf(host) === -1) {
|
|
return;
|
|
}
|
|
matchedEntity = entity;
|
|
});
|
|
return matchedEntity;
|
|
}
|
|
/**
|
|
* Removes all accounts and related tokens from cache.
|
|
*/
|
|
removeAllAccounts(correlationId) {
|
|
const accounts = this.getAllAccounts({}, correlationId);
|
|
accounts.forEach((account) => {
|
|
this.removeAccount(account, correlationId);
|
|
});
|
|
}
|
|
/**
|
|
* Removes the account and related tokens for a given account key
|
|
* @param account
|
|
*/
|
|
removeAccount(account, correlationId) {
|
|
this.removeAccountContext(account, correlationId);
|
|
const accountKeys = this.getAccountKeys();
|
|
const keyFilter = (key) => {
|
|
return (key.includes(account.homeAccountId) &&
|
|
key.includes(account.environment));
|
|
};
|
|
accountKeys.filter(keyFilter).forEach((key) => {
|
|
this.removeItem(key, correlationId);
|
|
this.performanceClient.incrementFields({ accountsRemoved: 1 }, correlationId);
|
|
});
|
|
}
|
|
/**
|
|
* Removes credentials associated with the provided account
|
|
* @param account
|
|
*/
|
|
removeAccountContext(account, correlationId) {
|
|
const allTokenKeys = this.getTokenKeys();
|
|
const keyFilter = (key) => {
|
|
return (key.includes(account.homeAccountId) &&
|
|
key.includes(account.environment));
|
|
};
|
|
allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
|
|
this.removeIdToken(key, correlationId);
|
|
});
|
|
allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
|
|
this.removeAccessToken(key, correlationId);
|
|
});
|
|
allTokenKeys.refreshToken.filter(keyFilter).forEach((key) => {
|
|
this.removeRefreshToken(key, correlationId);
|
|
});
|
|
}
|
|
/**
|
|
* returns a boolean if the given credential is removed
|
|
* @param key
|
|
* @param correlationId
|
|
*/
|
|
removeAccessToken(key, correlationId) {
|
|
const credential = this.getAccessTokenCredential(key, correlationId);
|
|
if (!credential) {
|
|
return;
|
|
}
|
|
this.removeItem(key, correlationId);
|
|
this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
|
|
// Remove Token Binding Key from key store for PoP Tokens Credentials
|
|
if (credential.credentialType.toLowerCase() ===
|
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
|
|
if (credential.tokenType === AuthenticationScheme.POP) {
|
|
const accessTokenWithAuthSchemeEntity = credential;
|
|
const kid = accessTokenWithAuthSchemeEntity.keyId;
|
|
if (kid) {
|
|
void this.cryptoImpl
|
|
.removeTokenBindingKey(kid, correlationId)
|
|
.catch(() => {
|
|
this.commonLogger.error(`Failed to remove token binding key '${kid}'`, correlationId);
|
|
this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
|
|
});
|
|
}
|
|
}
|
|
}
|
|
}
|
|
/**
|
|
* Removes all app metadata objects from cache.
|
|
*/
|
|
removeAppMetadata(correlationId) {
|
|
const allCacheKeys = this.getKeys();
|
|
allCacheKeys.forEach((cacheKey) => {
|
|
if (this.isAppMetadata(cacheKey)) {
|
|
this.removeItem(cacheKey, correlationId);
|
|
}
|
|
});
|
|
return true;
|
|
}
|
|
/**
|
|
* Retrieve IdTokenEntity from cache
|
|
* @param account {AccountInfo}
|
|
* @param tokenKeys {?TokenKeys}
|
|
* @param targetRealm {?string}
|
|
* @param performanceClient {?IPerformanceClient}
|
|
* @param correlationId {?string}
|
|
*/
|
|
getIdToken(account, correlationId, tokenKeys, targetRealm) {
|
|
this.commonLogger.trace("CacheManager - getIdToken called", correlationId);
|
|
const idTokenFilter = {
|
|
homeAccountId: account.homeAccountId,
|
|
environment: account.environment,
|
|
credentialType: CredentialType.ID_TOKEN,
|
|
clientId: this.clientId,
|
|
realm: targetRealm,
|
|
};
|
|
const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
|
|
const numIdTokens = idTokenMap.size;
|
|
if (numIdTokens < 1) {
|
|
this.commonLogger.info("CacheManager:getIdToken - No token found", correlationId);
|
|
return null;
|
|
}
|
|
else if (numIdTokens > 1) {
|
|
let tokensToBeRemoved = idTokenMap;
|
|
// Multiple tenant profiles and no tenant specified, pick home account
|
|
if (!targetRealm) {
|
|
const homeIdTokenMap = new Map();
|
|
idTokenMap.forEach((idToken, key) => {
|
|
if (idToken.realm === account.tenantId) {
|
|
homeIdTokenMap.set(key, idToken);
|
|
}
|
|
});
|
|
const numHomeIdTokens = homeIdTokenMap.size;
|
|
if (numHomeIdTokens < 1) {
|
|
this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result", correlationId);
|
|
return idTokenMap.values().next().value ?? null;
|
|
}
|
|
else if (numHomeIdTokens === 1) {
|
|
this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile", correlationId);
|
|
return homeIdTokenMap.values().next().value ?? null;
|
|
}
|
|
else {
|
|
// Multiple ID tokens for home tenant profile, remove all and return null
|
|
tokensToBeRemoved = homeIdTokenMap;
|
|
}
|
|
}
|
|
// Multiple tokens for a single tenant profile, remove all and return null
|
|
this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them", correlationId);
|
|
tokensToBeRemoved.forEach((idToken, key) => {
|
|
this.removeIdToken(key, correlationId);
|
|
});
|
|
this.performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
|
|
return null;
|
|
}
|
|
this.commonLogger.info("CacheManager:getIdToken - Returning ID token", correlationId);
|
|
return idTokenMap.values().next().value ?? null;
|
|
}
|
|
/**
|
|
* Gets all idTokens matching the given filter
|
|
* @param filter
|
|
* @returns
|
|
*/
|
|
getIdTokensByFilter(filter, correlationId, tokenKeys) {
|
|
const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
|
|
const idTokens = new Map();
|
|
idTokenKeys.forEach((key) => {
|
|
if (!this.idTokenKeyMatchesFilter(key, {
|
|
clientId: this.clientId,
|
|
...filter,
|
|
})) {
|
|
return;
|
|
}
|
|
const idToken = this.getIdTokenCredential(key, correlationId);
|
|
if (idToken &&
|
|
this.credentialMatchesFilter(idToken, filter, correlationId)) {
|
|
idTokens.set(key, idToken);
|
|
}
|
|
});
|
|
return idTokens;
|
|
}
|
|
/**
|
|
* Validate the cache key against filter before retrieving and parsing cache value
|
|
* @param key
|
|
* @param filter
|
|
* @returns
|
|
*/
|
|
idTokenKeyMatchesFilter(inputKey, filter) {
|
|
const key = inputKey.toLowerCase();
|
|
if (filter.clientId &&
|
|
key.indexOf(filter.clientId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
if (filter.homeAccountId &&
|
|
key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
/**
|
|
* Removes idToken from the cache
|
|
* @param key
|
|
*/
|
|
removeIdToken(key, correlationId) {
|
|
this.removeItem(key, correlationId);
|
|
}
|
|
/**
|
|
* Removes refresh token from the cache
|
|
* @param key
|
|
*/
|
|
removeRefreshToken(key, correlationId) {
|
|
this.removeItem(key, correlationId);
|
|
}
|
|
/**
|
|
* Retrieve AccessTokenEntity from cache
|
|
* @param account {AccountInfo}
|
|
* @param request {BaseAuthRequest}
|
|
* @param tokenKeys {?TokenKeys}
|
|
* @param performanceClient {?IPerformanceClient}
|
|
*/
|
|
getAccessToken(account, request, tokenKeys, targetRealm) {
|
|
const correlationId = request.correlationId;
|
|
this.commonLogger.trace("CacheManager - getAccessToken called", correlationId);
|
|
const scopes = ScopeSet.createSearchScopes(request.scopes);
|
|
const authScheme = request.authenticationScheme ||
|
|
AuthenticationScheme.BEARER;
|
|
/*
|
|
* Distinguish between Bearer and PoP/SSH token cache types
|
|
* Cast to lowercase to handle "bearer" from ADFS
|
|
*/
|
|
const credentialType = authScheme &&
|
|
authScheme.toLowerCase() !==
|
|
AuthenticationScheme.BEARER.toLowerCase()
|
|
? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
|
|
: CredentialType.ACCESS_TOKEN;
|
|
const accessTokenFilter = {
|
|
homeAccountId: account.homeAccountId,
|
|
environment: account.environment,
|
|
credentialType: credentialType,
|
|
clientId: this.clientId,
|
|
realm: targetRealm || account.tenantId,
|
|
target: scopes,
|
|
tokenType: authScheme,
|
|
keyId: request.sshKid,
|
|
};
|
|
const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||
|
|
this.getTokenKeys().accessToken;
|
|
const accessTokens = [];
|
|
accessTokenKeys.forEach((key) => {
|
|
// Validate key
|
|
if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
|
|
const accessToken = this.getAccessTokenCredential(key, correlationId);
|
|
// Validate value
|
|
if (accessToken &&
|
|
this.credentialMatchesFilter(accessToken, accessTokenFilter, correlationId)) {
|
|
accessTokens.push(accessToken);
|
|
}
|
|
}
|
|
});
|
|
const numAccessTokens = accessTokens.length;
|
|
if (numAccessTokens < 1) {
|
|
this.commonLogger.info("CacheManager:getAccessToken - No token found", correlationId);
|
|
return null;
|
|
}
|
|
else if (numAccessTokens > 1) {
|
|
this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them", correlationId);
|
|
accessTokens.forEach((accessToken) => {
|
|
this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
|
|
});
|
|
this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
|
|
return null;
|
|
}
|
|
this.commonLogger.info("CacheManager:getAccessToken - Returning access token", correlationId);
|
|
return accessTokens[0];
|
|
}
|
|
/**
|
|
* Validate the cache key against filter before retrieving and parsing cache value
|
|
* @param key
|
|
* @param filter
|
|
* @param keyMustContainAllScopes
|
|
* @returns
|
|
*/
|
|
accessTokenKeyMatchesFilter(inputKey, filter, keyMustContainAllScopes) {
|
|
const key = inputKey.toLowerCase();
|
|
if (filter.clientId &&
|
|
key.indexOf(filter.clientId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
if (filter.homeAccountId &&
|
|
key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
if (filter.target) {
|
|
const scopes = filter.target.asArray();
|
|
for (let i = 0; i < scopes.length; i++) {
|
|
if (keyMustContainAllScopes &&
|
|
!key.includes(scopes[i].toLowerCase())) {
|
|
// When performing a cache lookup a missing scope would be a cache miss
|
|
return false;
|
|
}
|
|
else if (!keyMustContainAllScopes &&
|
|
key.includes(scopes[i].toLowerCase())) {
|
|
// When performing a cache write, any token with a subset of requested scopes should be replaced
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
/**
|
|
* Gets all access tokens matching the filter
|
|
* @param filter
|
|
* @returns
|
|
*/
|
|
getAccessTokensByFilter(filter, correlationId) {
|
|
const tokenKeys = this.getTokenKeys();
|
|
const accessTokens = [];
|
|
tokenKeys.accessToken.forEach((key) => {
|
|
if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
|
|
return;
|
|
}
|
|
const accessToken = this.getAccessTokenCredential(key, correlationId);
|
|
if (accessToken &&
|
|
this.credentialMatchesFilter(accessToken, filter, correlationId)) {
|
|
accessTokens.push(accessToken);
|
|
}
|
|
});
|
|
return accessTokens;
|
|
}
|
|
/**
|
|
* Helper to retrieve the appropriate refresh token from cache
|
|
* @param account {AccountInfo}
|
|
* @param familyRT {boolean}
|
|
* @param tokenKeys {?TokenKeys}
|
|
* @param performanceClient {?IPerformanceClient}
|
|
* @param correlationId {?string}
|
|
*/
|
|
getRefreshToken(account, familyRT, correlationId, tokenKeys) {
|
|
this.commonLogger.trace("CacheManager - getRefreshToken called", correlationId);
|
|
const id = familyRT ? THE_FAMILY_ID : undefined;
|
|
const refreshTokenFilter = {
|
|
homeAccountId: account.homeAccountId,
|
|
environment: account.environment,
|
|
credentialType: CredentialType.REFRESH_TOKEN,
|
|
clientId: this.clientId,
|
|
familyId: id,
|
|
};
|
|
const refreshTokenKeys = (tokenKeys && tokenKeys.refreshToken) ||
