Skip to content

[Bug] Client Credential should not be allowed over organizations and common #1384

Open
@bgavrilMS

Description

Which Version of MSAL are you using ?
4.3.x

What authentication flow has the issue?
Client creds

Repro

  1. Create CCA with tenantless AAD authority (e.g. common)
  2. AcquireTokenForClient -> fetches a token, for tenant T1
  3. AcquireTokenForClient with authority override set tenanted authority T1

Actual: Second call to AcquireTokenForClient should fetch the AT in the cache
Expected: MSAL talks to Evo to get a new token

Note: discussed this with Adrian Frei and Evo's stance is that client_credentials should never have he authority set to common (or organizations). consumers should be supported thought). From MSAL perspective, we cannot get the actual tenant ID because we normally get it from the ID Token, which is not present in response.

Additional fix: populate AuthenticationResult.TenantID with the authority tenantid

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions