Merge pull request #75 from Azure-Samples/jmprieur/syncMicrosoftIdentityWeb

jmprieur · web-flow · commit a0bd59826b6b · 2019-07-18T09:29:17.000+02:00
Syncing Microsoft.Identity.Web content with ASP.NET Core web app tutorial
diff --git a/Microsoft.Identity.Web/ClaimConstants.cs b/Microsoft.Identity.Web/ClaimConstants.cs
@@ -35,5 +35,7 @@ public static class ClaimConstants
         public const string PreferredUserName = "preferred_username";
         public const string TenantId = "http://schemas.microsoft.com/identity/claims/tenantid";
         public const string Tid = "tid";
+        public const string Scope = "http://schemas.microsoft.com/identity/claims/scope";
+        public const string Roles = "roles";
     }
 }
diff --git a/Microsoft.Identity.Web/ClaimPrincipalExtension.cs b/Microsoft.Identity.Web/ClaimPrincipalExtension.cs
@@ -87,7 +87,7 @@ public static string GetLoginHint(this ClaimsPrincipal claimsPrincipal)
         /// <summary>
         /// Gets the domain-hint associated with an identity
         /// </summary>
-        /// <param name="claimsPrincipal">Identity for which to compte the domain-hint</param>
+        /// <param name="claimsPrincipal">Identity for which to compute the domain-hint</param>
         /// <returns>domain-hint for the identity, or <c>null</c> if it cannot be found</returns>
         public static string GetDomainHint(this ClaimsPrincipal claimsPrincipal)
         {
diff --git a/Microsoft.Identity.Web/Client/ITokenAcquisition.cs b/Microsoft.Identity.Web/Client/ITokenAcquisition.cs
@@ -19,7 +19,7 @@ public interface ITokenAcquisition
         /// From the configuration of the Authentication of the ASP.NET Core Web API: 
         /// <code>OpenIdConnectOptions options;</code>
         /// 
-        /// Subscribe to the authorization code recieved event:
+        /// Subscribe to the authorization code received event:
         /// <code>
         ///  options.Events = new OpenIdConnectEvents();
         ///  options.Events.OnAuthorizationCodeReceived = OnAuthorizationCodeReceived;
diff --git a/Microsoft.Identity.Web/Client/MsalUiRequiredExceptionFilterAttribute.cs b/Microsoft.Identity.Web/Client/MsalUiRequiredExceptionFilterAttribute.cs
@@ -1,19 +1,19 @@
-using System.Collections.Generic;
-using System.Linq;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Identity.Client;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+using System.Collections.Generic;
+using System.Linq;
 
 namespace Microsoft.Identity.Web.Client
 {
     /// <summary>
     /// Filter used on a controller action to trigger an incremental consent.
     /// </summary>
     /// <example>
-    /// The following controller action will trigger 
+    /// The following controller action will trigger
     /// <code>
     /// [MsalUiRequiredExceptionFilter(Scopes = new[] {"Mail.Send"})]
     /// public async Task<IActionResult> SendEmail()
@@ -24,7 +24,7 @@ namespace Microsoft.Identity.Web.Client
     public class MsalUiRequiredExceptionFilterAttribute : ExceptionFilterAttribute
     {
         public string[] Scopes { get; set; }
-        
+
         public override void OnException(ExceptionContext context)
         {
             MsalUiRequiredException msalUiRequiredException = context.Exception as MsalUiRequiredException;
@@ -33,7 +33,7 @@ public override void OnException(ExceptionContext context)
                 msalUiRequiredException = context.Exception?.InnerException as MsalUiRequiredException;
             }
 