|
|
this.getTokenKeys().refreshToken;
|
|
const refreshTokens = [];
|
|
refreshTokenKeys.forEach((key) => {
|
|
// Validate key
|
|
if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
|
|
const refreshToken = this.getRefreshTokenCredential(key, correlationId);
|
|
// Validate value
|
|
if (refreshToken &&
|
|
this.credentialMatchesFilter(refreshToken, refreshTokenFilter, correlationId)) {
|
|
refreshTokens.push(refreshToken);
|
|
}
|
|
}
|
|
});
|
|
const numRefreshTokens = refreshTokens.length;
|
|
if (numRefreshTokens < 1) {
|
|
this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found.", correlationId);
|
|
return null;
|
|
}
|
|
// address the else case after remove functions address environment aliases
|
|
if (numRefreshTokens > 1) {
|
|
this.performanceClient.addFields({ multiMatchedRT: numRefreshTokens }, correlationId);
|
|
}
|
|
this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token", correlationId);
|
|
return refreshTokens[0];
|
|
}
|
|
/**
|
|
* Validate the cache key against filter before retrieving and parsing cache value
|
|
* @param key
|
|
* @param filter
|
|
*/
|
|
refreshTokenKeyMatchesFilter(inputKey, filter) {
|
|
const key = inputKey.toLowerCase();
|
|
if (filter.familyId &&
|
|
key.indexOf(filter.familyId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
// If familyId is used, clientId is not in the key
|
|
if (!filter.familyId &&
|
|
filter.clientId &&
|
|
key.indexOf(filter.clientId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
if (filter.homeAccountId &&
|
|
key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
/**
|
|
* Retrieve AppMetadataEntity from cache
|
|
*/
|
|
readAppMetadataFromCache(environment, correlationId) {
|
|
const appMetadataFilter = {
|
|
environment,
|
|
clientId: this.clientId,
|
|
};
|
|
const appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter, correlationId);
|
|
const appMetadataEntries = Object.keys(appMetadata).map((key) => appMetadata[key]);
|
|
const numAppMetadata = appMetadataEntries.length;
|
|
if (numAppMetadata < 1) {
|
|
return null;
|
|
}
|
|
else if (numAppMetadata > 1) {
|
|
throw createClientAuthError(multipleMatchingAppMetadata);
|
|
}
|
|
return appMetadataEntries[0];
|
|
}
|
|
/**
|
|
* Return the family_id value associated with FOCI
|
|
* @param environment
|
|
* @param clientId
|
|
*/
|
|
isAppMetadataFOCI(environment, correlationId) {
|
|
const appMetadata = this.readAppMetadataFromCache(environment, correlationId);
|
|
return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);
|
|
}
|
|
/**
|
|
* helper to match account ids
|
|
* @param value
|
|
* @param homeAccountId
|
|
*/
|
|
matchHomeAccountId(entity, homeAccountId) {
|
|
return !!(typeof entity.homeAccountId === "string" &&
|
|
homeAccountId === entity.homeAccountId);
|
|
}
|
|
/**
|
|
* helper to match account ids
|
|
* @param entity
|
|
* @param localAccountId
|
|
* @returns
|
|
*/
|
|
matchLocalAccountIdFromTokenClaims(tokenClaims, localAccountId) {
|
|
const idTokenLocalAccountId = tokenClaims.oid || tokenClaims.sub;
|
|
return localAccountId === idTokenLocalAccountId;
|
|
}
|
|
matchLocalAccountIdFromTenantProfile(tenantProfile, localAccountId) {
|
|
return tenantProfile.localAccountId === localAccountId;
|
|
}
|
|
/**
|
|
* helper to match names
|
|
* @param entity
|
|
* @param name
|
|
* @returns true if the downcased name properties are present and match in the filter and the entity
|
|
*/
|
|
matchName(claims, name) {
|
|
return !!(name.toLowerCase() === claims.name?.toLowerCase());
|
|
}
|
|
/**
|
|
* helper to match usernames
|
|
* @param entity
|
|
* @param username
|
|
* @returns
|
|
*/
|
|
matchUsername(cachedUsername, filterUsername) {
|
|
return !!(cachedUsername &&
|
|
typeof cachedUsername === "string" &&
|
|
filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
|
|
}
|
|
/**
|
|
* helper to match loginhints
|
|
* @param entity
|
|
* @param loginHint
|
|
* @returns
|
|
*/
|
|
matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
|
|
return (tenantProfile.loginHint === loginHintFilter ||
|
|
tenantProfile.username === loginHintFilter ||
|
|
tenantProfile.upn === loginHintFilter);
|
|
}
|
|
/**
|
|
* helper to match assertion
|
|
* @param value
|
|
* @param oboAssertion
|
|
*/
|
|
matchUserAssertionHash(entity, userAssertionHash) {
|
|
return !!(entity.userAssertionHash &&
|
|
userAssertionHash === entity.userAssertionHash);
|
|
}
|
|
/**
|
|
* helper to match environment
|
|
* @param value
|
|
* @param environment
|
|
*/
|
|
matchEnvironment(entity, environment, correlationId) {
|
|
// Check static authority options first for cases where authority metadata has not been resolved and cached yet
|
|
if (this.staticAuthorityOptions) {
|
|
const staticAliases = getAliasesFromStaticSources(this.staticAuthorityOptions, this.commonLogger, correlationId);
|
|
if (staticAliases.includes(environment) &&
|
|
staticAliases.includes(entity.environment)) {
|
|
return true;
|
|
}
|
|
}
|
|
// Query metadata cache if no static authority configuration has aliases that match enviroment
|
|
const cloudMetadata = this.getAuthorityMetadataByAlias(environment, correlationId);
|
|
if (cloudMetadata &&
|
|
cloudMetadata.aliases.indexOf(entity.environment) > -1) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
/**
|
|
* helper to match credential type
|
|
* @param entity
|
|
* @param credentialType
|
|
*/
|
|
matchCredentialType(entity, credentialType) {
|
|
return (entity.credentialType &&
|
|
credentialType.toLowerCase() === entity.credentialType.toLowerCase());
|
|
}
|
|
/**
|
|
* helper to match client ids
|
|
* @param entity
|
|
* @param clientId
|
|
*/
|
|
matchClientId(entity, clientId) {
|
|
return !!(entity.clientId && clientId === entity.clientId);
|
|
}
|
|
/**
|
|
* helper to match family ids
|
|
* @param entity
|
|
* @param familyId
|
|
*/
|
|
matchFamilyId(entity, familyId) {
|
|
return !!(entity.familyId && familyId === entity.familyId);
|
|
}
|
|
/**
|
|
* helper to match realm
|
|
* @param entity
|
|
* @param realm
|
|
*/
|
|
matchRealm(entity, realm) {
|
|
return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
|
|
}
|
|
/**
|
|
* helper to match nativeAccountId
|
|
* @param entity
|
|
* @param nativeAccountId
|
|
* @returns boolean indicating the match result
|
|
*/
|
|
matchNativeAccountId(entity, nativeAccountId) {
|
|
return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
|
|
}
|
|
/**
|
|
* helper to match loginHint which can be either:
|
|
* 1. login_hint ID token claim
|
|
* 2. username in cached account object
|
|
* 3. upn in ID token claims
|
|
* @param entity
|
|
* @param loginHint
|
|
* @returns
|
|
*/
|
|
matchLoginHintFromTokenClaims(tokenClaims, loginHint) {
|
|
if (tokenClaims.login_hint === loginHint) {
|
|
return true;
|
|
}
|
|
if (tokenClaims.preferred_username === loginHint) {
|
|
return true;
|
|
}
|
|
if (tokenClaims.upn === loginHint) {
|
|
return true;
|
|
}
|
|
// check login hint against list of emails in token claims
|
|
if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
/**
|
|
* Helper to match sid
|
|
* @param entity
|
|
* @param sid
|
|
* @returns true if the sid claim is present and matches the filter
|
|
*/
|
|
matchSid(idTokenClaims, sid) {
|
|
return idTokenClaims.sid === sid;
|
|
}
|
|
matchAuthorityType(entity, authorityType) {
|
|
return !!(entity.authorityType &&
|
|
authorityType.toLowerCase() === entity.authorityType.toLowerCase());
|
|
}
|
|
/**
|
|
* Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
|
|
* @param entity
|
|
* @param target
|
|
*/
|
|
matchTarget(entity, target) {
|
|
const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&
|
|
entity.credentialType !==
|
|
CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
|
|
if (isNotAccessTokenCredential || !entity.target) {
|
|
return false;
|
|
}
|
|
const entityScopeSet = ScopeSet.fromString(entity.target);
|
|
return entityScopeSet.containsScopeSet(target);
|
|
}
|
|
/**
|
|
* Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
|
|
* @param entity
|
|
* @param tokenType
|
|
*/
|
|
matchTokenType(entity, tokenType) {
|
|
return !!(entity.tokenType && entity.tokenType === tokenType);
|
|
}
|
|
/**
|
|
* Returns true if the credential's keyId matches the one in the request, false otherwise
|
|
* @param entity
|
|
* @param keyId
|
|
*/
|
|
matchKeyId(entity, keyId) {
|
|
return !!(entity.keyId && entity.keyId === keyId);
|
|
}
|
|
/**
|
|
* returns if a given cache entity is of the type appmetadata
|
|
* @param key
|
|
*/
|
|
isAppMetadata(key) {
|
|
return key.indexOf(APP_METADATA) !== -1;
|
|
}
|
|
/**
|
|
* returns if a given cache entity is of the type authoritymetadata
|
|
* @param key
|
|
*/
|
|
isAuthorityMetadata(key) {
|
|
return key.indexOf(AUTHORITY_METADATA_CACHE_KEY) !== -1;
|
|
}
|
|
/**
|
|
* returns cache key used for cloud instance metadata
|
|
*/
|
|
generateAuthorityMetadataCacheKey(authority) {
|
|
return `${AUTHORITY_METADATA_CACHE_KEY}-${this.clientId}-${authority}`;
|
|
}
|
|
/**
|
|
* Helper to convert serialized data to object
|
|
* @param obj
|
|
* @param json
|
|
*/
|
|
static toObject(obj, json) {
|
|
for (const propertyName in json) {
|
|
obj[propertyName] = json[propertyName];
|
|
}
|
|
return obj;
|
|
}
|
|
}
|
|
/** @internal */
|
|
class DefaultStorageClass extends CacheManager {
|
|
async setAccount() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getAccount() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
async setIdTokenCredential() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getIdTokenCredential() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
async setAccessTokenCredential() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getAccessTokenCredential() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
async setRefreshTokenCredential() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getRefreshTokenCredential() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
setAppMetadata() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getAppMetadata() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
setServerTelemetry() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getServerTelemetry() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
setAuthorityMetadata() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getAuthorityMetadata() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getAuthorityMetadataKeys() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
setThrottlingCache() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getThrottlingCache() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
removeItem() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getKeys() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getAccountKeys() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
getTokenKeys() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
generateCredentialKey() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
generateAccountKey() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* State of the performance event.
|
|
*
|
|
* @export
|
|
* @enum {number}
|
|
*/
|
|
const PerformanceEventStatus = {
|
|
NotStarted: 0,
|
|
InProgress: 1,
|
|
Completed: 2,
|
|
};
|
|
/**
|
|
* Prefix used to mark telemetry field names as dynamic.
|
|
* Fields with this prefix in addFields/incrementFields calls will be routed
|
|
* to the PerformanceEvent.ext sub-object.
