[Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 #13263

sadasant · 2021-01-15T23:01:51Z

This PR is intended to fix #13155. I'll keep it as draft until @jonathandturner is able to do an initial review at least. I've tested a bit of it, but I'd like to run some more tests before I make it out of draft.

This PR switches from using the msal on InteractiveBrowserCredential, which uses the implicit flow, to use @azure/msal-browser 2.0^, which uses the PKCE authentication flow.

Reviews appreciated as always!

If you are curious on how I tested this, you can see my changes on this other PR:
#13308

The current state of this PR defaults on MSAL 2.0, but also allows users to go back to MSAL 1 by passing the flow property on the options bag to the InteractiveBrowserCredential constructor.

Fixes #13155
Fixes #13080

…browser-2.0

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts

sophiajt · 2021-01-17T20:22:44Z

This looks okay to me. @sameerag - can you take a look (or tag someone on your side)? Would be good to get some eyes on this from the MSAL side.

sadasant · 2021-01-19T17:08:28Z

@jonathandturner -> @pkanher617 is from Sameera's side 🌞

I'll do some tests today to ensure I see more clearly all the moving parts, then I'll make this out of draft 👍

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts

sameerag

Initial review comments: looks good. Will approve once out of draft.

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts

sadasant · 2021-01-25T13:37:38Z

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts

+
+    this.msalObject = new msalBrowser.PublicClientApplication(this.msalConfig);
+
+    this.handleRedirectResponse();


Important:
After redirect, the first time the user initializes any InteractiveBrowserCredential is when we'll be able to authenticate based on the redirect response. To finish the authentication flow, we need the fully formed configuration object, which we generate based on the parameters to this credential. Is it safe to assume that the first initialization of InteractiveBrowserCredential can be used to finish the MSAL redirect authentication flow?

An alternative I can think of is to store each set of new InteractiveBrowserCredential parameters in something like localStorage, then to cache the promise on page load based on the latest set of parameters, then on constructor initialization to match the promise based on parameters again.

My thought process is that I believe we can get away with asking the user to instantiate the InteractiveBrowserCredential on page load for the redirect style. Is this a reasonable assumption?

@jonathandturner , @sameerag

I believe msal-browser already addresses this. @pkanher617 to confirm.

The main issue is that if I have an app that has two instances of this credential, without this cache, the first one that is able to handle the redirect will get authenticated, the second one won't 🤔 I could be doing something wrong though.

Also, a separate problem perhaps:
Consider an application trying to authenticate two different accounts, how would one identify each individual redirect response? One would happen first, of course, then the other one would need to happen, but each time the page loads we lose track of the other credential. Does that make sense? I wonder if I'm doing something wrong.

Ok so we arrived at the following:

We'll only allow one active account per client ID and tenant ID pair.

If two or more clients try to authenticate with the same client ID and tenant ID, if the first succeeds authenticating, the others will be able to retrieve this same account, so there will be no further authentication attempts, and our limitation above will be respected: only one account per client ID and tenant ID.

If the user happens to use MSAL-browser by their own account, and the storage is polluted, we might be able to get into two accounts. In that case, we will throw with an error, asking them to clear their browser cache.

I'll be asking @schaabs about this approach, but in the mean time, this is the update I'll be making to this PR.

…3511) * [Identity] InteractiveBrowserCredential - Fix Azure Stack support Fixes #11220 This PR ensures InteractiveBrowserCredential works for Azure Stack. This PR is compatible with the other InteractiveBrowserCredential PR: #13263 * changelog entry

…browser-2.0

sadasant · 2021-02-03T22:21:08Z

Adding [DO NOT MERGE] since we're pondering to release a patch first from a stable master, then include CAE and MSAL 2.0 in a beta release.

…browser-2.0

praveenkuttappan · 2021-02-11T23:59:06Z

/azp run js - core - ci

azure-pipelines · 2021-02-11T23:59:19Z

Azure Pipelines successfully started running 1 pipeline(s).

…browser-2.0

As part of Azure#13263 I added this link to the list of ignored links to make the build pass. I'm removing it now since it's not necessary anymore. Fixes Azure#13566

As part of #13263 I added this link to the list of ignored links to make the build pass. I'm removing it now since it's not necessary anymore. Fixes #13566

sadasant added 3 commits January 15, 2021 00:35

wip

b5ec3fd

msal changes

60c53ea

Merge remote-tracking branch 'Azure/master' into identity/13155-msal-…

ad9cfdc

…browser-2.0

sadasant requested a review from sophiajt January 15, 2021 23:01

ghost added the Azure.Identity label Jan 15, 2021

This comment has been minimized.

