Add per-request tenant ID option

[chlowell]

This closes #296 by adding a new option, WithTenantID, for public and confidential client token acquisition methods. Tenant resolution follows the logic laid out in #296; see the new tests. Feel free to just look at the tests if you aren't interested in the Go plumbing that makes this new option work.

WithTenantID is straightforward to use in an application but its implementation is complex because it must function alongside options which apply only to particular methods, those methods must accept it without a breaking change to their signatures, and we still want the compiler to prevent users from passing invalid options to a method. Credit goes to @element-of-surprise for the pattern I implemented here.

I exported the new *Option interfaces supporting WithTenantID to enable users to fake Client with their own interfaces (but users can't implement the *Option interfaces). Sadly, this clutters the public API with overlapping names, for example:

type AcquireTokenByAuthCodeOption func(a *AcquireTokenByAuthCodeOptions)
type AcquireByAuthCodeOption interface { ... }
type AcquireTokenByAuthCodeOptions struct { ... }

[element-of-surprise]

There are two things here: 1.17 is out of support. Go team supports two versions, which means 1.18 and 1.19 1.18 introduces generics. I haven't looked but if he ported my libs into here it uses generics in the apply loop. Charles and I have been talking, and we think we should probably switch these shortly after Go team drops support for the previous version. What do you think Joel? Charles, I haven't looked at this yet, but it will probably be Monday because I took a couple days off this week. You may need to ping me, as I tend to forget stuff when I go off for 4 days.

-- Doak

________________________________ From: Joel Hendrix ***@***.***> Sent: Wednesday, August 17, 2022 11:09 AM To: AzureAD/microsoft-authentication-library-for-go ***@***.***> Cc: John Doak ***@***.***>; Mention ***@***.***> Subject: Re: [AzureAD/microsoft-authentication-library-for-go] Add per-request tenant ID option (PR #343) @jhendrixMSFT commented on this pull request.

________________________________ In go.mod<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.luolix.top%2FAzureAD%2Fmicrosoft-authentication-library-for-go%2Fpull%2F343%23discussion_r948270243&data=05%7C01%7CJohn.Doak%40microsoft.com%7C315b69af032d497e38c508da807b99c8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637963565594323655%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=PyTY1MDgnYtRivUM%2FlGw2iEfEisZDmG5plBBMx0BpYQ%3D&reserved=0>:

@@ -1,6 +1,6 @@

module github.com/AzureAD/microsoft-authentication-library-for-go

…

-go 1.17 +go 1.18 Are we using something new in Go 1.18? — Reply to this email directly, view it on GitHub<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.luolix.top%2FAzureAD%2Fmicrosoft-authentication-library-for-go%2Fpull%2F343%23pullrequestreview-1076194688&data=05%7C01%7CJohn.Doak%40microsoft.com%7C315b69af032d497e38c508da807b99c8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637963565594323655%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sSVwg9BwxKzVgw1zFV%2BA9Z9nrWM1f%2FDwOmiNc%2B5IGK0%3D&reserved=0>, or unsubscribe<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.luolix.top%2Fnotifications%2Funsubscribe-auth%2FAKCSL7BNLTNCPFCX6TLQNTLVZUTE3ANCNFSM56XUJKOQ&data=05%7C01%7CJohn.Doak%40microsoft.com%7C315b69af032d497e38c508da807b99c8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637963565594323655%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=amC11H3dj%2B1ui7b8hf9CWVVZcTl2voQZKq1V9RYmtVc%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[bgavrilMS]

I would add another restriction here, i.e. we should not allow the tenantID to be common or organizations because the intent of this option is to help multi-tenant apps get tokens for specific tenants only. It's ok to go from general to specific, i.e. authority = "l.m.o/common" and tenant = "12345-..", but there aren't any scenarios where you'd want to go from "common" to "common" or from "12345" to "common".

Never mind, this is implemented in authority.go and there are tests for it!

[bgavrilMS]

Also, just FYI / for context, both in client_credentials flow and in OBO flow, calls should not be made over "common" / "organizations".

• in client_credentials we should outright ban it, because "common" is only supposed to work with user flows
• in OBO, if you've got a multi-tenant app, the tenant should be incomming_assertion.tid

[chlowell]

"common" is the default confidential client tenant here, so I opened #348 to track addressing your first point. For OBO, you mean that the application should request a token from the same tenant the user authenticated in i.e., the value of the assertion's tid claim?

[element-of-surprise]

Reviewed from the options part of the code, which lgtm.

[jhendrixMSFT]

LGTM although somebody from the MSAL should review the MSAL-specific parts.

[sonarcloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
18 Code Smells

No Coverage information
12.2% Duplication

[rayluo]

Thanks for the discussion on the feature. This implementation looks good to me.