|
|
*/
|
|
const EXT_FIELD_PREFIX = "ext.";
|
|
const IntFields = new Set([
|
|
"accessTokenSize",
|
|
"durationMs",
|
|
"idTokenSize",
|
|
"matsSilentStatus",
|
|
"matsHttpStatus",
|
|
"refreshTokenSize",
|
|
"startTimeMs",
|
|
"status",
|
|
"multiMatchedAT",
|
|
"multiMatchedID",
|
|
"multiMatchedRT",
|
|
"unencryptedCacheCount",
|
|
"encryptedCacheExpiredCount",
|
|
"oldAccountCount",
|
|
"oldAccessCount",
|
|
"oldIdCount",
|
|
"oldRefreshCount",
|
|
"currAccountCount",
|
|
"currAccessCount",
|
|
"currIdCount",
|
|
"currRefreshCount",
|
|
"expiredCacheRemovedCount",
|
|
"upgradedCacheCount",
|
|
"cacheMatchedAccounts",
|
|
"networkRtt",
|
|
"redirectBridgeTimeoutMs",
|
|
"redirectBridgeMessageVersion",
|
|
]);
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
class StubPerformanceClient {
|
|
generateId() {
|
|
return "callback-id";
|
|
}
|
|
startMeasurement(measureName, correlationId) {
|
|
return {
|
|
end: () => null,
|
|
discard: () => { },
|
|
add: () => { },
|
|
increment: () => { },
|
|
event: {
|
|
eventId: this.generateId(),
|
|
status: PerformanceEventStatus.InProgress,
|
|
authority: "",
|
|
libraryName: "",
|
|
libraryVersion: "",
|
|
clientId: "",
|
|
name: measureName,
|
|
startTimeMs: Date.now(),
|
|
correlationId: correlationId || "",
|
|
},
|
|
};
|
|
}
|
|
endMeasurement() {
|
|
return null;
|
|
}
|
|
discardMeasurements() {
|
|
return;
|
|
}
|
|
removePerformanceCallback() {
|
|
return true;
|
|
}
|
|
addPerformanceCallback() {
|
|
return "";
|
|
}
|
|
emitEvents() {
|
|
return;
|
|
}
|
|
addFields() {
|
|
return;
|
|
}
|
|
incrementFields() {
|
|
return;
|
|
}
|
|
cacheEventByCorrelationId() {
|
|
return;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const DEFAULT_SYSTEM_OPTIONS = {
|
|
tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
|
|
preventCorsPreflight: false,
|
|
};
|
|
const DEFAULT_LOGGER_IMPLEMENTATION = {
|
|
loggerCallback: () => {
|
|
// allow users to not set loggerCallback
|
|
},
|
|
piiLoggingEnabled: false,
|
|
logLevel: exports.LogLevel.Info,
|
|
correlationId: "",
|
|
};
|
|
const DEFAULT_NETWORK_IMPLEMENTATION = {
|
|
async sendGetRequestAsync() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
async sendPostRequestAsync() {
|
|
throw createClientAuthError(methodNotImplemented);
|
|
},
|
|
};
|
|
const DEFAULT_LIBRARY_INFO = {
|
|
sku: SKU,
|
|
version: version,
|
|
cpu: "",
|
|
os: "",
|
|
};
|
|
const DEFAULT_CLIENT_CREDENTIALS = {
|
|
clientSecret: "",
|
|
clientAssertion: undefined,
|
|
};
|
|
const DEFAULT_AZURE_CLOUD_OPTIONS = {
|
|
azureCloudInstance: AzureCloudInstance.None,
|
|
tenant: `${DEFAULT_COMMON_TENANT}`,
|
|
};
|
|
const DEFAULT_TELEMETRY_OPTIONS = {
|
|
application: {
|
|
appName: "",
|
|
appVersion: "",
|
|
},
|
|
};
|
|
/**
|
|
* Function that sets the default options when not explicitly configured from app developer
|
|
*
|
|
* @param Configuration
|
|
*
|
|
* @returns Configuration
|
|
*/
|
|
function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
|
|
const loggerOptions = {
|
|
...DEFAULT_LOGGER_IMPLEMENTATION,
|
|
...userLoggerOption,
|
|
};
|
|
return {
|
|
authOptions: buildAuthOptions(userAuthOptions),
|
|
systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
|
|
loggerOptions: loggerOptions,
|
|
storageInterface: storageImplementation ||
|
|
new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
|
|
networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
|
|
cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
|
|
clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
|
|
libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
|
|
telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
|
|
serverTelemetryManager: serverTelemetryManager || null,
|
|
persistencePlugin: persistencePlugin || null,
|
|
serializableCache: serializableCache || null,
|
|
};
|
|
}
|
|
/**
|
|
* Construct authoptions from the client and platform passed values
|
|
* @param authOptions
|
|
*/
|
|
function buildAuthOptions(authOptions) {
|
|
return {
|
|
clientCapabilities: [],
|
|
azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
|
|
instanceAware: false,
|
|
isMcp: false,
|
|
...authOptions,
|
|
};
|
|
}
|
|
/**
|
|
* Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
|
|
* @param ClientConfiguration
|
|
*/
|
|
function isOidcProtocolMode(config) {
|
|
return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* This class instance helps track the memory changes facilitating
|
|
* decisions to read from and write to the persistent cache
|
|
*/ class TokenCacheContext {
|
|
constructor(tokenCache, hasChanged) {
|
|
this.cache = tokenCache;
|
|
this.hasChanged = hasChanged;
|
|
}
|
|
/**
|
|
* boolean which indicates the changes in cache
|
|
*/
|
|
get cacheHasChanged() {
|
|
return this.hasChanged;
|
|
}
|
|
/**
|
|
* function to retrieve the token cache
|
|
*/
|
|
get tokenCache() {
|
|
return this.cache;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const KeyLocation = {
|
|
SW: "sw"};
|
|
/** @internal */
|
|
class PopTokenGenerator {
|
|
constructor(cryptoUtils, performanceClient) {
|
|
this.cryptoUtils = cryptoUtils;
|
|
this.performanceClient = performanceClient;
|
|
}
|
|
/**
|
|
* Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
|
|
* and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
|
|
* @param request
|
|
* @returns
|
|
*/
|
|
async generateCnf(request, logger) {
|
|
const reqCnf = await invokeAsync(this.generateKid.bind(this), PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
|
|
const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
|
|
return {
|
|
kid: reqCnf.kid,
|
|
reqCnfString,
|
|
};
|
|
}
|
|
/**
|
|
* Generates key_id for a SHR token request
|
|
* @param request
|
|
* @returns
|
|
*/
|
|
async generateKid(request) {
|
|
const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
|
|
return {
|
|
kid: kidThumbprint,
|
|
xms_ksl: KeyLocation.SW,
|
|
};
|
|
}
|
|
/**
|
|
* Signs the POP access_token with the local generated key-pair
|
|
* @param accessToken
|
|
* @param request
|
|
* @returns
|
|
*/
|
|
async signPopToken(accessToken, keyId, request) {
|
|
return this.signPayload(accessToken, keyId, request);
|
|
}
|
|
/**
|
|
* Utility function to generate the signed JWT for an access_token
|
|
* @param payload
|
|
* @param kid
|
|
* @param request
|
|
* @param claims
|
|
* @returns
|
|
*/
|
|
async signPayload(payload, keyId, request, claims) {
|
|
// Deconstruct request to extract SHR parameters
|
|
const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
|
|
const resourceUrlString = resourceRequestUri
|
|
? new UrlString(resourceRequestUri)
|
|
: undefined;
|
|
const resourceUrlComponents = resourceUrlString?.getUrlComponents();
|
|
return this.cryptoUtils.signJwt({
|
|
at: payload,
|
|
ts: nowSeconds(),
|
|
m: resourceRequestMethod?.toUpperCase(),
|
|
u: resourceUrlComponents?.HostNameAndPort,
|
|
nonce: shrNonce || this.cryptoUtils.createNewGuid(),
|
|
p: resourceUrlComponents?.AbsolutePath,
|
|
q: resourceUrlComponents?.QueryString
|
|
? [[], resourceUrlComponents.QueryString]
|
|
: undefined,
|
|
client_claims: shrClaims || undefined,
|
|
...claims,
|
|
}, keyId, shrOptions, request.correlationId);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* MSAL-defined interaction required error code indicating no tokens are found in cache.
|
|
* @public
|
|
*/
|
|
const noTokensFound = "no_tokens_found";
|
|
/**
|
|
* MSAL-defined error code indicating a native account is unavailable on the platform.
|
|
* @public
|
|
*/
|
|
const nativeAccountUnavailable = "native_account_unavailable";
|
|
/**
|
|
* MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
|
|
* @public
|
|
*/
|
|
const refreshTokenExpired = "refresh_token_expired";
|
|
/**
|
|
* MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
|
|
* @public
|
|
*/
|
|
const uxNotAllowed = "ux_not_allowed";
|
|
/**
|
|
* Server-originated error code indicating interaction is required to complete the request.
|
|
* @public
|
|
*/
|
|
const interactionRequired = "interaction_required";
|
|
/**
|
|
* Server-originated error code indicating user consent is required.
|
|
* @public
|
|
*/
|
|
const consentRequired = "consent_required";
|
|
/**
|
|
* Server-originated error code indicating user login is required.
|
|
* @public
|
|
*/
|
|
const loginRequired = "login_required";
|
|
/**
|
|
* Server-originated error code indicating the token is invalid or corrupted.
|
|
* @public
|
|
*/
|
|
const badToken = "bad_token";
|
|
/**
|
|
* Server-originated error code indicating the user is in an interrupted state and interaction is required.
|
|
* @public
|
|
*/
|
|
const interruptedUser = "interrupted_user";
|
|
|
|
var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
badToken: badToken,
|
|
consentRequired: consentRequired,
|
|
interactionRequired: interactionRequired,
|
|
interruptedUser: interruptedUser,
|
|
loginRequired: loginRequired,
|
|
nativeAccountUnavailable: nativeAccountUnavailable,
|
|
noTokensFound: noTokensFound,
|
|
refreshTokenExpired: refreshTokenExpired,
|
|
uxNotAllowed: uxNotAllowed
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
|
|
*/
|
|
const InteractionRequiredServerErrorMessage = [
|
|
interactionRequired,
|
|
consentRequired,
|
|
loginRequired,
|
|
badToken,
|
|
uxNotAllowed,
|
|
interruptedUser,
|
|
];
|
|
const InteractionRequiredAuthSubErrorMessage = [
|
|
"message_only",
|
|
"additional_action",
|
|
"basic_action",
|
|
"user_password_expired",
|
|
"consent_required",
|
|
"bad_token",
|
|
"ux_not_allowed",
|
|
"interrupted_user",
|
|
];
|
|
/**
|
|
* Error thrown when user interaction is required.
|
|
*/
|
|
class InteractionRequiredAuthError extends AuthError {
|
|
constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
|
|
super(errorCode, errorMessage, subError);
|
|
Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
|
|
this.timestamp = timestamp || "";
|
|
this.traceId = traceId || "";
|
|
this.correlationId = correlationId || "";
|
|
this.claims = claims || "";
|
|
this.name = "InteractionRequiredAuthError";
|
|
this.errorNo = errorNo;
|
|
}
|
|
}
|
|
/**
|
|
* Helper function used to determine if an error thrown by the server requires interaction to resolve
|
|
* @param errorCode
|
|
* @param errorString
|
|
* @param subError
|
|
*/
|
|
function isInteractionRequiredError(errorCode, errorString, subError) {
|
|
const isInteractionRequiredErrorCode = !!errorCode &&
|
|
InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
|
|
const isInteractionRequiredSubError = !!subError &&
|
|
InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
|
|
const isInteractionRequiredErrorDesc = !!errorString &&
|
|
InteractionRequiredServerErrorMessage.some((irErrorCode) => {
|
|
return errorString.indexOf(irErrorCode) > -1;
|
|
});
|
|
return (isInteractionRequiredErrorCode ||
|
|
isInteractionRequiredErrorDesc ||
|
|
isInteractionRequiredSubError);
|
|
}
|
|
/**
|
|
* Creates an InteractionRequiredAuthError
|
|
*/
|
|
function createInteractionRequiredAuthError(errorCode, errorMessage) {
|
|
return new InteractionRequiredAuthError(errorCode, errorMessage);
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Error thrown when there is an error with the server code, for example, unavailability.
|
|
*/
|
|
class ServerError extends AuthError {
|
|
constructor(errorCode, errorMessage, subError, errorNo, status) {
|
|
super(errorCode, errorMessage, subError);
|
|
this.name = "ServerError";
|
|
this.errorNo = errorNo;
|
|
this.status = status;
|
|
Object.setPrototypeOf(this, ServerError.prototype);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Appends user state with random guid, or returns random guid.
|
|
* @param cryptoObj
|
|
* @param userState
|
|
* @param meta
|
|
*/
|
|
function setRequestState(cryptoObj, userState, meta) {
|
|
const libraryState = generateLibraryState(cryptoObj, meta);
|
|
return userState
|
|
? `${libraryState}${RESOURCE_DELIM}${userState}`
|
|
: libraryState;
|
|
}
|
|
/**
|
|
* Generates the state value used by the common library.
|
|
* @param cryptoObj
|
|
* @param meta
|
|
*/
|
|
function generateLibraryState(cryptoObj, meta) {
|
|
if (!cryptoObj) {
|
|
throw createClientAuthError(noCryptoObject);
|
|
}
|
|
// Create a state object containing a unique id and the timestamp of the request creation
|
|
const stateObj = {
|
|
id: cryptoObj.createNewGuid(),
|
|
};
|
|
if (meta) {
|
|
stateObj.meta = meta;
|
|
}
|
|
const stateString = JSON.stringify(stateObj);
|
|
return cryptoObj.base64Encode(stateString);
|
|
}
|
|
/**
|
|
* Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
|
|
* @param base64Decode
|
|
* @param state
|
|
*/
|
|
function parseRequestState(base64Decode, state) {
|
|
if (!base64Decode) {
|
|
throw createClientAuthError(noCryptoObject);
|
|
}
|
|
if (!state) {
|
|
throw createClientAuthError(invalidState);
|
|
}
|
|
try {
|
|
// Split the state between library state and user passed state and decode them separately
|
|
const splitState = state.split(RESOURCE_DELIM);
|
|
const libraryState = splitState[0];
|
|
const userState = splitState.length > 1
|
|
? splitState.slice(1).join(RESOURCE_DELIM)
|
|
: "";
|
|
const libraryStateString = base64Decode(libraryState);
|
|
const libraryStateObj = JSON.parse(libraryStateString);
|
|
return {
|
|
userRequestState: userState || "",
|
|
libraryState: libraryStateObj,
|
|
};
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(invalidState);
|
|
}
|
|
}
|
|
|
|
var ProtocolUtils = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
generateLibraryState: generateLibraryState,
|
|
parseRequestState: parseRequestState,
|
|
setRequestState: setRequestState
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Class that handles response parsing.
|
|
* @internal
|
|
*/
|
|
class ResponseHandler {
|
|
constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin) {
|
|
this.clientId = clientId;
|
|
this.cacheStorage = cacheStorage;
|
|
this.cryptoObj = cryptoObj;
|
|
this.logger = logger;
|
|
this.performanceClient = performanceClient;
|
|
this.serializableCache = serializableCache;
|
|
this.persistencePlugin = persistencePlugin;
|
|
}
|
|
/**
|
|
* Function which validates server authorization token response.
|
|
* @param serverResponse
|
|
* @param correlationId
|
|
* @param refreshAccessToken
|
|
*/
|
|
validateTokenResponse(serverResponse, correlationId, refreshAccessToken) {
|
|
// Check for error
|
|
if (serverResponse.error ||
|
|
serverResponse.error_description ||
|
|
serverResponse.suberror) {
|
|
const errString = `Error(s): ${serverResponse.error_codes || NOT_AVAILABLE} - Timestamp: ${serverResponse.timestamp || NOT_AVAILABLE} - Description: ${serverResponse.error_description || NOT_AVAILABLE} - Correlation ID: ${serverResponse.correlation_id || NOT_AVAILABLE} - Trace ID: ${serverResponse.trace_id || NOT_AVAILABLE}`;
|
|
const serverErrorNo = serverResponse.error_codes?.length
|
|
? serverResponse.error_codes[0]
|
|
: undefined;
|
|
const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
|
|
// check if 500 error
|
|
if (refreshAccessToken &&
|
|
serverResponse.status &&
|
|
serverResponse.status >=
|
|
HTTP_SERVER_ERROR_RANGE_START &&
|
|
serverResponse.status <= HTTP_SERVER_ERROR_RANGE_END) {
|
|
this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.\n${serverError}`, correlationId);
|
|
// don't throw an exception, but alert the user via a log that the token was unable to be refreshed
|
|
return;
|
|
// check if 400 error
|
|
}
|
|
else if (refreshAccessToken &&
|
|
serverResponse.status &&
|
|
serverResponse.status >=
|
|
HTTP_CLIENT_ERROR_RANGE_START &&
|
|
serverResponse.status <= HTTP_CLIENT_ERROR_RANGE_END) {
|
|
this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\n${serverError}`, correlationId);
|
|
// don't throw an exception, but alert the user via a log that the token was unable to be refreshed
|
|
return;
|
|
}
|
|
if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
|
|
throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
|
|
}
|
|
throw serverError;
|
|
}
|
|
}
|
|
/**
|
|
* Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
|
|
* @param serverTokenResponse
|
|
* @param authority
|
|
*/
|
|
async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
|
|
// create an idToken object (not entity)
|
|
let idTokenClaims;
|
|
if (serverTokenResponse.id_token) {
|
|
idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
|
|
// token nonce check (TODO: Add a warning if no nonce is given?)
