Skip to content

Commit 5f4ca84

Browse files
Avery-DunnSomkaPeRomanNosachevSantiago Gonzalezsangonzal
authored
1.9.0 release (#347)
* Exception Improvements (#254) * Add null checks for MsalException error code references * Better exception handling for invalid tokens * Better exception handling for invalid tokens * Sync with changes to Azure-Samples/ms-identity-java-desktop (#259) * extra scopes for consent during authorizaion * typo * minor * HTTPClient default timeouts (#264) * Add default timeouts for DefaultHttpClient * Handle 'stay signed in' confirmation page in DeviceCodeIT tests * Small best-practices changes * append extra scopes as suffix * 1.6.2 release (#268) * fixing integ test * Tenant Profiles (#263) * Classes for tenant profile functionality * Implement tenant profile feature * Tests for tenant profile feature * Simplify tenant profile class structure * 1.6.2 release * Classes for tenant profile redesign * Tests for tenant profile redesign * Adjust sample cached ID tokens to have realistic headers * Redesign how Tenant Pofiles are added to Accounts * New error code for JWT parse exceptions * Add claims and tenant profiles fields to Account * Remove annotation excluding realm field from comparisons * Use more generic token * Remove ID token claims field from Account * Minor changes for clarity * Adjust tests for tenant profile design refactor * Refactor tenant profile structure * Minor fixes * Minor fixes * Minor fixes * Simplify tenant profile class Co-authored-by: SomkaPe <[email protected]> * Improve HTTP client timeouts (#275) * 1.6.2 release (#269) * 1.6.2 release * Make DefaultHttpClient timeouts settable * Refactor timeout names Co-authored-by: SomkaPe <[email protected]> * Bewaters certchain (#276) * Support for certificate chain * 1.7.0 release (#277) * Update DefaultHttpClient.java * Fixed parsing ClientInfo: on some accounts, the server response contained characters that are incorrect for Base64 encoding, but acceptable for Base64URL (#282) * sendX5c api (#285) * refactoring (#287) * refactoring * refactoring * refactoring * Add AcquireTokenSilent tests for B2C and ADFS2019, refactor duplicate code in tests (#293) * Add public constants for cloud endpoints (#298) * Add public constants for cloud endpoints * Add license header * Added javadocs * Removed unneeded test * Make IAccount serializable (#297) * Make IAccount objects serializable * Make AuthenticationResult objects not serializable * Add tenant profile/id claims to auth result (#300) * Add tenant profile/id claims to auth result * Minor fix * treat null password as default one - empty string (#304) * treat null password as default one - empty string * Support for refresh_in (#305) * Support for refresh_in * Tests for refresh_in * Add extra null check * Add test for refreshOn cache persistence * refresh on is optional field (#312) * refresh on optional field * 1.8.0 Release (#313) 1.8.0 release * Fix spelling mistake in Prompt.java * Remove use of Nimbus Oauth2 SDK's CommonContentTypes (#322) * Remove use of Nimbus Oauth2 SDK's CommonContentTypes * Add enum for HTTP content-type constants * Remove use of javax.mail.internet.ContentType * Support for claims request parameter (#315) * ClaimsRequest classes * Support for claims request parameter * Tests for claims request * Use Jackson library for JSON processing * Change access level of userinfo and access_token claims * Better merge tests * Remove ability to set claims in userinfo field * Refactor claims field naming * 1.8.1 release (#326) * Version number updates for 1.8.1 release * Minor rewording * Add missing check when creating tenant profile (#331) * 1.8.1 release (#327) * Exception Improvements (#254) * Add null checks for MsalException error code references * Better exception handling for invalid tokens * Better exception handling for invalid tokens * Sync with changes to Azure-Samples/ms-identity-java-desktop (#259) * extra scopes for consent during authorizaion * typo * minor * HTTPClient default timeouts (#264) * Add default timeouts for DefaultHttpClient * Handle 'stay signed in' confirmation page in DeviceCodeIT tests * Small best-practices changes * append extra scopes as suffix * 1.6.2 release (#268) * fixing integ test * Tenant Profiles (#263) * Classes for tenant profile functionality * Implement tenant profile feature * Tests for tenant profile feature * Simplify tenant profile class structure * 1.6.2 release * Classes for tenant profile redesign * Tests for tenant profile redesign * Adjust sample cached ID tokens to have realistic headers * Redesign how Tenant Pofiles are added to Accounts * New error code for JWT parse exceptions * Add claims and tenant profiles fields to Account * Remove annotation excluding realm field from comparisons * Use more generic token * Remove ID token claims field from Account * Minor changes for clarity * Adjust tests for tenant profile design refactor * Refactor tenant profile structure * Minor fixes * Minor fixes * Minor fixes * Simplify tenant profile class Co-authored-by: SomkaPe <[email protected]> * Improve HTTP client timeouts (#275) * 1.6.2 release (#269) * 1.6.2 release * Make DefaultHttpClient timeouts settable * Refactor timeout names Co-authored-by: SomkaPe <[email protected]> * Bewaters certchain (#276) * Support for certificate chain * 1.7.0 release (#277) * Update DefaultHttpClient.java * Fixed parsing ClientInfo: on some accounts, the server response contained characters that are