-            if (msalUiRequiredException!=null)
+            if (msalUiRequiredException != null)
             {
                 if (CanBeSolvedByReSignInUser(msalUiRequiredException))
                 {
@@ -42,10 +42,10 @@ public override void OnException(ExceptionContext context)
                     context.Result = new ChallengeResult(properties);
                 }
             }
-            
+
             base.OnException(context);
         }
-        
+
         private bool CanBeSolvedByReSignInUser(MsalUiRequiredException ex)
         {
             // ex.ErrorCode != MsalUiRequiredException.UserNullError indicates a cache problem.
@@ -61,7 +61,7 @@ private bool CanBeSolvedByReSignInUser(MsalUiRequiredException ex)
         /// Build Authentication properties needed for an incremental consent.
         /// </summary>
         /// <param name="scopes">Scopes to request</param>
-        /// <param name="ex">ui is present</param>
+        /// <param name="ex">MsalUiRequiredException instance</param>
         /// <param name="context">current http context in the pipeline</param>
         /// <returns>AuthenticationProperties</returns>
         private AuthenticationProperties BuildAuthenticationPropertiesForIncrementalConsent(
@@ -94,4 +94,4 @@ private AuthenticationProperties BuildAuthenticationPropertiesForIncrementalCons
             return properties;
         }
     }
-}
+}
diff --git a/Microsoft.Identity.Web/Client/TokenAcquisition.cs b/Microsoft.Identity.Web/Client/TokenAcquisition.cs
@@ -98,7 +98,7 @@ public TokenAcquisition(IConfiguration configuration, IMSALAppTokenCacheProvider
         /// From the configuration of the Authentication of the ASP.NET Core Web API:
         /// <code>OpenIdConnectOptions options;</code>
         ///
-        /// Subscribe to the authorization code recieved event:
+        /// Subscribe to the authorization code received event:
         /// <code>
         ///  options.Events = new OpenIdConnectEvents();
         ///  options.Events.OnAuthorizationCodeReceived = OnAuthorizationCodeReceived;
@@ -125,9 +125,17 @@ public async Task AddAccountToCacheFromAuthorizationCode(AuthorizationCodeReceiv
             try
             {
                 // As AcquireTokenByAuthorizationCodeAsync is asynchronous we want to tell ASP.NET core that we are handing the code
-                // even if it's not done yet, so that it does not concurrently call the Token endpoint.
+                // even if it's not done yet, so that it does not concurrently call the Token endpoint. (otherwise there will be a
+                // race condition ending-up in an error from Azure AD telling "code already redeemed")
                 context.HandleCodeRedemption();
 
+                // The cache will need the claims from the ID token. In the case of guest scenarios
+                // If they are not yet in the HttpContext.User's claims, adding them.
+                if (!context.HttpContext.User.Claims.Any())
+                {
+                    (context.HttpContext.User.Identity as ClaimsIdentity).AddClaims(context.Principal.Claims);
+                }
+
                 var application = GetOrBuildConfidentialClientApplication(context.HttpContext, context.Principal);
 
                 // Do not share the access token with ASP.NET Core otherwise ASP.NET will cache it and will not send the OAuth 2.0 request in
@@ -272,15 +280,15 @@ public async Task RemoveAccount(RedirectContext context)
                 account = accounts.FirstOrDefault(a => a.Username == user.GetLoginHint());
             }
 
-            if (account!=null)
+            if (account != null)
             {
                 this.UserTokenCacheProvider?.Clear(account.HomeAccountId.Identifier);
 
                 await app.RemoveAsync(account);
             }
         }
 
-        IConfidentialClientApplication application;
+        private IConfidentialClientApplication application;
 
         /// <summary>
         /// Creates an MSAL Confidential client application if needed
@@ -359,14 +367,15 @@ private async Task<string> GetAccessTokenOnBehalfOfUser(IConfidentialClientAppli
             // Get the account
             IAccount account = await application.GetAccountAsync(accountIdentifier);
 
-            // Special case for guest users as the Guest iod / tenant id are not surfaced.
+            // Special case for guest users as the Guest id / tenant id are not surfaced.
             if (account == null)
             {
                 var accounts = await application.GetAccountsAsync();
                 account = accounts.FirstOrDefault(a => a.Username == loginHint);
             }
 