|
|
if (authCodePayload && authCodePayload.nonce) {
|
|
if (idTokenClaims.nonce !== authCodePayload.nonce) {
|
|
throw createClientAuthError(nonceMismatch);
|
|
}
|
|
}
|
|
// token max_age check
|
|
if (request.maxAge || request.maxAge === 0) {
|
|
const authTime = idTokenClaims.auth_time;
|
|
if (!authTime) {
|
|
throw createClientAuthError(authTimeNotFound);
|
|
}
|
|
checkMaxAge(authTime, request.maxAge);
|
|
}
|
|
}
|
|
// generate homeAccountId
|
|
this.homeAccountIdentifier = generateHomeAccountId(serverTokenResponse.client_info || "", authority.authorityType, this.logger, this.cryptoObj, request.correlationId, idTokenClaims);
|
|
// save the response tokens
|
|
let requestStateObj;
|
|
if (!!authCodePayload && !!authCodePayload.state) {
|
|
requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
|
|
}
|
|
// Add keyId from request to serverTokenResponse if defined
|
|
serverTokenResponse.key_id =
|
|
serverTokenResponse.key_id || request.sshKid || undefined;
|
|
const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
|
|
let cacheContext;
|
|
try {
|
|
if (this.persistencePlugin && this.serializableCache) {
|
|
this.logger.verbose("Persistence enabled, calling beforeCacheAccess", request.correlationId);
|
|
cacheContext = new TokenCacheContext(this.serializableCache, true);
|
|
await this.persistencePlugin.beforeCacheAccess(cacheContext);
|
|
}
|
|
/*
|
|
* When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
|
|
* If not present, we should return null, as it's the case that another application called removeAccount in between
|
|
* the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
|
|
* the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
|
|
*/
|
|
if (handlingRefreshTokenResponse &&
|
|
!forceCacheRefreshTokenResponse &&
|
|
cacheRecord.account) {
|
|
const cachedAccounts = this.cacheStorage.getAllAccounts({
|
|
homeAccountId: cacheRecord.account.homeAccountId,
|
|
environment: cacheRecord.account.environment,
|
|
}, request.correlationId);
|
|
if (cachedAccounts.length < 1) {
|
|
this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache", request.correlationId);
|
|
this.performanceClient?.addFields({
|
|
acntLoggedOut: true,
|
|
}, request.correlationId);
|
|
return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, undefined, serverRequestId);
|
|
}
|
|
}
|
|
await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
|
|
}
|
|
finally {
|
|
if (this.persistencePlugin &&
|
|
this.serializableCache &&
|
|
cacheContext) {
|
|
this.logger.verbose("Persistence enabled, calling afterCacheAccess", request.correlationId);
|
|
await this.persistencePlugin.afterCacheAccess(cacheContext);
|
|
}
|
|
}
|
|
return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, serverTokenResponse, serverRequestId);
|
|
}
|
|
/**
|
|
* Generates CacheRecord
|
|
* @param serverTokenResponse
|
|
* @param idTokenObj
|
|
* @param authority
|
|
*/
|
|
generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
|
|
const env = authority.getPreferredCache();
|
|
if (!env) {
|
|
throw createClientAuthError(invalidCacheEnvironment);
|
|
}
|
|
const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
|
|
// IdToken: non AAD scenarios can have empty realm
|
|
let cachedIdToken;
|
|
let cachedAccount;
|
|
if (serverTokenResponse.id_token && !!idTokenClaims) {
|
|
cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
|
|
cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
|
|
this.logger, this.performanceClient);
|
|
}
|
|
// AccessToken
|
|
let cachedAccessToken = null;
|
|
if (serverTokenResponse.access_token) {
|
|
// If scopes not returned in server response, use request scopes
|
|
const responseScopes = serverTokenResponse.scope
|
|
? ScopeSet.fromString(serverTokenResponse.scope)
|
|
: new ScopeSet(request.scopes || []);
|
|
/*
|
|
* Use timestamp calculated before request
|
|
* Server may return timestamps as strings, parse to numbers if so.
|
|
*/
|
|
const expiresIn = (typeof serverTokenResponse.expires_in === "string"
|
|
? parseInt(serverTokenResponse.expires_in, 10)
|
|
: serverTokenResponse.expires_in) || 0;
|
|
const extExpiresIn = (typeof serverTokenResponse.ext_expires_in === "string"
|
|
? parseInt(serverTokenResponse.ext_expires_in, 10)
|
|
: serverTokenResponse.ext_expires_in) || 0;
|
|
const refreshIn = (typeof serverTokenResponse.refresh_in === "string"
|
|
? parseInt(serverTokenResponse.refresh_in, 10)
|
|
: serverTokenResponse.refresh_in) || undefined;
|
|
const tokenExpirationSeconds = reqTimestamp + expiresIn;
|
|
const extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
|
|
const refreshOnSeconds = refreshIn && refreshIn > 0
|
|
? reqTimestamp + refreshIn
|
|
: undefined;
|
|
// non AAD scenarios can have empty realm
|
|
cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
|
|
// Set resource (to be used for MCP scenarios)
|
|
const resource = request.resource || null;
|
|
if (resource) {
|
|
cachedAccessToken.resource = resource;
|
|
}
|
|
}
|
|
// refreshToken
|
|
let cachedRefreshToken = null;
|
|
if (serverTokenResponse.refresh_token) {
|
|
let rtExpiresOn;
|
|
if (serverTokenResponse.refresh_token_expires_in) {
|
|
const rtExpiresIn = typeof serverTokenResponse.refresh_token_expires_in ===
|
|
"string"
|
|
? parseInt(serverTokenResponse.refresh_token_expires_in, 10)
|
|
: serverTokenResponse.refresh_token_expires_in;
|
|
rtExpiresOn = reqTimestamp + rtExpiresIn;
|
|
this.performanceClient?.addFields({ ntwkRtExpiresOnSeconds: rtExpiresOn }, request.correlationId);
|
|
}
|
|
cachedRefreshToken = createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token, this.clientId, serverTokenResponse.foci, userAssertionHash, rtExpiresOn);
|
|
}
|
|
// appMetadata
|
|
let cachedAppMetadata = null;
|
|
if (serverTokenResponse.foci) {
|
|
cachedAppMetadata = {
|
|
clientId: this.clientId,
|
|
environment: env,
|
|
familyId: serverTokenResponse.foci,
|
|
};
|
|
}
|
|
return {
|
|
account: cachedAccount,
|
|
idToken: cachedIdToken,
|
|
accessToken: cachedAccessToken,
|
|
refreshToken: cachedRefreshToken,
|
|
appMetadata: cachedAppMetadata,
|
|
};
|
|
}
|
|
/**
|
|
* Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
|
|
*
|
|
* Optionally takes a state string that is set as-is in the response.
|
|
*
|
|
* @param cacheRecord
|
|
* @param idTokenObj
|
|
* @param fromTokenCache
|
|
* @param stateString
|
|
*/
|
|
static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, idTokenClaims, requestState, serverTokenResponse, requestId) {
|
|
let accessToken = "";
|
|
let responseScopes = [];
|
|
let expiresOn = null;
|
|
let extExpiresOn;
|
|
let refreshOn;
|
|
let familyId = "";
|
|
if (cacheRecord.accessToken) {
|
|
/*
|
|
* if the request object has `popKid` property, `signPopToken` will be set to false and
|
|
* the token will be returned unsigned
|
|
*/
|
|
if (cacheRecord.accessToken.tokenType ===
|
|
AuthenticationScheme.POP &&
|
|
!request.popKid) {
|
|
const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
|
|
const { secret, keyId } = cacheRecord.accessToken;
|
|
if (!keyId) {
|
|
throw createClientAuthError(keyIdMissing);
|
|
}
|
|
accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
|
|
}
|
|
else {
|
|
accessToken = cacheRecord.accessToken.secret;
|
|
}
|
|
responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
|
|
// Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
|
|
expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
|
|
extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
|
|
if (cacheRecord.accessToken.refreshOn) {
|
|
refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
|
|
}
|
|
}
|
|
if (cacheRecord.appMetadata) {
|
|
familyId =
|
|
cacheRecord.appMetadata.familyId === THE_FAMILY_ID
|
|
? THE_FAMILY_ID
|
|
: "";
|
|
}
|
|
const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
|
|
const tid = idTokenClaims?.tid || "";
|
|
// for hybrid + native bridge enablement, send back the native account Id
|
|
if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
|
|
cacheRecord.account.nativeAccountId =
|
|
serverTokenResponse?.spa_accountid;
|
|
}
|
|
const accountInfo = cacheRecord.account
|
|
? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
|
|
idTokenClaims, cacheRecord.idToken?.secret)
|
|
: null;
|
|
return {
|
|
authority: authority.canonicalAuthority,
|
|
uniqueId: uid,
|
|
tenantId: tid,
|
|
scopes: responseScopes,
|
|
account: accountInfo,
|
|
idToken: cacheRecord?.idToken?.secret || "",
|
|
idTokenClaims: idTokenClaims || {},
|
|
accessToken: accessToken,
|
|
fromCache: fromTokenCache,
|
|
expiresOn: expiresOn,
|
|
extExpiresOn: extExpiresOn,
|
|
refreshOn: refreshOn,
|
|
correlationId: request.correlationId,
|
|
requestId: requestId || "",
|
|
familyId: familyId,
|
|
tokenType: cacheRecord.accessToken?.tokenType || "",
|
|
state: requestState ? requestState.userRequestState : "",
|
|
cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
|
|
msGraphHost: cacheRecord.account?.msGraphHost || "",
|
|
code: serverTokenResponse?.spa_code,
|
|
fromPlatformBroker: false,
|
|
};
|
|
}
|
|
}
|
|
function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
|
|
logger?.verbose("setCachedAccount called", correlationId);
|
|
/*
|
|
* Check if base account is already cached. Filter by homeAccountId (identifies
|
|
* the user's home identity) and environment (identifies the cloud) — the two
|
|
* tenant-agnostic properties that uniquely locate a base AccountEntity.
|
|
*/
|
|
const accountEnvironment = environment || authority.getPreferredCache();
|
|
const matchedAccounts = cacheStorage.getAccountsFilteredBy({ homeAccountId, environment: accountEnvironment }, correlationId);
|
|
performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
|
|
if (matchedAccounts.length > 1) {
|
|
/*
|
|
* Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
|
|
* If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
|
|
*/
|
|
logger?.warning("Multiple base accounts matched homeAccountId. Ignoring cached account and creating a new base account.", correlationId);
|
|
}
|
|
const cachedAccount = matchedAccounts.length === 1 ? matchedAccounts[0] : null;
|
|
const baseAccount = cachedAccount ||
|
|
createAccountEntity({
|
|
homeAccountId,
|
|
idTokenClaims,
|
|
clientInfo,
|
|
environment,
|
|
cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
|
|
msGraphHost: authCodePayload?.msgraph_host,
|
|
nativeAccountId: nativeAccountId,
|
|
}, authority, base64Decode);
|
|
const tenantProfiles = baseAccount.tenantProfiles || [];
|
|
const tenantId = claimsTenantId || baseAccount.realm;
|
|
if (tenantId &&
|
|
!tenantProfiles.find((tenantProfile) => {
|
|
return tenantProfile.tenantId === tenantId;
|
|
})) {
|
|
const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
|
|
tenantProfiles.push(newTenantProfile);
|
|
}
|
|
baseAccount.tenantProfiles = tenantProfiles;
|
|
return baseAccount;
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const CcsCredentialType = {
|
|
HOME_ACCOUNT_ID: "home_account_id",
|
|
UPN: "UPN",
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
|
|
if (typeof clientAssertion === "string") {
|
|
return clientAssertion;
|
|
}
|
|
else {
|
|
const config = {
|
|
clientId: clientId,
|
|
tokenEndpoint: tokenEndpoint,
|
|
};
|
|
return clientAssertion(config);
|
|
}
|
|
}
|
|
|
|
var ClientAssertionUtils = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
getClientAssertion: getClientAssertion
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
function getRequestThumbprint(clientId, request, homeAccountId) {
|
|
return {
|
|
clientId: clientId,
|
|
authority: request.authority,
|
|
scopes: request.scopes,
|
|
homeAccountIdentifier: homeAccountId,
|
|
claims: request.claims,
|
|
authenticationScheme: request.authenticationScheme,
|
|
resourceRequestMethod: request.resourceRequestMethod,
|
|
resourceRequestUri: request.resourceRequestUri,
|
|
shrClaims: request.shrClaims,
|
|
sshKid: request.sshKid,
|
|
embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
|
|
};
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/** @internal */
|
|
class ThrottlingUtils {
|
|
/**
|
|
* Prepares a RequestThumbprint to be stored as a key.
