Add WithFmiPath to MSAL (#5114)

trwalke · trwalke · gladjohn · web-flow · commit 4ab0e3b74589 · 2025-02-07T10:55:12.000-08:00
* Adding cache logic for additional components

* Adding logging.
Adding tests.

* Resolving test

* Clean Up

* Resolving cache key issues.
Adding test cases.

* Updating public api

* Remove unused using directive

* Adding credential type test

* Updating public api files

* Apply suggestions from code review

Co-authored-by: Gladwin Johnson &lt;90415114+gladjohn@users.noreply.github.com&gt;

* Update tests/Microsoft.Identity.Test.Unit/PublicApiTests/CacheKeyExtensionTests.cs

Co-authored-by: Gladwin Johnson &lt;90415114+gladjohn@users.noreply.github.com&gt;

* Addressing feedback.
clean up.
refactoring

* Adding pop test
Refactoring
Clean up

* Adding additional test

* Adding WithFmiPath api

* Update src/client/Microsoft.Identity.Client/ApiConfig/AcquireTokenForClientParameterBuilder.cs

Co-authored-by: Bogdan Gavril &lt;bogavril@microsoft.com&gt;

* Adding WithFmiPath api and test

* Adding test case

* Adding comment

* Refactoring

* Apply suggestions from code review

Co-authored-by: Gladwin Johnson &lt;90415114+gladjohn@users.noreply.github.com&gt;

---------

Co-authored-by: trwalke &lt;trwalke@microsoft.com&gt;
Co-authored-by: Gladwin Johnson &lt;90415114+gladjohn@users.noreply.github.com&gt;
Co-authored-by: Bogdan Gavril &lt;bogavril@microsoft.com&gt;
diff --git a/src/client/Microsoft.Identity.Client/ApiConfig/AcquireTokenForClientParameterBuilder.cs b/src/client/Microsoft.Identity.Client/ApiConfig/AcquireTokenForClientParameterBuilder.cs
@@ -14,6 +14,8 @@
 using Microsoft.Identity.Client.Internal.ClientCredential;
 using Microsoft.Identity.Client.TelemetryCore.Internal.Events;
 using Microsoft.Identity.Client.Utils;
+using Microsoft.Identity.Client.Extensibility;
+using Microsoft.Identity.Client.OAuth2;
 
 namespace Microsoft.Identity.Client
 {
@@ -122,6 +124,30 @@ public AcquireTokenForClientParameterBuilder WithPreferredAzureRegion(bool useAz
             throw new NotImplementedException();
         }
 
+        /// <summary> 
+        /// Adds an fmi_path parameter to the request. It modifies the subject of the token. 
+        /// </summary>
+        public AcquireTokenForClientParameterBuilder WithFmiPath(string pathSuffix)
+        {
+            ValidateUseOfExperimentalFeature();
+
+           if (string.IsNullOrWhiteSpace(pathSuffix))
+            {
+                throw new ArgumentNullException(nameof(pathSuffix));
+            }
+
+            var cacheKey = new SortedList<string, string>
+            { 
+                { OAuth2Parameter.FmiPath, pathSuffix } 
+            };
+
+            this.WithAdditionalCacheKeyComponents(cacheKey);
+
+            CommonParameters.FmiPathSuffix = pathSuffix;
+
+            return this;
+        }
+
         /// <inheritdoc/>
         internal override Task<AuthenticationResult> ExecuteInternalAsync(CancellationToken cancellationToken)
         {
diff --git a/src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenCommonParameters.cs b/src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenCommonParameters.cs
@@ -31,5 +31,6 @@ internal class AcquireTokenCommonParameters
         public X509Certificate2 MtlsCertificate { get; internal set; }
         public List<string> AdditionalCacheParameters { get; set; }
         public SortedList<string, string> CacheKeyComponents { get; internal set; }
+        public string FmiPathSuffix { get; internal set; }
     }
 }
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/AuthenticationRequestParameters.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/AuthenticationRequestParameters.cs
@@ -175,6 +175,8 @@ public string LoginHint
         public string LongRunningOboCacheKey { get; set; }
 
         public KeyValuePair<string, string>? CcsRoutingHint { get; set; }
+
+        public string FmiPathSuffix => _commonParameters.FmiPathSuffix;
         #endregion
 
         public void LogParameters()
diff --git a/src/client/Microsoft.Identity.Client/OAuth2/OAuthConstants.cs b/src/client/Microsoft.Identity.Client/OAuth2/OAuthConstants.cs
@@ -43,6 +43,7 @@ internal static class OAuth2Parameter
         public const string TokenType = "token_type"; // not a standard OAuth2 param
         public const string RequestConfirmation = "req_cnf"; // not a standard OAuth2 param
         public const string SpaCode = "return_spa_code"; // not a standard OAuth2 param
+        public const string FmiPath = "fmi_path"; // not a standard OAuth2 param
     }
 
     internal static class OAuth2GrantType
diff --git a/src/client/Microsoft.Identity.Client/OAuth2/TokenClient.cs b/src/client/Microsoft.Identity.Client/OAuth2/TokenClient.cs
@@ -56,6 +56,7 @@ public async Task<MsalTokenResponse> SendTokenRequestAsync(
                 {
                     tokenEndpoint = await _requestParams.Authority.GetTokenEndpointAsync(_requestParams.RequestContext).ConfigureAwait(false);
                 }
+
                 Debug.Assert(_requestParams.RequestContext.ApiEvent != null, "The Token Client must only be called by requests.");
                 _requestParams.RequestContext.ApiEvent.TokenEndpoint = tokenEndpoint;
 
