azuread/microsoft-authentication-library-for-dotnet

Microsoft Authentication Library (MSAL) for .NET

Microsoft Authentication Library (MSAL) for .NET

The MSAL library for .NET is part of the Microsoft identity platform for developers (formerly named Azure AD) v2.0. It enables you to acquire security tokens to call protected APIs. It uses industry standard OAuth2 and OpenID Connect. The library also supports Azure AD B2C.

Quick links:

Conceptual documentation	Getting Started	Sample Code	API Reference	Support	Feedback

Performance perspectives

Our documentation describes the approach to performance testing.

View some of the historical performance benchmark results in our dashboard.

Support SLA

MSAL.NET became Generally Available with MSAL.NET 3.0.8. Since MSAL.NET moved to version 4:

• Major versions are supported for twelve months after the release of the next major version.
• Minor versions older than N-1 are not supported.

Note Minor versions include bug fixes or features with non-breaking (additive) API changes. It is expected that applications using the library can upgrade through the IDE or CLI with no friction. We will not patch old minor versions of the library. When opening new issues, please confirm that you are using the latest minor version.

Using MSAL.NET

• Guides, tutorials, and detailed walkthroughs are available on Microsoft Learn.
• API documentation is available on Microsoft Learn
• Code samples are available from our Samples page.

Where do I file issues

You can file new issues in this repository.

Community help and support

We use Stack Overflow with the community to provide support. We highly recommend you ask your questions on Stack Overflow first and browse existing issues to see if someone has asked your question before.

If you find a bug or have a feature request, please raise the issue on GitHub Issues.

Contribute

We welcome contributions and feedback. You can fork and clone the repo and start contributing now. Read our Contribution Guide for more information.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Security library

This library controls how users sign-in and access services. We recommend you always take the latest version of our library in your app when possible. We use semantic versioning so you can control the risk associated with updating your app. As an example, always downloading the latest minor version number (e.g. x.y.z) ensures you get the latest security and feature enhancements but our API surface remains the same. You can always see the latest version and release notes under the Releases tab of GitHub.

Security reporting

If you find a security issue with our libraries or services please report it to [email protected] in as much detail as possible. Your submission may be eligible for a bounty through the Microsoft Bug Bounty program. Please do not post security issues to GitHub Issues or any other public site. We will contact you shortly after receiving the information. We encourage you to get notifications of when security incidents occur by visiting the Microsoft Technical Security Notifications page and subscribing to Security Advisory Alerts.

Data collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft's privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

See the our telemetry documentation for an example of the telemetry collected by MSAL.NET.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Copyright © Microsoft Corporation. All rights reserved. Licensed under the MIT License (the "License").

microsoft-authentication-library-for-dotnet's Issues

Fix webview bug in iOS and cache storage label issue

Fix webview bug in iOS and cache storage label issue

Instance discovery fails with HTTP 400 for valid authorities

compare with ADAL and make necessary fixes.

add default client id for public clients

add default client id for public clients

disable SSO header feature

disable SSO header feature

Add OSS header to all source

check if we can have empty scopes

check if we can have empty scopes and document how to handle them.

add get authz url tests

add get authz url tests

Send client_info=1 parameter on token endpoint.

We need to send client_info=1 parameter on token endpoint to get uid, utid. Update cache model to use uid/utid as a key instead of home oid.

Handle organizations and consumers as common authority

Handle organizations and consumers as common authority. Currently only "/common" is treated as Common endpoint. MSAL needs to add support for /organizations and /consumers.

Remove integrated auth support using WS-Trust

Remove integrated auth support using WS-Trust. Update source to use silent web UI.

Add innerexception to AcquireTokenSilentAcquisitionException

Add innerexception to AcquireTokenSilentAcquisitionException

Make client Id immutable in application object

Make client Id immutable in application object.

