From 149e5fc4f7c13d082c715cec0fa84f3a4691ce9e Mon Sep 17 00:00:00 2001
From: Ray Luo <rayluo@microsoft.com>
Date: Fri, 5 Nov 2021 00:11:55 -0700
Subject: [PATCH] Emit warning when common or organizations is used in
 acquire_token_for_client()

---
 msal/application.py       |  5 +++++
 tests/test_application.py | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/msal/application.py b/msal/application.py
index 125b675b..7ca62d7c 100644
--- a/msal/application.py
+++ b/msal/application.py
@@ -1675,6 +1675,11 @@ def acquire_token_for_client(self, scopes, claims_challenge=None, **kwargs):
             - an error response would contain "error" and usually "error_description".
         """
         # TBD: force_refresh behavior
+        if self.authority.tenant.lower() in ["common", "organizations"]:
+            warnings.warn(
+                "Using /common or /organizations authority "
+                "in acquire_token_for_client() is unreliable. "
+                "Please use a specific tenant instead.", DeprecationWarning)
         self._validate_ssh_cert_input_data(kwargs.get("data", {}))
         telemetry_context = self._build_telemetry_context(
             self.ACQUIRE_TOKEN_FOR_CLIENT_ID)
diff --git a/tests/test_application.py b/tests/test_application.py
index 518042a8..804ccb82 100644
--- a/tests/test_application.py
+++ b/tests/test_application.py
@@ -1,5 +1,6 @@
 # Note: Since Aug 2019 we move all e2e tests into test_e2e.py,
 # so this test_application file contains only unit tests without dependency.
+import sys
 from msal.application import *
 from msal.application import _str2bytes
 import msal
@@ -602,3 +603,25 @@ def test_get_accounts(self):
         self.assertIn("local_account_id", account, "Backward compatibility")
         self.assertIn("realm", account, "Backward compatibility")
 
+
+@unittest.skipUnless(
+    sys.version_info[0] >= 3 and sys.version_info[1] >= 2,
+    "assertWarns() is only available in Python 3.2+")
+class TestClientCredentialGrant(unittest.TestCase):
+    def _test_certain_authority_should_emit_warnning(self, authority):
+        app = ConfidentialClientApplication(
+            "client_id", client_credential="secret", authority=authority)
+        def mock_post(url, headers=None, *args, **kwargs):
+            return MinimalResponse(
+                status_code=200, text=json.dumps({"access_token": "an AT"}))
+        with self.assertWarns(DeprecationWarning):
+            app.acquire_token_for_client(["scope"], post=mock_post)
+
+    def test_common_authority_should_emit_warnning(self):
+        self._test_certain_authority_should_emit_warnning(
+            authority="https://login.microsoftonline.com/common")
+
+    def test_organizations_authority_should_emit_warnning(self):
+        self._test_certain_authority_should_emit_warnning(
+            authority="https://login.microsoftonline.com/organizations")
+