@@ -163,6 +164,11 @@ await _serviceBundle.Config.ClientCredential.AddConfidentialClientParametersAsyn
                 _oAuth2Client.AddBodyParameter(kvp.Key, kvp.Value);
             }
 
+            if (!string.IsNullOrEmpty(_requestParams.FmiPathSuffix))
+            {
+                _oAuth2Client.AddBodyParameter(OAuth2Parameter.FmiPath, _requestParams.FmiPathSuffix);
+            }
+
             _oAuth2Client.AddHeader(
                 TelemetryConstants.XClientCurrentTelemetry,
                 _serviceBundle.HttpTelemetryManager.GetCurrentRequestHeader(
diff --git a/src/client/Microsoft.Identity.Client/PublicApi/net462/PublicAPI.Unshipped.txt b/src/client/Microsoft.Identity.Client/PublicApi/net462/PublicAPI.Unshipped.txt
@@ -0,0 +1 @@
+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder
diff --git a/src/client/Microsoft.Identity.Client/PublicApi/net472/PublicAPI.Unshipped.txt b/src/client/Microsoft.Identity.Client/PublicApi/net472/PublicAPI.Unshipped.txt
@@ -0,0 +1 @@
+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder
diff --git a/src/client/Microsoft.Identity.Client/PublicApi/net8.0-android/PublicAPI.Unshipped.txt b/src/client/Microsoft.Identity.Client/PublicApi/net8.0-android/PublicAPI.Unshipped.txt
@@ -0,0 +1 @@
+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder
diff --git a/src/client/Microsoft.Identity.Client/PublicApi/net8.0-ios/PublicAPI.Unshipped.txt b/src/client/Microsoft.Identity.Client/PublicApi/net8.0-ios/PublicAPI.Unshipped.txt
@@ -0,0 +1 @@
+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder
diff --git a/src/client/Microsoft.Identity.Client/PublicApi/net8.0/PublicAPI.Unshipped.txt b/src/client/Microsoft.Identity.Client/PublicApi/net8.0/PublicAPI.Unshipped.txt
@@ -0,0 +1 @@
+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder
diff --git a/src/client/Microsoft.Identity.Client/PublicApi/netstandard2.0/PublicAPI.Unshipped.txt b/src/client/Microsoft.Identity.Client/PublicApi/netstandard2.0/PublicAPI.Unshipped.txt
@@ -0,0 +1 @@
+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder
diff --git a/tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHttpManagerExtensions.cs b/tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHttpManagerExtensions.cs
@@ -183,13 +183,16 @@ public static MockHttpMessageHandler AddMockHandlerSuccessfulClientCredentialTok
             string token = "header.payload.signature", 
             string expiresIn = "3599",
             string tokenType = "Bearer",
-            IList<string> unexpectedHttpHeaders = null)
+            IList<string> unexpectedHttpHeaders = null,
+            Dictionary<string, string> expectedPostData = null
+            )
         {
             var handler = new MockHttpMessageHandler()
             {
                 ExpectedMethod = HttpMethod.Post,
                 ResponseMessage = MockHelpers.CreateSuccessfulClientCredentialTokenResponseMessage(token, expiresIn, tokenType),
-                UnexpectedRequestHeaders = unexpectedHttpHeaders
+                UnexpectedRequestHeaders = unexpectedHttpHeaders,
+                ExpectedPostData = expectedPostData
             };
 
