Enable IAuthenticationOperation2 to reject MSAL cached tokens and fetch new ones from ESTS (#5567)

* Initial prototype

* Initial prototype

* Refactoring

* Reverting csproj changes

* Apply suggestions from code review

Co-authored-by: Gladwin Johnson <90415114+gladjohn@users.noreply.github.com>

---------

Co-authored-by: trwalke <trwalke@microsoft.com>
Co-authored-by: Bogdan Gavril <bogavril@microsoft.com>
Co-authored-by: Gladwin Johnson <90415114+gladjohn@users.noreply.github.com>

Author: 4 people

src/client/Microsoft.Identity.Client/AuthScheme/Bearer/BearerAuthenticationOperation.cs

@@ -38,5 +38,11 @@ public IReadOnlyDictionary<string, string> GetTokenRequestParams()
             // ESTS issues Bearer tokens by default, no need for any extra params
             return CollectionHelpers.GetEmptyDictionary<string, string>();
         }
+
+        public Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData)
+        {
+            // no-op
+            return Task.FromResult(true);
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/IAuthenticationOperation2.cs

@@ -17,5 +17,12 @@ public interface IAuthenticationOperation2 : IAuthenticationOperation
         /// Will be invoked instead of IAuthenticationOperation.FormatResult
         /// </summary>
         Task FormatResultAsync(AuthenticationResult authenticationResult, CancellationToken cancellationToken = default);
+
+        /// <summary>
+        /// Determines whether the cached token is still valid.
+        /// </summary>
+        /// <param name="cachedTokenData">Data used to determine if token is still valid</param>
+        /// <returns></returns>
+        Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData);
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/MsalCacheValidationData.cs

@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System.Collections.Generic;
+
+namespace Microsoft.Identity.Client.AuthScheme
+{
+    /// <summary>
+    /// Data used to validate cache items for different authentication schemes.
+    /// </summary>
+    public class MsalCacheValidationData
+    {
+        /// <summary>
+        /// Gets the persisted parameters addded to the cache items.
+        /// </summary>
+        public IDictionary<string, string> PersistedCacheParameters { get; internal set; }
+    }
+}

src/client/Microsoft.Identity.Client/AuthScheme/PoP/MtlsPopAuthenticationOperation.cs

@@ -48,5 +48,11 @@ public void FormatResult(AuthenticationResult authenticationResult)
         {
             authenticationResult.BindingCertificate = _mtlsCert;
         }
+
+        public Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData)
+        {
+            // no-op
+            return Task.FromResult(true);
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/PoP/PopAuthenticationOperation.cs

@@ -172,5 +172,11 @@ private string CreateJWS(string payload, string header)
 
             return sb.ToString();
         }
+
+        public Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData)
+        {
+            // no-op
+            return Task.FromResult(true);
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/PoP/PopBrokerAuthenticationOperation.cs

@@ -40,5 +40,11 @@ public IReadOnlyDictionary<string, string> GetTokenRequestParams()
         {
             return CollectionHelpers.GetEmptyDictionary<string, string>();
         }
+
+        public Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData)
+        {
+            // no-op
+            return Task.FromResult(true);
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/SSHCertificates/SSHCertAuthenticationOperation.cs

@@ -60,5 +60,11 @@ public IReadOnlyDictionary<string, string> GetTokenRequestParams()
                 { OAuth2Parameter.RequestConfirmation , _jwk }
             };
         }
+
+        public Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData)
+        {
+            // no-op
+            return Task.FromResult(true);
+        }
     }
 }

src/client/Microsoft.Identity.Client/Extensibility/ExternalBoundTokenScheme.cs

@@ -44,5 +44,11 @@ public IReadOnlyDictionary<string, string> GetTokenRequestParams()
         {
             return CollectionHelpers.GetEmptyDictionary<string, string>();
         }
+
+        public Task<bool> ValidateCachedTokenAsync(MsalCacheValidationData cachedTokenData)
+        {
+            // no-op
+            return Task.FromResult(true);
+        }
     }
 }

src/client/Microsoft.Identity.Client/Internal/Requests/ClientCredentialRequest.cs

@@ -10,6 +10,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Identity.Client.ApiConfig.Parameters;
+using Microsoft.Identity.Client.AuthScheme;
 using Microsoft.Identity.Client.Cache.Items;
 using Microsoft.Identity.Client.Core;
 using Microsoft.Identity.Client.Extensibility;
@@ -76,6 +77,21 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
 
             MsalAccessTokenCacheItem cachedAccessTokenItem = await GetCachedAccessTokenAsync().ConfigureAwait(false);
 
+            // Validate the cached token using the authentication operation
+            if (AuthenticationRequestParameters.AuthenticationScheme != null &&
+                cachedAccessTokenItem != null &&
+                AuthenticationRequestParameters.AuthenticationScheme is IAuthenticationOperation2 authOp2)
+            {
+                var cacheValidationData = new MsalCacheValidationData();
+                cacheValidationData.PersistedCacheParameters = cachedAccessTokenItem.PersistedCacheParameters;
+
+                if (!await authOp2.ValidateCachedTokenAsync(cacheValidationData).ConfigureAwait(false))
+                {
+                    logger.Info("[ClientCredentialRequest] Cached token failed authentication operation validation.");
+                    cachedAccessTokenItem = null;
+                }
+            }
+
             // No access token or cached access token needs to be refreshed 
             if (cachedAccessTokenItem != null)
             {

src/client/Microsoft.Identity.Client/Microsoft.Identity.Client.csproj

@@ -92,7 +92,7 @@
     <Compile Include="$(PathToMsalSources)\Platforms\Features\DesktopOS\**\*.cs" />
     <Compile Include="$(PathToMsalSources)\Platforms\Features\DefaultOSBrowser\**\*.cs" />
     <Compile Include="$(PathToMsalSources)\Platforms\Features\OpenTelemetry\**\*.cs" />
-    
+
     <PackageReference Include="System.Diagnostics.DiagnosticSource" />
     <PackageReference Include="System.Formats.Asn1" />
     <PackageReference Include="System.Security.Cryptography.Cng" />
@@ -104,7 +104,7 @@
     <Compile Include="$(PathToMsalSources)\Platforms\Features\DefaultOSBrowser\**\*.cs" />
     <Compile Include="$(PathToMsalSources)\Platforms\Features\DesktopOS\**\*.cs" />
     <Compile Include="$(PathToMsalSources)\Platforms\Features\OpenTelemetry\**\*.cs" />
-    
+
     <!--System.Text.Json replaces internal NewtonSoft for NET -->
     <Compile Remove="$(PathToMsalSources)\json\**\*.*" />
 
@@ -161,4 +161,4 @@
     <AdditionalFiles Include="PublicAPI/$(TargetFramework)/PublicAPI.Unshipped.txt" />
   </ItemGroup>
 
-</Project>
+</Project>