Source home account identifier (uid/utid) claims from the redeemed token - #3991
Open
Tanuj Sood (soodt) wants to merge 3 commits into
Open
Source home account identifier (uid/utid) claims from the redeemed token#3991Tanuj Sood (soodt) wants to merge 3 commits into
Tanuj Sood (soodt) wants to merge 3 commits into
Conversation
The web app sign-in flow stamped the uid/utid home account identifier
claims (the MSAL home account id, used as the per-user token-cache key)
from the front-channel client_info parameter on the authorize response,
which is a separate value from the token the app actually redeems.
Derive these claims from the authoritative back-channel token result so
they are always consistent with the token that was acquired.
- Surface the home account id (HomeAccountId ObjectId/TenantId) out of
the internal authorization-code redemption via a small internal
AuthCodeRedemptionResult. AcquireTokenResult and all public API are
unchanged.
- ASP.NET Core: stash the redeemed uid/utid on HttpContext.Items during
AddAccountToCacheFromAuthorizationCodeAsync and read them in
OnTokenValidated instead of client_info.
- OWIN: stash the redeemed uid/utid in the OWIN context / session and
read them in SecurityTokenValidated, using namespaced storage keys.
- Preserve B2C ({oid}-{userFlow}.{utid}) handling, the reserved-claim
conflict guard (issue 2968), and the no-account -> stamp-nothing
behavior.
- Add unit tests for both adapters.
Member
|
Tanuj Sood (@soodt) - what bug are you trying to solve? This s a pretty tricky area of the code. What testing has there been done. You need to manually test:
|
| } | ||
| httpContext.Session.Remove(ClaimConstants.ClientInfo); | ||
| } | ||
| (string? homeObjectId, string? homeTenantId) = GetAndRemoveHomeAccountIdentifier(context.OwinContext, httpContext); |
There was a problem hiding this comment.
Why do you need to do: Get & Remove and then Add ? Why not just GetOrAdd ?
| @@ -161,11 +161,21 @@ public TokenAcquisition( | |||
| #endif | |||
| public async Task<AcquireTokenResult> AddAccountToCacheFromAuthorizationCodeAsync( | |||
There was a problem hiding this comment.
Why do we need this overload?
Bogdan Gavril (bgavrilMS)
requested changes
Jul 31, 2026
Bogdan Gavril (bgavrilMS)
left a comment
Bogdan Gavril (bgavrilMS)
left a comment
Member
There was a problem hiding this comment.
It's not clear what problem is solved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Source home account identifier (uid/utid) claims from the redeemed token
Description
The web app sign-in adapters (ASP.NET Core and OWIN) now set the uid/utid claims — the
MSAL home account identifier and token-cache key — from the redeemed token's
Account.HomeAccountId instead of the client_info parameter on the sign-in response, so the
claims stay consistent with the account that was redeemed and cached.
sign-in events).
stamped when the redeemed token has no home account id.