[Bug] Client Credential should not be allowed over organizations and common #1384
Open
Description
Which Version of MSAL are you using ?
4.3.x
What authentication flow has the issue?
Client creds
Repro
- Create CCA with tenantless AAD authority (e.g. common)
- AcquireTokenForClient -> fetches a token, for tenant T1
- AcquireTokenForClient with authority override set tenanted authority T1
Actual: Second call to AcquireTokenForClient should fetch the AT in the cache
Expected: MSAL talks to Evo to get a new token
Note: discussed this with Adrian Frei and Evo's stance is that client_credentials should never have he authority set to common
(or organizations
). consumers
should be supported thought). From MSAL perspective, we cannot get the actual tenant ID because we normally get it from the ID Token, which is not present in response.
Additional fix: populate AuthenticationResult.TenantID with the authority tenantid