-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Workaround MSAL.NET issue with MSA-PT account silent auth #1321
Conversation
Let the caller in to the `IMicrosoftAuthentication` component decide if Microsoft Account Passthrough (MSA-PT) behaviour should be used. Azure DevOps requires MSA-PT, so set that to `true` in usages.
When we have a Microsoft Account (MSA) in the cache and attempt to do a silent authentication, if we're an MSA-PT app we need to specify the special MSA transfer tenant ID to make sure we get the a token silently, correctly. See the issue [1] in the MSAL repo for more information. [1] AzureAD/microsoft-authentication-library-for-dotnet#3077
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice! ✨
var atsBuilder = app.AcquireTokenSilent(scopes, account); | ||
|
||
// Is we are operating with an MSA passthrough app we need to ensure that we target the | ||
// special MSA 'transfer' tenant explicitly. This is a workaround for MSAL issue: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Super nit: I'm wondering whether there's any public documentation available about the transfer tenant that we can link here for those who would like to learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unfortunately MSA passthrough is an internal (and legacy) feature of the Microsoft Identity platform, and the only docs are for Microsoft employees only: https://review.learn.microsoft.com/en-us/identity/microsoft-identity-platform/stack-choices?branch=main#msa-passthrough
**Changes since 2.2.2:** - Fix a GCM/Git Trace2 file locking issue - Issue: #1323 - PR: #1340 - Remove symlinks to `git-credential-manager-core` exe - Issue: #1322 - PR: #1327 - Add fallback http uri to `diagnose` command - Issue: #1215 - PR: #1339 - Workaround MSAL tenant issue with silent auth - Issue: #1297 - PR: #1321
When we have a Microsoft Account (MSA) in the cache and attempt to do a silent authentication, if we're an MSA-PT app we need to specify the special MSA transfer tenant ID to make sure we get the a token silently, correctly.
See the issue in the MSAL repo for more information.
Fixes: #1297