-            AuthenticationResult result;
+            AuthenticationResult result = null;
+
             if (string.IsNullOrWhiteSpace(tenant))
             {
                 result = await application.AcquireTokenSilent(scopes.Except(scopesRequestedByMsalNet), account)
@@ -379,6 +388,7 @@ private async Task<string> GetAccessTokenOnBehalfOfUser(IConfidentialClientAppli
                                           .WithAuthority(authority)
                                           .ExecuteAsync();
             }
+
             return result.AccessToken;
         }
 
@@ -417,9 +427,8 @@ private void AddAccountToCacheFromJwt(IEnumerable<string> scopes, JwtSecurityTok
             }
         }
 
-
         /// <summary>
-        /// Used in Web APIs (which therefore cannot have an interaction with the user). 
+        /// Used in Web APIs (which therefore cannot have an interaction with the user).
         /// Replies to the client through the HttpReponse by sending a 403 (forbidden) and populating wwwAuthenticateHeaders so that
         /// the client can trigger an iteraction with the user so that the user consents to more scopes
         /// </summary>
@@ -466,7 +475,7 @@ private static bool AcceptedTokenVersionIsNotTheSameAsTokenVersion(MsalUiRequire
         {
             // Normally app developers should not make decisions based on the internal AAD code
             // however until the STS sends sub-error codes for this error, this is the only
-            // way to distinguish the case. 
+            // way to distinguish the case.
             // This is subject to change in the future
             return (msalSeviceException.Message.Contains("AADSTS50013"));
         }
diff --git a/Microsoft.Identity.Web/Client/TokenCacheProviders/InMemory/MSALPerUserMemoryTokenCacheProvider.cs b/Microsoft.Identity.Web/Client/TokenCacheProviders/InMemory/MSALPerUserMemoryTokenCacheProvider.cs
@@ -94,18 +94,13 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar
             // if the access operation resulted in a cache update
             if (args.HasStateChanged)
             {
-                string cacheKey = args.Account?.HomeAccountId?.Identifier;
-                if (string.IsNullOrEmpty(cacheKey))
-                {
-                    cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
-                }
+                string cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
 
                 if (string.IsNullOrWhiteSpace(cacheKey))
                     return;
 
                 // Ideally, methods that load and persist should be thread safe.MemoryCache.Get() is thread safe.
                 this.memoryCache.Set(cacheKey, args.TokenCache.SerializeMsalV3(), this.CacheOptions.SlidingExpiration);
-
             }
         }
 
@@ -116,17 +111,13 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar
         /// <param name="args">Contains parameters used by the MSAL call accessing the cache.</param>
         private void UserTokenCacheBeforeAccessNotification(TokenCacheNotificationArgs args)
         {
-            string cacheKey = args.Account?.HomeAccountId?.Identifier;
-            if (string.IsNullOrEmpty(cacheKey))
-            {
-                cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
-            }
+            string cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
 
             if (string.IsNullOrWhiteSpace(cacheKey))
                 return;
 
             byte[] tokenCacheBytes = (byte[])this.memoryCache.Get(cacheKey);
-            args.TokenCache.DeserializeMsalV3(tokenCacheBytes, shouldClearExistingCache:true);
+            args.TokenCache.DeserializeMsalV3(tokenCacheBytes, shouldClearExistingCache: true);
         }
 