incorrect for Base64 encoding, but acceptable for Base64URL (#282) * sendX5c api (#285) * refactoring (#287) * refactoring * refactoring * refactoring * Add AcquireTokenSilent tests for B2C and ADFS2019, refactor duplicate code in tests (#293) * Add public constants for cloud endpoints (#298) * Add public constants for cloud endpoints * Add license header * Added javadocs * Removed unneeded test * Make IAccount serializable (#297) * Make IAccount objects serializable * Make AuthenticationResult objects not serializable * Add tenant profile/id claims to auth result (#300) * Add tenant profile/id claims to auth result * Minor fix * treat null password as default one - empty string (#304) * treat null password as default one - empty string * Support for refresh_in (#305) * Support for refresh_in * Tests for refresh_in * Add extra null check * Add test for refreshOn cache persistence * refresh on is optional field (#312) * refresh on optional field * 1.8.0 Release (#313) 1.8.0 release * Fix spelling mistake in Prompt.java * Remove use of Nimbus Oauth2 SDK's CommonContentTypes (#322) * Remove use of Nimbus Oauth2 SDK's CommonContentTypes * Add enum for HTTP content-type constants * Remove use of javax.mail.internet.ContentType * Support for claims request parameter (#315) * ClaimsRequest classes * Support for claims request parameter * Tests for claims request * Use Jackson library for JSON processing * Change access level of userinfo and access_token claims * Better merge tests * Remove ability to set claims in userinfo field * Refactor claims field naming * 1.8.1 release (#326) * Version number updates for 1.8.1 release * Minor rewording Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * Add check for empty String Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * Update lab API urls * Release pointing to the main branch shows not built... some infrastructure needs to get updated to reflect that this thing is being built. * Region discovery support (#343) * Add Azure regional support * Refactor * Add logs for success/failure to find regional info * Extra log * Upgrade oauth2-oidc-sdk version (#345) * 1.8.1 release (#327) * Exception Improvements (#254) * Add null checks for MsalException error code references * Better exception handling for invalid tokens * Better exception handling for invalid tokens * Sync with changes to Azure-Samples/ms-identity-java-desktop (#259) * extra scopes for consent during authorizaion * typo * minor * HTTPClient default timeouts (#264) * Add default timeouts for DefaultHttpClient * Handle 'stay signed in' confirmation page in DeviceCodeIT tests * Small best-practices changes * append extra scopes as suffix * 1.6.2 release (#268) * fixing integ test * Tenant Profiles (#263) * Classes for tenant profile functionality * Implement tenant profile feature * Tests for tenant profile feature * Simplify tenant profile class structure * 1.6.2 release * Classes for tenant profile redesign * Tests for tenant profile redesign * Adjust sample cached ID tokens to have realistic headers * Redesign how Tenant Pofiles are added to Accounts * New error code for JWT parse exceptions * Add claims and tenant profiles fields to Account * Remove annotation excluding realm field from comparisons * Use more generic token * Remove ID token claims field from Account * Minor changes for clarity * Adjust tests for tenant profile design refactor * Refactor tenant profile structure * Minor fixes * Minor fixes * Minor fixes * Simplify tenant profile class Co-authored-by: SomkaPe <[email protected]> * Improve HTTP client timeouts (#275) * 1.6.2 release (#269) * 1.6.2 release * Make DefaultHttpClient timeouts settable * Refactor timeout names Co-authored-by: SomkaPe <[email protected]> * Bewaters certchain (#276) * Support for certificate chain * 1.7.0 release (#277) * Update DefaultHttpClient.java * Fixed parsing ClientInfo: on some accounts, the server response contained characters that are incorrect for Base64 encoding, but acceptable for Base64URL (#282) * sendX5c api (#285) * refactoring (#287) * refactoring * refactoring * refactoring * Add AcquireTokenSilent tests for B2C and ADFS2019, refactor duplicate code in tests (#293) * Add public constants for cloud endpoints (#298) * Add public constants for cloud endpoints * Add license header * Added javadocs * Removed unneeded test * Make IAccount serializable (#297) * Make IAccount objects serializable * Make AuthenticationResult objects not serializable * Add tenant profile/id claims to auth result (#300) * Add tenant profile/id claims to auth result * Minor fix * treat null password as default one - empty string (#304) * treat null password as default one - empty string * Support for refresh_in (#305) * Support for refresh_in * Tests for refresh_in * Add extra null check * Add test for refreshOn cache persistence * refresh on is optional field (#312) * refresh on optional field * 1.8.0 Release (#313) 1.8.0 release * Fix spelling mistake in Prompt.java * Remove use of Nimbus Oauth2 SDK's CommonContentTypes (#322) * Remove use of Nimbus Oauth2 SDK's CommonContentTypes * Add enum for HTTP content-type constants * Remove use of javax.mail.internet.ContentType * Support for claims request parameter (#315) * ClaimsRequest classes * Support for claims request parameter * Tests for claims request * Use Jackson library for JSON processing * Change access level of userinfo and access_token claims * Better merge tests * Remove ability to set