[Feature Request] Provide a more sophisticated token cache L1/L2 (L1 in InMemoryCache, L2 IDistributedCache, with encryption strategy)

[jmprieur]

Is your feature request related to a problem? Please describe.
@henrik-me to update or @jennyf19 / @jmprieur after discussing with @henrik-me and/or @GeoK

Describe the solution you'd like
TBD

Describe alternatives you've considered
TBD

Additional context
See MISE

[damienbod]

It would be great that when the required access token has expired, or does not exist in the cache, the lib just tries to get a new access token. We do this with other OIDC, OAUTH clients. Would this be possible?

Greetings Damien

[jmprieur]

@damienbod : in a web app? or in a web API?
in a web app, Microsoft.Identity.Web manages it already with the [AuthorizeForScopes] attribute. See https://github.com/AzureAD/microsoft-identity-web/wiki/Managing-incremental-consent-and-conditional-access

[damienbod]

Hi @jmprieur In both, I don't see this from the docs. But you say then that if I don't use a persistent cache, then I can use the [AuthorizeForScopes] attribute on my API and it will get me a new token if the the cache has been reset?

Will try this. => Tried this and it does not help (hopefully I try this correctly.)

I can show the problem with the demo:

https://github.com/damienbod/AzureADAuthRazorUiServiceApiCertificate/tree/main/DownstreamApis

Steps to reproduce:

• Start the Web App and the 2 APIs
• call the API from the Web APP
• stop the applications
• start the applications again
• call the API => Bug
  ApplicationException: Exception Microsoft.Identity.Web.MicrosoftIdentityWebChallengeUserException: IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. See https://aka.ms/ms-id-web/ca_incremental-consent.

If I reset my persistent cache or use in memory cache I have this problem.The consent has been already given. To solve I need to delete my cookies from the browser or use a persistent cache but then problem will exist here as well if the cache gets reset.

It would be great if the lib could recover from this without having to delete the APP cookies.

Thanks Damien

[jmprieur]

Thanks @damienbod
this is on the backlog: #685
(today if you have a web API, you'd need handle the exception and pass it to ITokenAcquisition.ReplyForbiddenWithWwwAuthenticateHeaderAsync. See https://github.com/AzureAD/microsoft-identity-web/wiki/web-apis#handle-conditional-access

[jennyf19]

Included in 1.8.0 release