Add hook to test browser control launch and close

Add hook to test browser control launch and close

throw Argument exception when platform parameters are not complete

throw Argument exception when platform parameters are not complete

Use SOAPValue to determine WSTrust 1.3 vs 2005

Use SOAPValue to determine WSTrust 1.3 vs 2005

Use rootId to represent user instead of uniqueId

Use rootId to represent user instead of uniqueId

replace PCL. to MSAL. in PlatformInformation.GetProductName

replace PCL. to MSAL. in PlatformInformation.GetProductName

Clean project structure

Clean project structure

MSAL.NET supports family of client ids

Family of client ids

Clean up warnings during the build

Clean up warnings during the build

Refresh Token as a SSO artifact

Refresh Token as a SSO artifact -- (Header)

Add forceRefresh support in Silent calls

Add forceRefresh support in Silent calls

make token cache scope lookup case insensitive

make token cache scope lookup case insensitive

Port bug fixes from v2 and v3 in to MSAL

Port bug fixes from v2 and v3 in to MSAL

Add support for UserAssertion Hash

Add support for UserAssertion Hash

access token not returned when restrict2singleuser=true and authority is common

MSAL does not return access token when restrictToSingleUser=true and authority tenant is set to common. MSAL should be able to ignore the tenant and return the AT because we guarantee single unique user in the cache.

Normalize cache storage to have 1 RT per user

Normalize cache storage to have 1 RT per user

MSAL should send haschrome=1 QP for all interactive requests

MSAL should send haschrome=1 QP for all interactive requests. This will hide the back button the UI and developers will stop getting access_denied error when it was actually user_cancel.

refactor hard-coded string into variables

refactor hard-coded string into variables

app.Users does not add client_id and cache reference to object

app.Users does not add client_id and cache reference to object

MSAL.Net Cache is backward and forward compatible

Why?
To enable an easy migration of applications using ADAL.Net to MSAL.Net, we'd want the cache to be backward and forward compatible in both libraries.

What?
MSAL.Net should be able to:

• read ADAL.NET v3.0 cache blobs and migrate refresh tokens to MSAL cache format.
• write both ADAL.NET v3.0 blob format and MSAL.NET Json format.
• Add a test where HasStateChanged is false due to the token not in the cache, thus not deleted, thus no state changed (See #252)
• RequestParams should not be passed in the token cache. request classes must pass exact information to the methods (#317)

look up userIdentifier in the cache to load user object

look up userIdentifier in the cache to load user object when developer passes identifier instead of User in AcquireTokenSilentHandler and other flows.

special case b2c scenarios to not send email and profile as scopes for BUILD

special case b2c scenarios to not send email and profile as scopes

turn on warnings as errors in build

turn on warnings as errors in build. This requires removing all the code warnings in the source first.

Revert changes for Issue #55 once b2c is updated

Revert changes for Issue #55 once b2c is updated

disable HTTP redirects in webview

disable HTTP redirects in webview

remove stream.position and fix MSALServiceException

remove stream.position and fix MSALServiceException in HttpClientWrapper.GetResponseAsync

Revert changes for issue #65 once feature is fully supported

Revert changes for issue #65

add last updated time to refresh tokens

this is required for family of client id feature

New JSON cache format for cross platform sharing

New JSON cache format for cross platform sharing

Make the cache thread safe

Make the cache thread safe

add whitelist for url schemes

add whitelist for url schemes where only HTTPS redirects are allowed.-- see adal v3 for reference

Update README

Update README

Add fxcop analysis during build

Add fxcop analysis during build

Rework Exception handling

Rework Exception handling

Add logging implementation for iOS/Android

Add logging implementation for iOS/Android

support Resiliency for outages

Add support for resiliency/client heuristics for outages

Add support to read error and error_description from URL when user cancels web ui

Add support to read error and error_description from URL when user cancels web ui for cases when the user gets an error on authorize like your app does not have access to the resource or transient error happened. These pages are generally non-recoverable and user ends up calling "cancel". This results in user_cancelled error in the API even though it was actually some other error. Putting the error and description will allow us to provide error details to developers and will improve our and developer's ability to build telemetry.

update TokenCacheTests.LoadCacheItems to create cache

update TokenCacheTests.LoadCacheItems to create cache

Add log.error for every caught exception in MSAL

Add log.error for every caught exception in MSAL. Make sure all the catch statements in the code are covered.