|
|
* @param thumbprint
|
|
*/
|
|
static generateThrottlingStorageKey(thumbprint) {
|
|
return `${THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
|
|
}
|
|
/**
|
|
* Performs necessary throttling checks before a network request.
|
|
* @param cacheManager
|
|
* @param thumbprint
|
|
*/
|
|
static preProcess(cacheManager, thumbprint, correlationId) {
|
|
const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
|
|
const value = cacheManager.getThrottlingCache(key, correlationId);
|
|
if (value) {
|
|
if (value.throttleTime < Date.now()) {
|
|
cacheManager.removeItem(key, correlationId);
|
|
return;
|
|
}
|
|
throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
|
|
}
|
|
}
|
|
/**
|
|
* Performs necessary throttling checks after a network request.
|
|
* @param cacheManager
|
|
* @param thumbprint
|
|
* @param response
|
|
*/
|
|
static postProcess(cacheManager, thumbprint, response, correlationId) {
|
|
if (ThrottlingUtils.checkResponseStatus(response) ||
|
|
ThrottlingUtils.checkResponseForRetryAfter(response)) {
|
|
const thumbprintValue = {
|
|
throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
|
|
error: response.body.error,
|
|
errorCodes: response.body.error_codes,
|
|
errorMessage: response.body.error_description,
|
|
subError: response.body.suberror,
|
|
};
|
|
cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
|
|
}
|
|
}
|
|
/**
|
|
* Checks a NetworkResponse object's status codes against 429 or 5xx
|
|
* @param response
|
|
*/
|
|
static checkResponseStatus(response) {
|
|
return (response.status === 429 ||
|
|
(response.status >= 500 && response.status < 600));
|
|
}
|
|
/**
|
|
* Checks a NetworkResponse object's RetryAfter header
|
|
* @param response
|
|
*/
|
|
static checkResponseForRetryAfter(response) {
|
|
if (response.headers) {
|
|
return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
|
|
(response.status < 200 || response.status >= 300));
|
|
}
|
|
return false;
|
|
}
|
|
/**
|
|
* Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
|
|
* @param throttleTime
|
|
*/
|
|
static calculateThrottleTime(throttleTime) {
|
|
const time = throttleTime <= 0 ? 0 : throttleTime;
|
|
const currentSeconds = Date.now() / 1000;
|
|
return Math.floor(Math.min(currentSeconds +
|
|
(time || DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds + DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
|
|
}
|
|
static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
|
|
const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
|
|
const key = this.generateThrottlingStorageKey(thumbprint);
|
|
cacheManager.removeItem(key, request.correlationId);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Represents network related errors
|
|
*/
|
|
class NetworkError extends AuthError {
|
|
constructor(error, httpStatus, responseHeaders) {
|
|
super(error.errorCode, error.errorMessage, error.subError);
|
|
Object.setPrototypeOf(this, NetworkError.prototype);
|
|
this.name = "NetworkError";
|
|
this.error = error;
|
|
this.httpStatus = httpStatus;
|
|
this.responseHeaders = responseHeaders;
|
|
}
|
|
}
|
|
/**
|
|
* Creates NetworkError object for a failed network request
|
|
* @param error - Error to be thrown back to the caller
|
|
* @param httpStatus - Status code of the network request
|
|
* @param responseHeaders - Response headers of the network request, when available
|
|
* @returns NetworkError object
|
|
*/
|
|
function createNetworkError(error, httpStatus, responseHeaders, additionalError) {
|
|
error.errorMessage = `${error.errorMessage}, additionalErrorInfo: error.name:${additionalError?.name}, error.message:${additionalError?.message}`;
|
|
return new NetworkError(error, httpStatus, responseHeaders);
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Creates default headers for requests to token endpoint
|
|
*/
|
|
function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
|
|
const headers = {};
|
|
headers[HeaderNames.CONTENT_TYPE] = URL_FORM_CONTENT_TYPE;
|
|
if (!preventCorsPreflight && ccsCred) {
|
|
switch (ccsCred.type) {
|
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
|
try {
|
|
const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
|
|
headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
|
|
}
|
|
catch (e) {
|
|
logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, "");
|
|
}
|
|
break;
|
|
case CcsCredentialType.UPN:
|
|
headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
|
|
break;
|
|
}
|
|
}
|
|
return headers;
|
|
}
|
|
/**
|
|
* Creates query string for the /token request
|
|
* @param request
|
|
*/
|
|
function createTokenQueryParameters(request, clientId, redirectUri, performanceClient) {
|
|
const parameters = new Map();
|
|
if (request.embeddedClientId) {
|
|
addBrokerParameters(parameters, clientId, redirectUri);
|
|
}
|
|
if (request.extraQueryParameters) {
|
|
addExtraParameters(parameters, request.extraQueryParameters);
|
|
}
|
|
addCorrelationId(parameters, request.correlationId);
|
|
instrumentBrokerParams(parameters, request.correlationId, performanceClient);
|
|
return mapToQueryString(parameters);
|
|
}
|
|
/**
|
|
* Http post to token endpoint
|
|
* @param tokenEndpoint
|
|
* @param queryString
|
|
* @param headers
|
|
* @param thumbprint
|
|
*/
|
|
async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
|
|
const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
|
|
if (serverTelemetryManager &&
|
|
response.status < 500 &&
|
|
response.status !== 429) {
|
|
// Telemetry data successfully logged by server, clear Telemetry cache
|
|
serverTelemetryManager.clearTelemetryCache();
|
|
}
|
|
return response;
|
|
}
|
|
/**
|
|
* Wraps sendPostRequestAsync with necessary preflight and postflight logic
|
|
* @param thumbprint - Request thumbprint for throttling
|
|
* @param tokenEndpoint - Endpoint to make the POST to
|
|
* @param options - Body and Headers to include on the POST request
|
|
* @param correlationId - CorrelationId for telemetry
|
|
* @param cacheManager - Cache manager instance
|
|
* @param networkClient - Network module instance
|
|
* @param logger - Logger instance
|
|
* @param performanceClient - Performance client instance
|
|
*/
|
|
async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
|
|
ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
|
|
let response;
|
|
try {
|
|
response = await invokeAsync((networkClient.sendPostRequestAsync.bind(networkClient)), NetworkClientSendPostRequestAsync, logger, performanceClient, correlationId)(tokenEndpoint, options);
|
|
const responseHeaders = response.headers || {};
|
|
performanceClient?.addFields({
|
|
refreshTokenSize: response.body.refresh_token?.length || 0,
|
|
httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
|
|
requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
|
|
}, correlationId);
|
|
}
|
|
catch (e) {
|
|
if (e instanceof NetworkError) {
|
|
const responseHeaders = e.responseHeaders;
|
|
if (responseHeaders) {
|
|
performanceClient?.addFields({
|
|
httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] ||
|
|
"",
|
|
requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
|
|
contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
|
|
undefined,
|
|
contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
|
|
undefined,
|
|
httpStatus: e.httpStatus,
|
|
}, correlationId);
|
|
}
|
|
throw e.error;
|
|
}
|
|
if (e instanceof AuthError) {
|
|
throw e;
|
|
}
|
|
else {
|
|
throw createClientAuthError(networkError);
|
|
}
|
|
}
|
|
ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
|
|
return response;
|
|
}
|
|
|
|
var Token = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
createTokenQueryParameters: createTokenQueryParameters,
|
|
createTokenRequestHeaders: createTokenRequestHeaders,
|
|
executePostToTokenEndpoint: executePostToTokenEndpoint,
|
|
sendPostRequest: sendPostRequest
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Oauth2.0 Authorization Code client
|
|
* @internal
|
|
*/
|
|
class AuthorizationCodeClient {
|
|
constructor(configuration, performanceClient) {
|
|
// Flag to indicate if client is for hybrid spa auth code redemption
|
|
this.includeRedirectUri = true;
|
|
// Set the configuration
|
|
this.config = buildClientConfiguration(configuration);
|
|
// Initialize the logger
|
|
this.logger = new Logger(this.config.loggerOptions, name, version);
|
|
// Initialize crypto
|
|
this.cryptoUtils = this.config.cryptoInterface;
|
|
// Initialize storage interface
|
|
this.cacheManager = this.config.storageInterface;
|
|
// Set the network interface
|
|
this.networkClient = this.config.networkInterface;
|
|
// Set TelemetryManager
|
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
|
// set Authority
|
|
this.authority = this.config.authOptions.authority;
|
|
// set performance telemetry client
|
|
this.performanceClient = performanceClient;
|
|
this.oidcDefaultScopes =
|
|
this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
|
|
}
|
|
/**
|
|
* API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
|
|
* authorization_code_grant
|
|
* @param request
|
|
*/
|
|
async acquireToken(request, apiId, authCodePayload) {
|
|
if (!request.code) {
|
|
throw createClientAuthError(requestCannotBeMade);
|
|
}
|
|
// Check for new cloud instance
|
|
if (authCodePayload && authCodePayload.cloud_instance_host_name) {
|
|
await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
|
|
}
|
|
const reqTimestamp = nowSeconds();
|
|
const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
|
|
// Retrieve requestId from response headers
|
|
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
|
// Validate response. This function throws a server error if an error is returned by the server.
|
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
|
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
|
|
}
|
|
/**
|
|
* Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
|
|
* Default behaviour is to redirect the user to `window.location.href`.
|
|
* @param authorityUri
|
|
*/
|
|
getLogoutUri(logoutRequest) {
|
|
// Throw error if logoutRequest is null/undefined
|
|
if (!logoutRequest) {
|
|
throw createClientConfigurationError(logoutRequestEmpty);
|
|
}
|
|
const queryString = this.createLogoutUrlQueryString(logoutRequest);
|
|
// Construct logout URI
|
|
return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
|
|
}
|
|
/**
|
|
* Executes POST request to token endpoint
|
|
* @param authority
|
|
* @param request
|
|
*/
|
|
async executeTokenRequest(authority, request, serverTelemetryManager) {
|
|
const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
|
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
|
const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
|
|
let ccsCredential = undefined;
|
|
if (request.clientInfo) {
|
|
try {
|
|
const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
|
|
ccsCredential = {
|
|
credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
|
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
|
};
|
|
}
|
|
catch (e) {
|
|
this.logger.verbose(`Could not parse client info for CCS Header: '${e}'`, request.correlationId);
|
|
}
|
|
}
|
|
const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
|
|
const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
|
|
return invokeAsync(executePostToTokenEndpoint, AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, serverTelemetryManager);
|
|
}
|
|
/**
|
|
* Generates a map for all the params to be sent to the service
|
|
* @param request
|
|
*/
|
|
async createTokenRequestBody(request) {
|
|
const parameters = new Map();
|
|
addClientId(parameters, request.embeddedClientId ||
|
|
request.extraParameters?.[CLIENT_ID] ||
|
|
this.config.authOptions.clientId);
|
|
/*
|
|
* For hybrid spa flow, there will be a code but no verifier
|
|
* In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
|
|
*/
|
|
if (!this.includeRedirectUri) {
|
|
// Just validate
|
|
if (!request.redirectUri) {
|
|
throw createClientConfigurationError(redirectUriEmpty);
|
|
}
|
|
}
|
|
else {
|
|
// Validate and include redirect uri
|
|
addRedirectUri(parameters, request.redirectUri);
|
|
}
|
|
// Add scope array, parameter builder will add default scopes and dedupe
|
|
addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
|
|
addResource(parameters, request.resource);
|
|
// add code: user set, not validated
|
|
addAuthorizationCode(parameters, request.code);
|
|
// Add library metadata
|
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
|
addThrottling(parameters);
|
|
if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
|
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
|
}
|
|
// add code_verifier if passed
|
|
if (request.codeVerifier) {
|
|
addCodeVerifier(parameters, request.codeVerifier);
|
|
}
|
|
if (this.config.clientCredentials.clientSecret) {
|
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
|
}
|
|
if (this.config.clientCredentials.clientAssertion) {
|
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
|
}
|
|
addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
|
|
addClientInfo(parameters);
|
|
if (request.authenticationScheme === AuthenticationScheme.POP) {
|
|
const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
|
|
let reqCnfData;
|
|
if (!request.popKid) {
|
|
const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
|
|
reqCnfData = generatedReqCnfData.reqCnfString;
|
|
}
|
|
else {
|
|
reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
|
|
}
|
|
// SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
|
|
addPopToken(parameters, reqCnfData);
|
|
}
|
|
else if (request.authenticationScheme === AuthenticationScheme.SSH) {
|
|
if (request.sshJwk) {
|
|
addSshJwk(parameters, request.sshJwk);
|
|
}
|
|
else {
|
|
throw createClientConfigurationError(missingSshJwk);
|
|
}
|
|
}
|
|
let ccsCred = undefined;
|
|
if (request.clientInfo) {
|
|
try {
|
|
const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
|
|
ccsCred = {
|
|
credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
|
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
|
};
|
|
}
|
|
catch (e) {
|
|
this.logger.verbose(`Could not parse client info for CCS Header: '${e}'`, request.correlationId);
|
|
}
|
|
}
|
|
else {
|
|
ccsCred = request.ccsCredential;
|
|
}
|
|
// Adds these as parameters in the request instead of headers to prevent CORS preflight request
|
|
if (this.config.systemOptions.preventCorsPreflight && ccsCred) {
|
|
switch (ccsCred.type) {
|
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
|
try {
|
|
const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
|
|
addCcsOid(parameters, clientInfo);
|
|
}
|
|
catch (e) {
|
|
this.logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, request.correlationId);
|
|
}
|
|
break;
|
|
case CcsCredentialType.UPN:
|
|
addCcsUpn(parameters, ccsCred.credential);
|
|
break;
|
|
}
|
|
}
|
|
if (request.embeddedClientId) {
|
|
addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
|
|
}
|
|
if (request.extraParameters) {
|
|
addExtraParameters(parameters, request.extraParameters);
|
|
}
|
|
// Add hybrid spa parameters if not already provided
|
|
if (request.enableSpaAuthorizationCode &&
|
|
(!request.extraParameters ||
|
|
!request.extraParameters[RETURN_SPA_CODE])) {
|
|
addExtraParameters(parameters, {
|
|
[RETURN_SPA_CODE]: "1",
|
|
});
|
|
}
|
|
instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
|
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
|
|
return mapToQueryString(parameters);
|
|
}
|
|
/**
|
|
* This API validates the `EndSessionRequest` and creates a URL
|
|
* @param request
|
|
*/
|
|
createLogoutUrlQueryString(request) {
|
|
const parameters = new Map();
|
|
if (request.postLogoutRedirectUri) {
|
|
addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
|
|
}
|
|
if (request.correlationId) {
|
|
addCorrelationId(parameters, request.correlationId);
|
|
}
|
|
if (request.idTokenHint) {
|
|
addIdTokenHint(parameters, request.idTokenHint);
|
|
}
|
|
if (request.state) {
|
|
addState(parameters, request.state);
|
|
}
|
|
if (request.logoutHint) {
|
|
addLogoutHint(parameters, request.logoutHint);
|
|
}
|
|
if (request.extraQueryParameters) {
|
|
addExtraParameters(parameters, request.extraQueryParameters);
|
|
}
|
|
if (this.config.authOptions.instanceAware) {
|
|
addInstanceAware(parameters);
|
|
}
|
|
return mapToQueryString(parameters);
|
|
}
|
|
/**
|
|
* Updates the authority to the cloud instance provided in the authorization response
|
|
* @param cloudInstanceHostName - cloud instance host name from authorization code payload
|
|
* @param correlationId - request correlation id
|
|
*/
|
|
async updateTokenEndpointAuthority(cloudInstanceHostName, correlationId) {
|
|
const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
|
|
const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
|
|
this.authority = cloudInstanceAuthority;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
|
|
/**
|
|
* OAuth2.0 refresh token client
|
|
* @internal
|
|
*/
|
|
class RefreshTokenClient {
|
|
constructor(configuration, performanceClient) {
|
|
// Set the configuration
|
|
this.config = buildClientConfiguration(configuration);
|
|
// Initialize the logger
|
|
this.logger = new Logger(this.config.loggerOptions, name, version);
|
|
// Initialize crypto
|
|
this.cryptoUtils = this.config.cryptoInterface;
|
|
// Initialize storage interface
|
|
this.cacheManager = this.config.storageInterface;
|
|
// Set the network interface
|
|
this.networkClient = this.config.networkInterface;
|
|
// Set TelemetryManager
|
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
|
// set Authority
|
|
this.authority = this.config.authOptions.authority;
|
|
// set performance telemetry client
|
|
this.performanceClient = performanceClient;
|
|
}
|
|
async acquireToken(request, apiId) {
|
|
const reqTimestamp = nowSeconds();
|
|
const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
|
|
// Retrieve requestId from response headers
|
|
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
|
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
|
|
}
|
|
/**
|
|
* Gets cached refresh token and attaches to request, then calls acquireToken API
|
|
* @param request
|
|
*/
|
|
async acquireTokenByRefreshToken(request, apiId) {
|
|
// Cannot renew token if no request object is given.