         /// <summary>
@@ -137,4 +128,4 @@ private void UserTokenCacheBeforeWriteNotification(TokenCacheNotificationArgs ar
         {
         }
     }
-}
+}
diff --git a/Microsoft.Identity.Web/Client/TokenCacheProviders/Session/MSALPerUserSessionTokenCacheProvider.cs b/Microsoft.Identity.Web/Client/TokenCacheProviders/Session/MSALPerUserSessionTokenCacheProvider.cs
@@ -107,11 +107,7 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar
             // if the access operation resulted in a cache update
             if (args.HasStateChanged)
             {
-                string cacheKey = args.Account?.HomeAccountId?.Identifier;
-                if (string.IsNullOrEmpty(cacheKey))
-                {
-                    cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
-                }
+                string cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
 
                 if (string.IsNullOrWhiteSpace(cacheKey))
                     return;
@@ -140,11 +136,7 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar
         private void UserTokenCacheBeforeAccessNotification(TokenCacheNotificationArgs args)
         {
             this.HttpContext.Session.LoadAsync().Wait();
-            string cacheKey = args.Account?.HomeAccountId?.Identifier;
-            if (string.IsNullOrEmpty(cacheKey))
-            {
-                cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
-            }
+            string cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();
             if (string.IsNullOrWhiteSpace(cacheKey))
                 return;
 
diff --git a/Microsoft.Identity.Web/Client/TokenCacheProviders/Sql/MSALPerUserSqlTokenCacheProvider.cs b/Microsoft.Identity.Web/Client/TokenCacheProviders/Sql/MSALPerUserSqlTokenCacheProvider.cs
@@ -121,11 +121,7 @@ private void UserTokenCacheBeforeAccessNotification(TokenCacheNotificationArgs a
         /// <param name="args">Contains parameters used by the MSAL call accessing the cache.</param>
         private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs args)
         {
-            string accountId = args.Account?.HomeAccountId?.Identifier;
-            if (string.IsNullOrEmpty(accountId))
-            {
-                accountId = httpContextAccesssor.HttpContext.User.GetMsalAccountId();
-            }
+            string accountId = httpContextAccesssor.HttpContext.User.GetMsalAccountId();
 
             // if state changed, i.e. new token obtained
             if (args.HasStateChanged && !string.IsNullOrWhiteSpace(accountId))
@@ -160,11 +156,7 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar
         /// </summary>
         private void ReadCacheForSignedInUser(TokenCacheNotificationArgs args)
         {
-            string accountId = args.Account?.HomeAccountId?.Identifier;
-            if (string.IsNullOrEmpty(accountId))
-            {
-                accountId = httpContextAccesssor.HttpContext.User.GetMsalAccountId();
-            }
+            string accountId = httpContextAccesssor.HttpContext.User.GetMsalAccountId();
             if (this.InMemoryCache == null) // first time access
             {
                 this.InMemoryCache = GetLatestUserRecordQuery(accountId).FirstOrDefault();
diff --git a/Microsoft.Identity.Web/Microsoft.Identity.Web.csproj b/Microsoft.Identity.Web/Microsoft.Identity.Web.csproj
@@ -7,6 +7,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.App" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.AzureAD.UI" Version="2.2.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.AzureADB2C.UI" Version="2.2.0" />
     <PackageReference Include="Microsoft.Identity.Client" Version="4.1.0" />
   </ItemGroup>
 </Project>
diff --git a/Microsoft.Identity.Web/README.md b/Microsoft.Identity.Web/README.md
@@ -5,7 +5,7 @@ This library contains a set of reusable classes useful in Web Applications and W
 The library contains helper classes to:
 
 - **Bootstrap the web resource from the Startup.cs file** in your web application by just calling a few methods
-  - `AddAzureAdV2Authentication` to add authentication with the Microsoft Identity platform (AAD v2.0), including managing the authority validation, and the sign-out.
+  - `AddAzureAdV2Authentication` to add authentication with the Microsoft Identity platform (AAD v2.0), including managing the authority validation.
   