Sign in to view

correlationId from uuid, for now at least

e64a199

sadasant commented Jan 15, 2021

View reviewed changes

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts Outdated Show resolved Hide resolved

sadasant self-assigned this Jan 15, 2021

pkanher617 reviewed Jan 15, 2021

View reviewed changes

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts Outdated Show resolved Hide resolved

using msal-browser solely instead of msal-common

932cc56

sameerag reviewed Jan 20, 2021

View reviewed changes

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts Outdated Show resolved Hide resolved

sameerag reviewed Jan 20, 2021

View reviewed changes

sadasant added 3 commits January 20, 2021 17:57

updates after several tests

ad264d9

avoiding generating a correlationId ourselves, MSAL already does this

2bf06eb

lint fix

a636f36

sadasant marked this pull request as ready for review January 21, 2021 01:04

sadasant requested review from bterlson, chradek, daviwil, schaabs and xirzec as code owners January 21, 2021 01:04

nikithauc mentioned this pull request Jan 21, 2021

@azure/identity-TokenCredential microsoftgraph/msgraph-sdk-javascript#371

Merged

sadasant commented Jan 22, 2021

View reviewed changes

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts Outdated Show resolved Hide resolved

pkanher617 reviewed Jan 22, 2021

View reviewed changes

sdk/identity/identity/src/credentials/interactiveBrowserCredential.browser.ts Outdated Show resolved Hide resolved

no more getAllAccounts and stopping execution after initial redirect

034fc42

sadasant commented Jan 25, 2021

View reviewed changes

no more chededirectResponse

d857339

sadasant added 3 commits February 2, 2021 18:21

Merge branch 'master' into identity/13155-msal-browser-2.0

806e187

Merge remote-tracking branch 'Azure/master' into identity/13155-msal-…

61eacb1

…browser-2.0

build fixes

e249936

sadasant requested review from danieljurek, mikeharder, mitchdenny, praveenkuttappan and weshaggard as code owners February 3, 2021 21:46

sadasant mentioned this pull request Feb 3, 2021

[Identity] Remove ignored link #13566

Closed

pnpm-lock update

a07720f

sadasant changed the title ~~[Identity] InteractiveBrowserCredential to use MSAL Browser 2.0~~ [DO NOT MERGE] [Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 Feb 3, 2021

Merge remote-tracking branch 'Azure/master' into identity/13155-msal-…

a18eb60

…browser-2.0

sadasant changed the title ~~[DO NOT MERGE] [Identity] InteractiveBrowserCredential to use MSAL Browser 2.0~~ [Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 Feb 11, 2021

sadasant and others added 2 commits February 11, 2021 15:13

Merge branch 'master' into identity/13155-msal-browser-2.0

b57d87d

Merge remote-tracking branch 'Azure/master' into identity/13155-msal-…

f989b2c

…browser-2.0

sadasant requested review from HarshaNalluru and richardpark-msft as code owners February 11, 2021 23:51

sadasant force-pushed the identity/13155-msal-browser-2.0 branch from 39ba458 to f989b2c Compare February 11, 2021 23:58

implicit redirect fix

68c5078

HarshaNalluru mentioned this pull request Feb 12, 2021

[Identity] Using service-bus for manual test with MSAL 2.0 #13308

Merged

Merge remote-tracking branch 'Azure/master' into identity/13155-msal-…

9a46ca6

…browser-2.0

sadasant merged commit 29825f0 into Azure:master Feb 13, 2021

sadasant deleted the identity/13155-msal-browser-2.0 branch February 13, 2021 00:03

sadasant mentioned this pull request Feb 16, 2021

[Identity] Remove ignored link #13807

Merged

ghost pushed a commit that referenced this pull request Feb 16, 2021

[Identity] Remove ignored link (#13807)

9266a1e

As part of #13263 I added this link to the list of ignored links to make the build pass. I'm removing it now since it's not necessary anymore. Fixes #13566

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 #13263

[Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 #13263

sadasant commented Jan 15, 2021 •

edited

Loading

This comment has been minimized.

sophiajt commented Jan 17, 2021

sadasant commented Jan 19, 2021

sameerag left a comment

sadasant Jan 25, 2021

sameerag Jan 25, 2021

sadasant Jan 25, 2021

sadasant Jan 25, 2021

sadasant commented Feb 3, 2021

praveenkuttappan commented Feb 11, 2021

azure-pipelines bot commented Feb 11, 2021


		this.msalObject = new msalBrowser.PublicClientApplication(this.msalConfig);

		this.handleRedirectResponse();

[Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 #13263

[Identity] InteractiveBrowserCredential to use MSAL Browser 2.0 #13263

Conversation

sadasant commented Jan 15, 2021 • edited Loading

This comment has been minimized.

sophiajt commented Jan 17, 2021

sadasant commented Jan 19, 2021

sameerag left a comment

Choose a reason for hiding this comment

sadasant Jan 25, 2021

Choose a reason for hiding this comment

sameerag Jan 25, 2021

Choose a reason for hiding this comment

sadasant Jan 25, 2021

Choose a reason for hiding this comment

sadasant Jan 25, 2021

Choose a reason for hiding this comment

sadasant commented Feb 3, 2021

praveenkuttappan commented Feb 11, 2021

azure-pipelines bot commented Feb 11, 2021

sadasant commented Jan 15, 2021 •

edited

Loading