|
|
if (!request) {
|
|
throw createClientConfigurationError(tokenRequestEmpty);
|
|
}
|
|
// We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
|
|
if (!request.account) {
|
|
throw createClientAuthError(noAccountInSilentRequest);
|
|
}
|
|
// try checking if FOCI is enabled for the given application
|
|
const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
|
|
// if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
|
|
if (isFOCI) {
|
|
try {
|
|
return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true, apiId);
|
|
}
|
|
catch (e) {
|
|
const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
|
|
e.errorCode ===
|
|
noTokensFound;
|
|
const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
|
|
e.errorCode === INVALID_GRANT_ERROR &&
|
|
e.subError === CLIENT_MISMATCH_ERROR;
|
|
// if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
|
|
if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
|
|
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
|
|
// throw in all other cases
|
|
}
|
|
else {
|
|
throw e;
|
|
}
|
|
}
|
|
}
|
|
// fall back to application refresh token acquisition
|
|
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
|
|
}
|
|
/**
|
|
* makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
|
|
* @param request
|
|
*/
|
|
async acquireTokenWithCachedRefreshToken(request, foci, apiId) {
|
|
// fetches family RT or application RT based on FOCI value
|
|
const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
|
|
if (!refreshToken) {
|
|
throw createInteractionRequiredAuthError(noTokensFound);
|
|
}
|
|
if (refreshToken.expiresOn) {
|
|
const offset = request.refreshTokenExpirationOffsetSeconds ||
|
|
DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
|
|
this.performanceClient?.addFields({
|
|
cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
|
|
rtOffsetSeconds: offset,
|
|
}, request.correlationId);
|
|
if (isTokenExpired(refreshToken.expiresOn, offset)) {
|
|
throw createInteractionRequiredAuthError(refreshTokenExpired);
|
|
}
|
|
}
|
|
// attach cached RT size to the current measurement
|
|
const refreshTokenRequest = {
|
|
...request,
|
|
refreshToken: refreshToken.secret,
|
|
authenticationScheme: request.authenticationScheme ||
|
|
AuthenticationScheme.BEARER,
|
|
ccsCredential: {
|
|
credential: request.account.homeAccountId,
|
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
|
},
|
|
};
|
|
try {
|
|
return await invokeAsync(this.acquireToken.bind(this), RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
|
|
}
|
|
catch (e) {
|
|
if (e instanceof InteractionRequiredAuthError) {
|
|
if (e.subError === badToken) {
|
|
// Remove bad refresh token from cache
|
|
this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache", request.correlationId);
|
|
const badRefreshTokenKey = this.cacheManager.generateCredentialKey(refreshToken);
|
|
this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
|
|
}
|
|
}
|
|
throw e;
|
|
}
|
|
}
|
|
/**
|
|
* Constructs the network message and makes a NW call to the underlying secure token service
|
|
* @param request
|
|
* @param authority
|
|
*/
|
|
async executeTokenRequest(request, authority) {
|
|
const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
|
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
|
const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
|
|
const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, request.ccsCredential);
|
|
const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
|
|
return invokeAsync(executePostToTokenEndpoint, RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
|
|
}
|
|
/**
|
|
* Helper function to create the token request body
|
|
* @param request
|
|
*/
|
|
async createTokenRequestBody(request) {
|
|
const parameters = new Map();
|
|
addClientId(parameters, request.embeddedClientId ||
|
|
request.extraParameters?.[CLIENT_ID] ||
|
|
this.config.authOptions.clientId);
|
|
if (request.redirectUri) {
|
|
addRedirectUri(parameters, request.redirectUri);
|
|
}
|
|
addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
|
|
addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
|
|
addClientInfo(parameters);
|
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
|
addThrottling(parameters);
|
|
if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
|
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
|
}
|
|
addRefreshToken(parameters, request.refreshToken);
|
|
if (this.config.clientCredentials.clientSecret) {
|
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
|
}
|
|
if (this.config.clientCredentials.clientAssertion) {
|
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
|
}
|
|
if (request.authenticationScheme === AuthenticationScheme.POP) {
|
|
const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
|
|
let reqCnfData;
|
|
if (!request.popKid) {
|
|
const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
|
|
reqCnfData = generatedReqCnfData.reqCnfString;
|
|
}
|
|
else {
|
|
reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
|
|
}
|
|
// SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
|
|
addPopToken(parameters, reqCnfData);
|
|
}
|
|
else if (request.authenticationScheme === AuthenticationScheme.SSH) {
|
|
if (request.sshJwk) {
|
|
addSshJwk(parameters, request.sshJwk);
|
|
}
|
|
else {
|
|
throw createClientConfigurationError(missingSshJwk);
|
|
}
|
|
}
|
|
if (this.config.systemOptions.preventCorsPreflight &&
|
|
request.ccsCredential) {
|
|
switch (request.ccsCredential.type) {
|
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
|
try {
|
|
const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
|
|
addCcsOid(parameters, clientInfo);
|
|
}
|
|
catch (e) {
|
|
this.logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, request.correlationId);
|
|
}
|
|
break;
|
|
case CcsCredentialType.UPN:
|
|
addCcsUpn(parameters, request.ccsCredential.credential);
|
|
break;
|
|
}
|
|
}
|
|
if (request.embeddedClientId) {
|
|
addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
|
|
}
|
|
if (request.extraParameters) {
|
|
addExtraParameters(parameters, {
|
|
...request.extraParameters,
|
|
});
|
|
}
|
|
instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
|
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
|
|
return mapToQueryString(parameters);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/** @internal */
|
|
class SilentFlowClient {
|
|
constructor(configuration, performanceClient) {
|
|
// Set the configuration
|
|
this.config = buildClientConfiguration(configuration);
|
|
// Initialize the logger
|
|
this.logger = new Logger(this.config.loggerOptions, name, version);
|
|
// Initialize crypto
|
|
this.cryptoUtils = this.config.cryptoInterface;
|
|
// Initialize storage interface
|
|
this.cacheManager = this.config.storageInterface;
|
|
// Set the network interface
|
|
this.networkClient = this.config.networkInterface;
|
|
// Set TelemetryManager
|
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
|
// set Authority
|
|
this.authority = this.config.authOptions.authority;
|
|
// set performance telemetry client
|
|
this.performanceClient = performanceClient;
|
|
}
|
|
/**
|
|
* Retrieves token from cache or throws an error if it must be refreshed.
|
|
* @param request
|
|
*/
|
|
async acquireCachedToken(request) {
|
|
let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
|
|
if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
|
|
// Must refresh due to present force_refresh flag.
|
|
this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
|
|
throw createClientAuthError(tokenRefreshRequired);
|
|
}
|
|
// We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
|
|
if (!request.account) {
|
|
throw createClientAuthError(noAccountInSilentRequest);
|
|
}
|
|
const requestTenantId = request.account.tenantId ||
|
|
getTenantFromAuthorityString(request.authority);
|
|
const tokenKeys = this.cacheManager.getTokenKeys();
|
|
const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
|
|
if (!cachedAccessToken) {
|
|
// must refresh due to non-existent access_token
|
|
this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
|
|
throw createClientAuthError(tokenRefreshRequired);
|
|
}
|
|
else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
|
|
isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
|
|
// must refresh due to the expires_in value
|
|
this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
|
|
throw createClientAuthError(tokenRefreshRequired);
|
|
}
|
|
else if (request.resource) {
|
|
// cached access token must have a resource that matches the request resource for MCP scenarios
|
|
if (cachedAccessToken.resource !== request.resource) {
|
|
this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
|
|
throw createClientAuthError(tokenRefreshRequired);
|
|
}
|
|
}
|
|
else if (cachedAccessToken.refreshOn &&
|
|
isTokenExpired(cachedAccessToken.refreshOn, 0)) {
|
|
// must refresh (in the background) due to the refresh_in value
|
|
lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
|
|
// don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
|
|
}
|
|
const environment = request.authority || this.authority.getPreferredCache();
|
|
const cacheRecord = {
|
|
account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
|
|
accessToken: cachedAccessToken,
|
|
idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId),
|
|
refreshToken: null,
|
|
appMetadata: this.cacheManager.readAppMetadataFromCache(environment, request.correlationId),
|
|
};
|
|
this.setCacheOutcome(lastCacheOutcome, request.correlationId);
|
|
if (this.config.serverTelemetryManager) {
|
|
this.config.serverTelemetryManager.incrementCacheHits();
|
|
}
|
|
return [
|
|
await invokeAsync(this.generateResultFromCacheRecord.bind(this), SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
|
|
lastCacheOutcome,
|
|
];
|
|
}
|
|
setCacheOutcome(cacheOutcome, correlationId) {
|
|
this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
|
|
this.performanceClient?.addFields({
|
|
cacheOutcome: cacheOutcome,
|
|
}, correlationId);
|
|
if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
|
|
this.logger.info(`Token refresh is required due to cache outcome: '${cacheOutcome}'`, correlationId);
|
|
}
|
|
}
|
|
/**
|
|
* Helper function to build response object from the CacheRecord
|
|
* @param cacheRecord
|
|
*/
|
|
async generateResultFromCacheRecord(cacheRecord, request) {
|
|
let idTokenClaims;
|
|
if (cacheRecord.idToken) {
|
|
idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
|
|
}
|
|
// token max_age check
|
|
if (request.maxAge || request.maxAge === 0) {
|
|
const authTime = idTokenClaims?.auth_time;
|
|
if (!authTime) {
|
|
throw createClientAuthError(authTimeNotFound);
|
|
}
|
|
checkMaxAge(authTime, request.maxAge);
|
|
}
|
|
return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const StubbedNetworkModule = {
|
|
sendGetRequestAsync: () => {
|
|
return Promise.reject(createClientAuthError(methodNotImplemented));
|
|
},
|
|
sendPostRequestAsync: () => {
|
|
return Promise.reject(createClientAuthError(methodNotImplemented));
|
|
},
|
|
};
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
|
|
* @param config
|
|
* @param request
|
|
* @param logger
|
|
* @param performanceClient
|
|
* @returns
|
|
*/
|
|
function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
|
|
// generate the correlationId if not set by the user and add
|
|
const correlationId = request.correlationId;
|
|
const parameters = new Map();
|
|
addClientId(parameters, request.embeddedClientId ||
|
|
request.extraQueryParameters?.[CLIENT_ID] ||
|
|
authOptions.clientId);
|
|
const requestScopes = [
|
|
...(request.scopes || []),
|
|
...(request.extraScopesToConsent || []),
|
|
];
|
|
addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
|
|
addResource(parameters, request.resource);
|
|
addRedirectUri(parameters, request.redirectUri);
|
|
addCorrelationId(parameters, correlationId);
|
|
// add response_mode. If not passed in it defaults to query.
|
|
addResponseMode(parameters, request.responseMode);
|
|
// add client_info=1
|
|
addClientInfo(parameters);
|
|
// add clidata=1
|
|
addCliData(parameters);
|
|
if (request.prompt) {
|
|
addPrompt(parameters, request.prompt);
|
|
performanceClient?.addFields({ prompt: request.prompt }, correlationId);
|
|
}
|
|
if (request.domainHint) {
|
|
addDomainHint(parameters, request.domainHint);
|
|
performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
|
|
}
|
|
// Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
|
|
if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
|
|
// AAD will throw if prompt=select_account is passed with an account hint
|
|
if (request.sid && request.prompt === PromptValue.NONE) {
|
|
// SessionID is only used in silent calls
|
|
logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request", request.correlationId);
|
|
addSid(parameters, request.sid);
|
|
performanceClient?.addFields({ sidFromRequest: true }, correlationId);
|
|
}
|
|
else if (request.account) {
|
|
const accountSid = extractAccountSid(request.account);
|
|
let accountLoginHintClaim = extractLoginHint(request.account);
|
|
if (accountLoginHintClaim && request.domainHint) {
|
|
logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`, request.correlationId);
|
|
accountLoginHintClaim = null;
|
|
}
|
|
// If login_hint claim is present, use it over sid/username
|
|
if (accountLoginHintClaim) {
|
|
logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account", request.correlationId);
|
|
addLoginHint(parameters, accountLoginHintClaim);
|
|
performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
|
|
try {
|
|
const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
|
|
addCcsOid(parameters, clientInfo);
|
|
}
|
|
catch (e) {
|
|
logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
|
|
}
|
|
}
|
|
else if (accountSid && request.prompt === PromptValue.NONE) {
|
|
/*
|
|
* If account and loginHint are provided, we will check account first for sid before adding loginHint
|
|
* SessionId is only used in silent calls
|
|
*/
|
|
logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account", request.correlationId);
|
|
addSid(parameters, accountSid);
|
|
performanceClient?.addFields({ sidFromClaim: true }, correlationId);
|
|
try {
|
|
const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
|
|
addCcsOid(parameters, clientInfo);
|
|
}
|
|
catch (e) {
|
|
logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
|
|
}
|
|
}
|
|
else if (request.loginHint) {
|
|
logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request", request.correlationId);
|
|
addLoginHint(parameters, request.loginHint);
|
|
addCcsUpn(parameters, request.loginHint);
|
|
performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
|
|
}
|
|
else if (request.account.username) {
|
|
// Fallback to account username if provided
|
|
logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account", request.correlationId);
|
|
addLoginHint(parameters, request.account.username);
|
|
performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
|
|
try {
|
|
const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
|
|
addCcsOid(parameters, clientInfo);
|
|
}
|
|
catch (e) {
|
|
logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
|
|
}
|
|
}
|
|
}
|
|
else if (request.loginHint) {
|
|
logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request", request.correlationId);
|
|
addLoginHint(parameters, request.loginHint);
|
|
addCcsUpn(parameters, request.loginHint);
|
|
performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
|
|
}
|
|
}
|
|
else {
|
|
logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints", request.correlationId);
|
|
}
|
|
if (request.nonce) {
|
|
addNonce(parameters, request.nonce);
|
|
}
|
|
if (request.state) {
|
|
addState(parameters, request.state);
|
|
}
|
|
if (request.embeddedClientId) {
|
|
addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
|
|
}
|
|
addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
|
|
// If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
|
|
if (authOptions.instanceAware &&
|
|
(!request.extraQueryParameters ||
|
|
!Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
|
|
addInstanceAware(parameters);
|
|
}
|
|
return parameters;
|
|
}
|
|
/**
|
|
* Returns authorize endpoint with given request parameters in the query string
|
|
* @param authority
|
|
* @param requestParameters
|
|
* @returns
|
|
*/
|
|
function getAuthorizeUrl(authority, requestParameters) {
|
|
const queryString = mapToQueryString(requestParameters);
|
|
return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
|
|
}
|
|
/**
|
|
* Handles the hash fragment response from public client code request. Returns a code response used by
|
|
* the client to exchange for a token in acquireToken.
|
|
* @param serverParams
|
|
* @param cachedState
|
|
*/
|
|
function getAuthorizationCodePayload(serverParams, cachedState) {
|
|
// Get code response
|
|
validateAuthorizationResponse(serverParams, cachedState);
|
|
// throw when there is no auth code in the response
|
|
if (!serverParams.code) {
|
|
throw createClientAuthError(authorizationCodeMissingFromServerResponse);
|
|
}
|
|
return serverParams;
|
|
}
|
|
/**
|
|
* Function which validates server authorization code response.
|
|
* @param serverResponseHash
|
|
* @param requestState
|
|
*/
|
|
function validateAuthorizationResponse(serverResponse, requestState) {
|
|
if (!serverResponse.state || !requestState) {
|
|
throw serverResponse.state
|
|
? createClientAuthError(stateNotFound, "Cached State")
|
|
: createClientAuthError(stateNotFound, "Server State");
|
|
}
|
|
let decodedServerResponseState;
|
|
let decodedRequestState;
|
|
try {
|
|
decodedServerResponseState = decodeURIComponent(serverResponse.state);
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(invalidState, serverResponse.state);
|
|
}
|
|
try {
|
|
decodedRequestState = decodeURIComponent(requestState);
|
|
}
|
|
catch (e) {
|
|
throw createClientAuthError(invalidState, serverResponse.state);
|
|
}
|
|
if (decodedServerResponseState !== decodedRequestState) {
|
|
throw createClientAuthError(stateMismatch);
|
|
}
|
|
// Check for error
|
|
if (serverResponse.error ||
|
|
serverResponse.error_description ||
|
|
serverResponse.suberror) {
|
|
const serverErrorNo = parseServerErrorNo(serverResponse);
|
|
if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
|
|
throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
|
|
}
|
|
throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
|
|
}
|
|
}
|
|
/**
|
|
* Get server error No from the error_uri
|
|
* @param serverResponse
|
|
* @returns
|
|
*/
|
|
function parseServerErrorNo(serverResponse) {
|
|
const errorCodePrefix = "code=";
|
|
const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
|
|
return errorCodePrefixIndex && errorCodePrefixIndex >= 0
|
|
? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
|
|
: undefined;
|
|
}
|
|
/**
|
|
* Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
|
|
* @param account
|
|
*/
|
|
function extractAccountSid(account) {
|
|
return account.idTokenClaims?.sid || null;
|
|
}
|
|
function extractLoginHint(account) {
|
|
return account.loginHint || account.idTokenClaims?.login_hint || null;
|
|
}
|
|
|
|
var Authorize = /*#__PURE__*/Object.freeze({
|
|
__proto__: null,
|
|
getAuthorizationCodePayload: getAuthorizationCodePayload,
|
|
getAuthorizeUrl: getAuthorizeUrl,
|
|
getStandardAuthorizeRequestParameters: getStandardAuthorizeRequestParameters,
|
|
validateAuthorizationResponse: validateAuthorizationResponse
|
|
});
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
|
|
* If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
|
|
* This is used for MCP flows.
|
|
* @param isMcp - Flag indicating if application is an MCP app, from configuration
|
|
* @param request - Auth request
|
|
*/
|
|
function enforceResourceParameter(isMcp, request) {
|
|
if (!isMcp) {
|
|
return;
|
|
}
|
|
if (request.resource &&
|
|
(containsResourceParam(request.extraParameters) ||
|
|
containsResourceParam(request.extraQueryParameters))) {
|
|
throw createClientAuthError(misplacedResourceParam);
|
|
}
|
|
if (!request.resource) {
|
|
throw createClientAuthError(resourceParameterRequired);
|
|
}
|
|
}
|
|
function containsResourceParam(params) {
|
|
if (!params) {
|
|
return false;
|
|
}
|
|
return Object.prototype.hasOwnProperty.call(params, "resource");
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* This is a helper class that parses supported HTTP response authentication headers to extract and return
|
|
* header challenge values that can be used outside the basic authorization flows.
|
|
*/
|
|
class AuthenticationHeaderParser {
|
|
constructor(headers) {
|
|
this.headers = headers;
|
|
}
|
|
/**
|
|
* This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
|
|
* @returns
|
|
*/
|
|
getShrNonce() {
|
|
// Attempt to parse nonce from Authentiacation-Info
|
|
const authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
|
|
if (authenticationInfo) {
|
|
const authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
|
|
if (authenticationInfoChallenges.nextnonce) {
|
|
return authenticationInfoChallenges.nextnonce;
|
|
}
|
|
throw createClientConfigurationError(invalidAuthenticationHeader);
|
|
}
|
|
// Attempt to parse nonce from WWW-Authenticate
|
|
const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
|
|
if (wwwAuthenticate) {
|
|
const wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
|
|
if (wwwAuthenticateChallenges.nonce) {
|
|
return wwwAuthenticateChallenges.nonce;
|
|
}
|
|
throw createClientConfigurationError(invalidAuthenticationHeader);
|
|
}
|
|
// If neither header is present, throw missing headers error
|
|
throw createClientConfigurationError(missingNonceAuthenticationHeader);
|
|
}
|
|
/**
|
|
* Parses an HTTP header's challenge set into a key/value map.
|
|
* @param header
|
|
* @returns
|
|
*/
|
|
parseChallenges(header) {
|
|
const schemeSeparator = header.indexOf(" ");
|
|
const challenges = header.substr(schemeSeparator + 1).split(",");
|
|
const challengeMap = {};
|
|
challenges.forEach((challenge) => {
|
|
const [key, value] = challenge.split("=");
|
|
// Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
|
|
challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
|
|
});
|
|
return challengeMap;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
/**
|
|
* Converts a numeric tag from MSAL Runtime to a 5-character string representation.
|
|
* Tags are encoded as 30-bit values (6 bits per character) using a custom symbol space.
|
|
* @param tag - The numeric tag to convert
|
|
* @returns The string representation of the tag
|
|
*/
|
|
function tagToString(tag) {
|
|
if (tag === 0) {
|
|
return "UNTAG";
|
|
}
|
|
const tagSymbolSpace = "abcdefghijklmnopqrstuvwxyz0123456789****************************";
|
|
let tagBuffer = "*****";
|
|
const chars = [
|
|
tagSymbolSpace[(tag >> 24) & 0x3f],
|
|
tagSymbolSpace[(tag >> 18) & 0x3f],
|
|
tagSymbolSpace[(tag >> 12) & 0x3f],
|
|
tagSymbolSpace[(tag >> 6) & 0x3f],
|
|
tagSymbolSpace[(tag >> 0) & 0x3f],
|
|
];
|
|
tagBuffer = chars.join("");
|
|
return tagBuffer;
|
|
}
|
|
/**
|
|
* Error class for MSAL Runtime errors that preserves detailed broker information
|
|
*/
|
|
class PlatformBrokerError extends AuthError {
|
|
constructor(errorStatus, errorContext, errorCode, errorTag) {
|
|
const tagString = tagToString(errorTag);
|
|
const enhancedErrorContext = errorContext
|
|
? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
|
|
: `(Error Code: ${errorCode}, Tag: ${tagString})`;
|
|
super(errorStatus, enhancedErrorContext);
|
|
this.name = "PlatformBrokerError";
|
|
this.statusCode = errorCode;
|
|
this.tag = tagString;
|
|
Object.setPrototypeOf(this, PlatformBrokerError.prototype);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
* Licensed under the MIT License.