     ```CSharp
     services.AddAzureAdV2Authentication();
diff --git a/Microsoft.Identity.Web/Resource/AadIssuerValidator.cs b/Microsoft.Identity.Web/Resource/AadIssuerValidator.cs
@@ -22,15 +22,15 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ***********************************************************************************************/
 
+using Microsoft.Identity.Web.InstanceDiscovery;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Protocols;
+using Microsoft.IdentityModel.Tokens;
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IdentityModel.Tokens.Jwt;
 using System.Linq;
-using Microsoft.Identity.Web.InstanceDiscovery;
-using Microsoft.IdentityModel.JsonWebTokens;
-using Microsoft.IdentityModel.Protocols;
-using Microsoft.IdentityModel.Tokens;
 
 namespace Microsoft.Identity.Web.Resource
 {
@@ -44,6 +44,7 @@ public class AadIssuerValidator
 
         // TODO: separate AadIssuerValidator creation logic from the validation logic in order to unit test it
         private static readonly IDictionary<string, AadIssuerValidator> s_issuerValidators = new ConcurrentDictionary<string, AadIssuerValidator>();
+
         private static readonly ConfigurationManager<IssuerMetadata> s_configManager = new ConfigurationManager<IssuerMetadata>(AzureADIssuerMetadataUrl, new IssuerConfigurationRetriever());
 
         /// <summary>
@@ -88,10 +89,9 @@ public static AadIssuerValidator GetIssuerValidator(string aadAuthority)
                 // Add issuer aliases of the chosen authority
                 string authority = authorityHost ?? new Uri(FallbackAuthority).Host;
                 var aliases = issuerMetadata.Metadata
-                    .Where(m => m.Aliases.Any(a => string.Equals(a , authority, StringComparison.OrdinalIgnoreCase)))
+                    .Where(m => m.Aliases.Any(a => string.Equals(a, authority, StringComparison.OrdinalIgnoreCase)))
                     .SelectMany(m => m.Aliases)
                     .Distinct();
-
                 s_issuerValidators[authority] = new AadIssuerValidator(aliases);
                 return s_issuerValidators[authority];
             }
@@ -152,12 +152,12 @@ private bool IsValidIssuer(string validIssuerTemplate, string tenantId, string a
 
                 // Template authority is in the aliases
                 return _issuerAliases.Contains(issuerFromTemplateUri.Authority) &&
-                    // "iss" authority is in the aliases
-                    _issuerAliases.Contains(actualIssuerUri.Authority) &&
-                    // Template authority ends in the tenantId
-                    IsValidTidInLocalPath(tenantId, issuerFromTemplateUri) &&
-                    // "iss" ends in the tenantId
-                    IsValidTidInLocalPath(tenantId, actualIssuerUri);
+                       // "iss" authority is in the aliases
+                       _issuerAliases.Contains(actualIssuerUri.Authority) &&
+                      // Template authority ends in the tenantId
+                      IsValidTidInLocalPath(tenantId, issuerFromTemplateUri) &&
+                      // "iss" ends in the tenantId
+                      IsValidTidInLocalPath(tenantId, actualIssuerUri);
             }
             catch
             {
@@ -186,7 +186,7 @@ private static string GetTenantIdFromToken(SecurityToken securityToken)
             }
 
             // brentsch - todo, TryGetPayloadValue is available in 5.5.0
-            if (securityToken is JsonWebToken  jsonWebToken)
+            if (securityToken is JsonWebToken jsonWebToken)
             {
                 var tid = jsonWebToken.GetPayloadValue<string>(ClaimConstants.Tid);
                 if (tid != null)
diff --git a/Microsoft.Identity.Web/Resource/ScopesRequiredByWebAPIExtension.cs b/Microsoft.Identity.Web/Resource/ScopesRequiredByWebAPIExtension.cs
diff --git a/Microsoft.Identity.Web/StartupHelpers.cs b/Microsoft.Identity.Web/StartupHelpers.cs
diff --git a/Microsoft.Identity.Web/WebApiStartupHelpers.cs b/Microsoft.Identity.Web/WebApiStartupHelpers.cs

