Claims don't bypass the cache for OBO and client_credentials

[bgavrilMS]

Core Library

MSAL Node (@azure/msal-node)

Core Library Version

1.17.3

Wrapper Library

Not Applicable

Wrapper Library Version

n/a

Public or Confidential Client?

Confidential

Description

1. Acquire a token from the STS using client_creds or OBO
2. Make the same request again. Expect the result to come from the cache.
3. Make a similar request, where you add some claims e.g. claims="foo"

Expected: request should go to the STS
Actual: token is served from the cache

Impact: this breaks the CAE scenario for web api and the upcoming CAE support for S2S

Error Message

see description

Msal Logs

see description

MSAL Configuration

see description

Relevant Code Snippets

see description

Reproduction Steps

see description

Expected Behavior

see description

Identity Provider

Azure AD / MSA

Browsers Affected (Select all that apply)

None (Server)

Regression

No response

Source

Internal (Microsoft)

[bgavrilMS]

Assigning to you @hectormmg as discussed over Teams. Thanks for observing this behavior !

[bgavrilMS]

I am not sure this is correct, I think @Robbie-Microsoft you tried it out and the cache is bypassed?

[Robbie-Microsoft]

I think I tried it out, but I can't remember. I noticed this is from last June and is for msal-node v1. Should I test this in v2? Or only v1?

[bgavrilMS]

Only the current version of MSAL (2.x)

[Robbie-Microsoft]

I just tried it out for client credentials with

const request: msal.ClientCredentialRequest = { scopes: ["https://graph.microsoft.com/.default"], claims: "foo", };

for the third request, and the token is indeed returned from the cache. Claims DO NOT bypass the cache for client credentials.

[bgavrilMS]

I'm surprised. You closed this #6769 which is a superset. Step 4 there states "token does not come from the cache". What changed?

In any case, this is a P1 that needs to be fixed then.

[Robbie-Microsoft]

I'm not sure what happened, but it looks like that PR is missing steps 4 & 5 for client_credentails, obo, and auth_code. Investigating now.

[Robbie-Microsoft]

I'm surprised. You closed this #6769 which is a superset. Step 4 there states "token does not come from the cache". What changed?

In any case, this is a P1 that needs to be fixed then.

@bgavrilMS I see my error now. I misinterpreted your description of the unit tests that needed to be written. I have now modified the unit test to properly test that requests with claims skip the cache.