             httpManager.AddMockHandler(handler);
diff --git a/tests/Microsoft.Identity.Test.Unit/PublicApiTests/FmiTests.cs b/tests/Microsoft.Identity.Test.Unit/PublicApiTests/FmiTests.cs
@@ -0,0 +1,62 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Identity.Client;
+using Microsoft.Identity.Test.Common.Core.Mocks;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Microsoft.Identity.Test.Common.Core.Helpers;
+using Microsoft.Identity.Client.OAuth2;
+
+namespace Microsoft.Identity.Test.Unit.PublicApiTests
+{
+    [TestClass]
+    public class FmiTests : TestBase
+    {
+        [TestMethod]
+        public async Task FmiEnsureWithFmiPathFunctions()
+        {
+            using (var httpManager = new MockHttpManager())
+            {
+                var fmiClientId = "urn:microsoft:identity:fmi";
+                var app = ConfidentialClientApplicationBuilder.Create(fmiClientId)
+                                              .WithAuthority(new Uri(ClientApplicationBase.DefaultAuthority), true)
+                                              .WithRedirectUri(TestConstants.RedirectUri)
+                                              .WithClientSecret(TestConstants.ClientSecret)
+                                              .WithHttpManager(httpManager)
+                                              .WithExperimentalFeatures()
+                                              .BuildConcrete();
+
+                var appCacheAccess = app.AppTokenCache.RecordAccess();
+
+                httpManager.AddInstanceDiscoveryMockHandler();
+                httpManager.AddMockHandlerSuccessfulClientCredentialTokenResponseMessage( expectedPostData: new Dictionary<string, string>() { { OAuth2Parameter.FmiPath, "fmiPath" } });
+
+                //Ensure that the FMI path is set correctly and token is retrieved
+                var result = await app.AcquireTokenForClient(TestConstants.s_scope.ToArray())
+                                        .WithFmiPath("fmiPath")
+                                        .ExecuteAsync(CancellationToken.None)
+                                        .ConfigureAwait(false);
+
+                Assert.IsNotNull(result);
+                Assert.AreEqual(TokenSource.IdentityProvider, result.AuthenticationResultMetadata.TokenSource);
+                Assert.AreEqual("header.payload.signature", result.AccessToken);
+                Assert.AreEqual(fmiClientId, app.AppTokenCacheInternal.Accessor.GetAllAccessTokens().First().ClientId);
+
+                result = await app.AcquireTokenForClient(TestConstants.s_scope.ToArray())
+                                        .WithFmiPath("fmiPath")
+                                        .ExecuteAsync(CancellationToken.None)
+                                        .ConfigureAwait(false);
+
+                Assert.IsNotNull(result);
+                Assert.AreEqual(TokenSource.Cache, result.AuthenticationResultMetadata.TokenSource);
+                Assert.AreEqual("header.payload.signature", result.AccessToken);
+                Assert.AreEqual(fmiClientId, app.AppTokenCacheInternal.Accessor.GetAllAccessTokens().First().ClientId);
+            }
+        }
+    }
+}

Original file line number	Diff line number	Diff line change
`@@ -31,5 +31,6 @@ internal class AcquireTokenCommonParameters`
`31`	`31`	`public X509Certificate2 MtlsCertificate { get; internal set; }`
`32`	`32`	`public List<string> AdditionalCacheParameters { get; set; }`
`33`	`33`	`public SortedList<string, string> CacheKeyComponents { get; internal set; }`
	`34`	`+ public string FmiPathSuffix { get; internal set; }`
`34`	`35`	`}`
`35`	`36`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,7 @@ internal static class OAuth2Parameter`
`43`	`43`	`public const string TokenType = "token_type"; // not a standard OAuth2 param`
`44`	`44`	`public const string RequestConfirmation = "req_cnf"; // not a standard OAuth2 param`
`45`	`45`	`public const string SpaCode = "return_spa_code"; // not a standard OAuth2 param`
	`46`	`+ public const string FmiPath = "fmi_path"; // not a standard OAuth2 param`
`46`	`47`	`}`
`47`	`48`
`48`	`49`	`internal static class OAuth2GrantType`
Original file line number	Diff line number	Diff line change
`@@ -56,6 +56,7 @@ public async Task<MsalTokenResponse> SendTokenRequestAsync(`
`56`	`56`	`{`
`57`	`57`	`tokenEndpoint = await _requestParams.Authority.GetTokenEndpointAsync(_requestParams.RequestContext).ConfigureAwait(false);`
`58`	`58`	`}`
	`59`	`+`
`59`	`60`	`Debug.Assert(_requestParams.RequestContext.ApiEvent != null, "The Token Client must only be called by requests.");`
`60`	`61`	`_requestParams.RequestContext.ApiEvent.TokenEndpoint = tokenEndpoint;`
`61`	`62`
`@@ -163,6 +164,11 @@ await _serviceBundle.Config.ClientCredential.AddConfidentialClientParametersAsyn`
`163`	`164`	`_oAuth2Client.AddBodyParameter(kvp.Key, kvp.Value);`
`164`	`165`	`}`
`165`	`166`
	`167`	`+ if (!string.IsNullOrEmpty(_requestParams.FmiPathSuffix))`
	`168`	`+ {`
	`169`	`+ _oAuth2Client.AddBodyParameter(OAuth2Parameter.FmiPath, _requestParams.FmiPathSuffix);`
	`170`	`+ }`
	`171`	`+`
`166`	`172`	`_oAuth2Client.AddHeader(`
`167`	`173`	`TelemetryConstants.XClientCurrentTelemetry,`
`168`	`174`	`_serviceBundle.HttpTelemetryManager.GetCurrentRequestHeader(`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder.WithFmiPath(string pathSuffix) -> Microsoft.Identity.Client.AcquireTokenForClientParameterBuilder`