Original file line number	Diff line number	Diff line change
`@@ -35,5 +35,7 @@ public static class ClaimConstants`
`35`	`35`	`public const string PreferredUserName = "preferred_username";`
`36`	`36`	`public const string TenantId = "http://schemas.microsoft.com/identity/claims/tenantid";`
`37`	`37`	`public const string Tid = "tid";`
	`38`	`+ public const string Scope = "http://schemas.microsoft.com/identity/claims/scope";`
	`39`	`+ public const string Roles = "roles";`
`38`	`40`	`}`
`39`	`41`	`}`
Original file line number	Diff line number	Diff line change
`@@ -87,7 +87,7 @@ public static string GetLoginHint(this ClaimsPrincipal claimsPrincipal)`
`87`	`87`	`/// <summary>`
`88`	`88`	`/// Gets the domain-hint associated with an identity`
`89`	`89`	`/// </summary>`
`90`		`- /// <param name="claimsPrincipal">Identity for which to compte the domain-hint</param>`
	`90`	`+ /// <param name="claimsPrincipal">Identity for which to compute the domain-hint</param>`
`91`	`91`	`/// <returns>domain-hint for the identity, or <c>null</c> if it cannot be found</returns>`
`92`	`92`	`public static string GetDomainHint(this ClaimsPrincipal claimsPrincipal)`
`93`	`93`	`{`
Original file line number	Diff line number	Diff line change
`@@ -1,19 +1,19 @@`
`1`		`-using System.Collections.Generic;`
`2`		`-using System.Linq;`
`3`	`1`	`using Microsoft.AspNetCore.Authentication;`
`4`	`2`	`using Microsoft.AspNetCore.Http;`
`5`	`3`	`using Microsoft.AspNetCore.Mvc;`
`6`	`4`	`using Microsoft.AspNetCore.Mvc.Filters;`
`7`	`5`	`using Microsoft.Identity.Client;`
`8`	`6`	`using Microsoft.IdentityModel.Protocols.OpenIdConnect;`
	`7`	`+using System.Collections.Generic;`
	`8`	`+using System.Linq;`
`9`	`9`
`10`	`10`	`namespace Microsoft.Identity.Web.Client`
`11`	`11`	`{`
`12`	`12`	`/// <summary>`
`13`	`13`	`/// Filter used on a controller action to trigger an incremental consent.`
`14`	`14`	`/// </summary>`
`15`	`15`	`/// <example>`
`16`		`- /// The following controller action will trigger`
	`16`	`+ /// The following controller action will trigger`
`17`	`17`	`/// <code>`
`18`	`18`	`/// [MsalUiRequiredExceptionFilter(Scopes = new[] {"Mail.Send"})]`
`19`	`19`	`/// public async Task<IActionResult> SendEmail()`
`@@ -24,7 +24,7 @@ namespace Microsoft.Identity.Web.Client`
`24`	`24`	`public class MsalUiRequiredExceptionFilterAttribute : ExceptionFilterAttribute`
`25`	`25`	`{`
`26`	`26`	`public string[] Scopes { get; set; }`
`27`		`-`
	`27`	`+`
`28`	`28`	`public override void OnException(ExceptionContext context)`
`29`	`29`	`{`
`30`	`30`	`MsalUiRequiredException msalUiRequiredException = context.Exception as MsalUiRequiredException;`
`@@ -33,7 +33,7 @@ public override void OnException(ExceptionContext context)`
`33`	`33`	`msalUiRequiredException = context.Exception?.InnerException as MsalUiRequiredException;`
`34`	`34`	`}`
`35`	`35`
`36`		`- if (msalUiRequiredException!=null)`
	`36`	`+ if (msalUiRequiredException != null)`
`37`	`37`	`{`
`38`	`38`	`if (CanBeSolvedByReSignInUser(msalUiRequiredException))`
`39`	`39`	`{`
`@@ -42,10 +42,10 @@ public override void OnException(ExceptionContext context)`
`42`	`42`	`context.Result = new ChallengeResult(properties);`
`43`	`43`	`}`
`44`	`44`	`}`
`45`		`-`