|
|
*/
|
|
const skuGroupSeparator = ",";
|
|
const skuValueSeparator = "|";
|
|
function makeExtraSkuString(params) {
|
|
const { skus, libraryName, libraryVersion, extensionName, extensionVersion, } = params;
|
|
const skuMap = new Map([
|
|
[0, [libraryName, libraryVersion]],
|
|
[2, [extensionName, extensionVersion]],
|
|
]);
|
|
let skuArr = [];
|
|
if (skus?.length) {
|
|
skuArr = skus.split(skuGroupSeparator);
|
|
// Ignore invalid input sku param
|
|
if (skuArr.length < 4) {
|
|
return skus;
|
|
}
|
|
}
|
|
else {
|
|
skuArr = Array.from({ length: 4 }, () => skuValueSeparator);
|
|
}
|
|
skuMap.forEach((value, key) => {
|
|
if (value.length === 2 && value[0]?.length && value[1]?.length) {
|
|
setSku({
|
|
skuArr,
|
|
index: key,
|
|
skuName: value[0],
|
|
skuVersion: value[1],
|
|
});
|
|
}
|
|
});
|
|
return skuArr.join(skuGroupSeparator);
|
|
}
|
|
function setSku(params) {
|
|
const { skuArr, index, skuName, skuVersion } = params;
|
|
if (index >= skuArr.length) {
|
|
return;
|
|
}
|
|
skuArr[index] = [skuName, skuVersion].join(skuValueSeparator);
|
|
}
|
|
/** @internal */
|
|
class ServerTelemetryManager {
|
|
constructor(telemetryRequest, cacheManager) {
|
|
this.cacheOutcome = CacheOutcome.NOT_APPLICABLE;
|
|
this.cacheManager = cacheManager;
|
|
this.apiId = telemetryRequest.apiId;
|
|
this.correlationId = telemetryRequest.correlationId;
|
|
this.wrapperSKU = telemetryRequest.wrapperSKU || "";
|
|
this.wrapperVer = telemetryRequest.wrapperVer || "";
|
|
this.telemetryCacheKey =
|
|
SERVER_TELEM_CACHE_KEY +
|
|
CACHE_KEY_SEPARATOR +
|
|
telemetryRequest.clientId;
|
|
}
|
|
/**
|
|
* API to add MSER Telemetry to request
|
|
*/
|
|
generateCurrentRequestHeaderValue() {
|
|
const request = `${this.apiId}${SERVER_TELEM_VALUE_SEPARATOR}${this.cacheOutcome}`;
|
|
const platformFieldsArr = [this.wrapperSKU, this.wrapperVer];
|
|
const nativeBrokerErrorCode = this.getNativeBrokerErrorCode();
|
|
if (nativeBrokerErrorCode?.length) {
|
|
platformFieldsArr.push(`broker_error=${nativeBrokerErrorCode}`);
|
|
}
|
|
const platformFields = platformFieldsArr.join(SERVER_TELEM_VALUE_SEPARATOR);
|
|
const regionDiscoveryFields = this.getRegionDiscoveryFields();
|
|
const requestWithRegionDiscoveryFields = [
|
|
request,
|
|
regionDiscoveryFields,
|
|
].join(SERVER_TELEM_VALUE_SEPARATOR);
|
|
return [
|
|
SERVER_TELEM_SCHEMA_VERSION,
|
|
requestWithRegionDiscoveryFields,
|
|
platformFields,
|
|
].join(SERVER_TELEM_CATEGORY_SEPARATOR);
|
|
}
|
|
/**
|
|
* API to add MSER Telemetry for the last failed request
|
|
*/
|
|
generateLastRequestHeaderValue() {
|
|
const lastRequests = this.getLastRequests();
|
|
const maxErrors = ServerTelemetryManager.maxErrorsToSend(lastRequests);
|
|
const failedRequests = lastRequests.failedRequests
|
|
.slice(0, 2 * maxErrors)
|
|
.join(SERVER_TELEM_VALUE_SEPARATOR);
|
|
const errors = lastRequests.errors
|
|
.slice(0, maxErrors)
|
|
.join(SERVER_TELEM_VALUE_SEPARATOR);
|
|
const errorCount = lastRequests.errors.length;
|
|
// Indicate whether this header contains all data or partial data
|
|
const overflow = maxErrors < errorCount
|
|
? SERVER_TELEM_OVERFLOW_TRUE
|
|
: SERVER_TELEM_OVERFLOW_FALSE;
|
|
const platformFields = [errorCount, overflow].join(SERVER_TELEM_VALUE_SEPARATOR);
|
|
return [
|
|
SERVER_TELEM_SCHEMA_VERSION,
|
|
lastRequests.cacheHits,
|
|
failedRequests,
|
|
errors,
|
|
platformFields,
|
|
].join(SERVER_TELEM_CATEGORY_SEPARATOR);
|
|
}
|
|
/**
|
|
* API to cache token failures for MSER data capture
|
|
* @param error
|
|
*/
|
|
cacheFailedRequest(error) {
|
|
const lastRequests = this.getLastRequests();
|
|
if (lastRequests.errors.length >=
|
|
SERVER_TELEM_MAX_CACHED_ERRORS) {
|
|
// Remove a cached error to make room, first in first out
|
|
lastRequests.failedRequests.shift(); // apiId
|
|
lastRequests.failedRequests.shift(); // correlationId
|
|
lastRequests.errors.shift();
|
|
}
|
|
lastRequests.failedRequests.push(this.apiId, this.correlationId);
|
|
if (error instanceof Error && !!error && error.toString()) {
|
|
if (error instanceof AuthError) {
|
|
if (error.subError) {
|
|
lastRequests.errors.push(error.subError);
|
|
}
|
|
else if (error.errorCode) {
|
|
lastRequests.errors.push(error.errorCode);
|
|
}
|
|
else {
|
|
lastRequests.errors.push(error.toString());
|
|
}
|
|
}
|
|
else {
|
|
lastRequests.errors.push(error.toString());
|
|
}
|
|
}
|
|
else {
|
|
lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
|
|
}
|
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
|
return;
|
|
}
|
|
/**
|
|
* Update server telemetry cache entry by incrementing cache hit counter
|
|
*/
|
|
incrementCacheHits() {
|
|
const lastRequests = this.getLastRequests();
|
|
lastRequests.cacheHits += 1;
|
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
|
return lastRequests.cacheHits;
|
|
}
|
|
/**
|
|
* Get the server telemetry entity from cache or initialize a new one
|
|
*/
|
|
getLastRequests() {
|
|
const initialValue = {
|
|
failedRequests: [],
|
|
errors: [],
|
|
cacheHits: 0,
|
|
};
|
|
const lastRequests = this.cacheManager.getServerTelemetry(this.telemetryCacheKey, this.correlationId);
|
|
return lastRequests || initialValue;
|
|
}
|
|
/**
|
|
* Remove server telemetry cache entry
|
|
*/
|
|
clearTelemetryCache() {
|
|
const lastRequests = this.getLastRequests();
|
|
const numErrorsFlushed = ServerTelemetryManager.maxErrorsToSend(lastRequests);
|
|
const errorCount = lastRequests.errors.length;
|
|
if (numErrorsFlushed === errorCount) {
|
|
// All errors were sent on last request, clear Telemetry cache
|
|
this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
|
|
}
|
|
else {
|
|
// Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
|
|
const serverTelemEntity = {
|
|
failedRequests: lastRequests.failedRequests.slice(numErrorsFlushed * 2),
|
|
errors: lastRequests.errors.slice(numErrorsFlushed),
|
|
cacheHits: 0,
|
|
};
|
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
|
|
}
|
|
}
|
|
/**
|
|
* Returns the maximum number of errors that can be flushed to the server in the next network request
|
|
* @param serverTelemetryEntity
|
|
*/
|
|
static maxErrorsToSend(serverTelemetryEntity) {
|
|
let i;
|
|
let maxErrors = 0;
|
|
let dataSize = 0;
|
|
const errorCount = serverTelemetryEntity.errors.length;
|
|
for (i = 0; i < errorCount; i++) {
|
|
// failedRequests parameter contains pairs of apiId and correlationId, multiply index by 2 to preserve pairs
|
|
const apiId = serverTelemetryEntity.failedRequests[2 * i] || "";
|
|
const correlationId = serverTelemetryEntity.failedRequests[2 * i + 1] || "";
|
|
const errorCode = serverTelemetryEntity.errors[i] || "";
|
|
// Count number of characters that would be added to header, each character is 1 byte. Add 3 at the end to account for separators
|
|
dataSize +=
|
|
apiId.toString().length +
|
|
correlationId.toString().length +
|
|
errorCode.length +
|
|
3;
|
|
if (dataSize < SERVER_TELEM_MAX_LAST_HEADER_BYTES) {
|
|
// Adding this entry to the header would still keep header size below the limit
|
|
maxErrors += 1;
|
|
}
|
|
else {
|
|
break;
|
|
}
|
|
}
|
|
return maxErrors;
|
|
}
|
|
/**
|
|
* Get the region discovery fields
|
|
*
|
|
* @returns string
|
|
*/
|
|
getRegionDiscoveryFields() {
|
|
const regionDiscoveryFields = [];
|
|
regionDiscoveryFields.push(this.regionUsed || "");
|
|
regionDiscoveryFields.push(this.regionSource || "");
|
|
regionDiscoveryFields.push(this.regionOutcome || "");
|
|
return regionDiscoveryFields.join(",");
|
|
}
|
|
/**
|
|
* Update the region discovery metadata
|
|
*
|
|
* @param regionDiscoveryMetadata
|
|
* @returns void
|
|
*/
|
|
updateRegionDiscoveryMetadata(regionDiscoveryMetadata) {
|
|
this.regionUsed = regionDiscoveryMetadata.region_used;
|
|
this.regionSource = regionDiscoveryMetadata.region_source;
|
|
this.regionOutcome = regionDiscoveryMetadata.region_outcome;
|
|
}
|
|
/**
|
|
* Set cache outcome
|
|
*/
|
|
setCacheOutcome(cacheOutcome) {
|
|
this.cacheOutcome = cacheOutcome;
|
|
}
|
|
setNativeBrokerErrorCode(errorCode) {
|
|
const lastRequests = this.getLastRequests();
|
|
lastRequests.nativeBrokerErrorCode = errorCode;
|
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
|
}
|
|
getNativeBrokerErrorCode() {
|
|
return this.getLastRequests().nativeBrokerErrorCode;
|
|
}
|
|
clearNativeBrokerErrorCode() {
|
|
const lastRequests = this.getLastRequests();
|
|
delete lastRequests.nativeBrokerErrorCode;
|
|
this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
|
|
}
|
|
static makeExtraSkuString(params) {
|
|
return makeExtraSkuString(params);
|
|
}
|
|
}
|
|
|
|
exports.AADServerParamKeys = AADServerParamKeys;
|
|
exports.AccountEntityUtils = AccountEntityUtils;
|
|
exports.AuthError = AuthError;
|
|
exports.AuthErrorCodes = AuthErrorCodes;
|
|
exports.AuthToken = AuthToken;
|
|
exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
|
|
exports.Authority = Authority;
|
|
exports.AuthorityFactory = AuthorityFactory;
|
|
exports.AuthorityType = AuthorityType;
|
|
exports.AuthorizationCodeClient = AuthorizationCodeClient;
|
|
exports.Authorize = Authorize;
|
|
exports.AzureCloudInstance = AzureCloudInstance;
|
|
exports.CacheError = CacheError;
|
|
exports.CacheErrorCodes = CacheErrorCodes;
|
|
exports.CacheHelpers = CacheHelpers;
|
|
exports.CacheManager = CacheManager;
|
|
exports.CcsCredentialType = CcsCredentialType;
|
|
exports.ClientAssertionUtils = ClientAssertionUtils;
|
|
exports.ClientAuthError = ClientAuthError;
|
|
exports.ClientAuthErrorCodes = ClientAuthErrorCodes;
|
|
exports.ClientConfigurationError = ClientConfigurationError;
|
|
exports.ClientConfigurationErrorCodes = ClientConfigurationErrorCodes;
|
|
exports.Constants = Constants;
|
|
exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
|
|
exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
|
|
exports.DefaultStorageClass = DefaultStorageClass;
|
|
exports.EXT_FIELD_PREFIX = EXT_FIELD_PREFIX;
|
|
exports.IntFields = IntFields;
|
|
exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
|
|
exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
|
|
exports.JsonWebTokenTypes = JsonWebTokenTypes;
|
|
exports.Logger = Logger;
|
|
exports.NetworkError = NetworkError;
|
|
exports.PerformanceEventStatus = PerformanceEventStatus;
|
|
exports.PerformanceEvents = PerformanceEvents;
|
|
exports.PlatformBrokerError = PlatformBrokerError;
|
|
exports.PopTokenGenerator = PopTokenGenerator;
|
|
exports.ProtocolMode = ProtocolMode;
|
|
exports.ProtocolUtils = ProtocolUtils;
|
|
exports.RefreshTokenClient = RefreshTokenClient;
|
|
exports.RequestParameterBuilder = RequestParameterBuilder;
|
|
exports.ResponseHandler = ResponseHandler;
|
|
exports.ScopeSet = ScopeSet;
|
|
exports.ServerError = ServerError;
|
|
exports.ServerTelemetryManager = ServerTelemetryManager;
|
|
exports.SilentFlowClient = SilentFlowClient;
|
|
exports.StringUtils = StringUtils;
|
|
exports.StubPerformanceClient = StubPerformanceClient;
|
|
exports.StubbedNetworkModule = StubbedNetworkModule;
|
|
exports.ThrottlingUtils = ThrottlingUtils;
|
|
exports.TimeUtils = TimeUtils;
|
|
exports.Token = Token;
|
|
exports.TokenCacheContext = TokenCacheContext;
|
|
exports.UrlString = UrlString;
|
|
exports.UrlUtils = UrlUtils;
|
|
exports.buildAccountToCache = buildAccountToCache;
|
|
exports.buildClientConfiguration = buildClientConfiguration;
|
|
exports.buildClientInfo = buildClientInfo;
|
|
exports.buildClientInfoFromHomeAccountId = buildClientInfoFromHomeAccountId;
|
|
exports.buildStaticAuthorityOptions = buildStaticAuthorityOptions;
|
|
exports.buildTenantProfile = buildTenantProfile;
|
|
exports.createAuthError = createAuthError;
|
|
exports.createCacheError = createCacheError;
|
|
exports.createClientAuthError = createClientAuthError;
|
|
exports.createClientConfigurationError = createClientConfigurationError;
|
|
exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
|
|
exports.createNetworkError = createNetworkError;
|
|
exports.enforceResourceParameter = enforceResourceParameter;
|
|
exports.formatAuthorityUri = formatAuthorityUri;
|
|
exports.getAndFlushLogsFromCache = getAndFlushLogsFromCache;
|
|
exports.getClientAssertion = getClientAssertion;
|
|
exports.getRequestThumbprint = getRequestThumbprint;
|
|
exports.getTenantIdFromIdTokenClaims = getTenantIdFromIdTokenClaims;
|
|
exports.invoke = invoke;
|
|
exports.invokeAsync = invokeAsync;
|
|
exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
|
|
exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
|
|
exports.version = version;
|
|
//# sourceMappingURL=index-node-9_Gz5QUk.js.map
|