	`45`	`+`
`46`	`46`	`base.OnException(context);`
`47`	`47`	`}`
`48`		`-`
	`48`	`+`
`49`	`49`	`private bool CanBeSolvedByReSignInUser(MsalUiRequiredException ex)`
`50`	`50`	`{`
`51`	`51`	`// ex.ErrorCode != MsalUiRequiredException.UserNullError indicates a cache problem.`
`@@ -61,7 +61,7 @@ private bool CanBeSolvedByReSignInUser(MsalUiRequiredException ex)`
`61`	`61`	`/// Build Authentication properties needed for an incremental consent.`
`62`	`62`	`/// </summary>`
`63`	`63`	`/// <param name="scopes">Scopes to request</param>`
`64`		`- /// <param name="ex">ui is present</param>`
	`64`	`+ /// <param name="ex">MsalUiRequiredException instance</param>`
`65`	`65`	`/// <param name="context">current http context in the pipeline</param>`
`66`	`66`	`/// <returns>AuthenticationProperties</returns>`
`67`	`67`	`private AuthenticationProperties BuildAuthenticationPropertiesForIncrementalConsent(`
`@@ -94,4 +94,4 @@ private AuthenticationProperties BuildAuthenticationPropertiesForIncrementalCons`
`94`	`94`	`return properties;`
`95`	`95`	`}`
`96`	`96`	`}`
`97`		`-}`
	`97`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -94,18 +94,13 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar`
`94`	`94`	`// if the access operation resulted in a cache update`
`95`	`95`	`if (args.HasStateChanged)`
`96`	`96`	`{`
`97`		`- string cacheKey = args.Account?.HomeAccountId?.Identifier;`
`98`		`- if (string.IsNullOrEmpty(cacheKey))`
`99`		`- {`
`100`		`- cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();`
`101`		`- }`
	`97`	`+ string cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();`
`102`	`98`
`103`	`99`	`if (string.IsNullOrWhiteSpace(cacheKey))`
`104`	`100`	`return;`
`105`	`101`
`106`	`102`	`// Ideally, methods that load and persist should be thread safe.MemoryCache.Get() is thread safe.`
`107`	`103`	`this.memoryCache.Set(cacheKey, args.TokenCache.SerializeMsalV3(), this.CacheOptions.SlidingExpiration);`
`108`		`-`
`109`	`104`	`}`
`110`	`105`	`}`
`111`	`106`
`@@ -116,17 +111,13 @@ private void UserTokenCacheAfterAccessNotification(TokenCacheNotificationArgs ar`
`116`	`111`	`/// <param name="args">Contains parameters used by the MSAL call accessing the cache.</param>`
`117`	`112`	`private void UserTokenCacheBeforeAccessNotification(TokenCacheNotificationArgs args)`
`118`	`113`	`{`
`119`		`- string cacheKey = args.Account?.HomeAccountId?.Identifier;`
`120`		`- if (string.IsNullOrEmpty(cacheKey))`
`121`		`- {`
`122`		`- cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();`
`123`		`- }`
	`114`	`+ string cacheKey = httpContextAccessor.HttpContext.User.GetMsalAccountId();`
`124`	`115`
`125`	`116`	`if (string.IsNullOrWhiteSpace(cacheKey))`
`126`	`117`	`return;`
`127`	`118`
`128`	`119`	`byte[] tokenCacheBytes = (byte[])this.memoryCache.Get(cacheKey);`
`129`		`- args.TokenCache.DeserializeMsalV3(tokenCacheBytes, shouldClearExistingCache:true);`
	`120`	`+ args.TokenCache.DeserializeMsalV3(tokenCacheBytes, shouldClearExistingCache: true);`
`130`	`121`	`}`
`131`	`122`
`132`	`123`	`/// <summary>`
`@@ -137,4 +128,4 @@ private void UserTokenCacheBeforeWriteNotification(TokenCacheNotificationArgs ar`
`137`	`128`	`{`
`138`	`129`	`}`
`139`	`130`	`}`
`140`		`-}`
	`131`	`+}`