claims in userinfo field * Refactor claims field naming * 1.8.1 release (#326) * Version number updates for 1.8.1 release * Minor rewording Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * Upgrade oauth2-oidc-sdk dependency version Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * Add String-to-ClaimsRequest helper method (#344) * 1.8.1 release (#327) * Exception Improvements (#254) * Add null checks for MsalException error code references * Better exception handling for invalid tokens * Better exception handling for invalid tokens * Sync with changes to Azure-Samples/ms-identity-java-desktop (#259) * extra scopes for consent during authorizaion * typo * minor * HTTPClient default timeouts (#264) * Add default timeouts for DefaultHttpClient * Handle 'stay signed in' confirmation page in DeviceCodeIT tests * Small best-practices changes * append extra scopes as suffix * 1.6.2 release (#268) * fixing integ test * Tenant Profiles (#263) * Classes for tenant profile functionality * Implement tenant profile feature * Tests for tenant profile feature * Simplify tenant profile class structure * 1.6.2 release * Classes for tenant profile redesign * Tests for tenant profile redesign * Adjust sample cached ID tokens to have realistic headers * Redesign how Tenant Pofiles are added to Accounts * New error code for JWT parse exceptions * Add claims and tenant profiles fields to Account * Remove annotation excluding realm field from comparisons * Use more generic token * Remove ID token claims field from Account * Minor changes for clarity * Adjust tests for tenant profile design refactor * Refactor tenant profile structure * Minor fixes * Minor fixes * Minor fixes * Simplify tenant profile class Co-authored-by: SomkaPe <[email protected]> * Improve HTTP client timeouts (#275) * 1.6.2 release (#269) * 1.6.2 release * Make DefaultHttpClient timeouts settable * Refactor timeout names Co-authored-by: SomkaPe <[email protected]> * Bewaters certchain (#276) * Support for certificate chain * 1.7.0 release (#277) * Update DefaultHttpClient.java * Fixed parsing ClientInfo: on some accounts, the server response contained characters that are incorrect for Base64 encoding, but acceptable for Base64URL (#282) * sendX5c api (#285) * refactoring (#287) * refactoring * refactoring * refactoring * Add AcquireTokenSilent tests for B2C and ADFS2019, refactor duplicate code in tests (#293) * Add public constants for cloud endpoints (#298) * Add public constants for cloud endpoints * Add license header * Added javadocs * Removed unneeded test * Make IAccount serializable (#297) * Make IAccount objects serializable * Make AuthenticationResult objects not serializable * Add tenant profile/id claims to auth result (#300) * Add tenant profile/id claims to auth result * Minor fix * treat null password as default one - empty string (#304) * treat null password as default one - empty string * Support for refresh_in (#305) * Support for refresh_in * Tests for refresh_in * Add extra null check * Add test for refreshOn cache persistence * refresh on is optional field (#312) * refresh on optional field * 1.8.0 Release (#313) 1.8.0 release * Fix spelling mistake in Prompt.java * Remove use of Nimbus Oauth2 SDK's CommonContentTypes (#322) * Remove use of Nimbus Oauth2 SDK's CommonContentTypes * Add enum for HTTP content-type constants * Remove use of javax.mail.internet.ContentType * Support for claims request parameter (#315) * ClaimsRequest classes * Support for claims request parameter * Tests for claims request * Use Jackson library for JSON processing * Change access level of userinfo and access_token claims * Better merge tests * Remove ability to set claims in userinfo field * Refactor claims field naming * 1.8.1 release (#326) * Version number updates for 1.8.1 release * Minor rewording Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * Add helper method to create a ClaimsRequest from a string Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * 1.9.0 release (#346) * 1.8.1 release (#327) * Exception Improvements (#254) * Add null checks for MsalException error code references * Better exception handling for invalid tokens * Better exception handling for invalid tokens * Sync with changes to Azure-Samples/ms-identity-java-desktop (#259) * extra scopes for consent during authorizaion * typo * minor * HTTPClient default timeouts (#264) * Add default timeouts for DefaultHttpClient * Handle 'stay signed in' confirmation page in DeviceCodeIT tests * Small best-practices changes * append extra scopes as suffix * 1.6.2 release (#268) * fixing integ test * Tenant Profiles (#263) * Classes for tenant profile functionality * Implement tenant profile feature * Tests for tenant profile feature * Simplify tenant profile class structure * 1.6.2 release * Classes for tenant profile redesign * Tests for tenant profile redesign * Adjust sample cached ID tokens to have realistic headers * Redesign how Tenant Pofiles are added to Accounts * New error code for JWT parse exceptions * Add claims and tenant profiles fields to Account * Remove annotation excluding realm field from comparisons * Use more generic token * Remove ID token claims field from Account * Minor changes for clarity * Adjust tests for tenant profile design refactor * Refactor tenant profile structure * Minor fixes * Minor fixes * Minor fixes * Simplify tenant profile class Co-authored-by: SomkaPe <[email protected]> * Improve HTTP client timeouts (#275) * 1.6.2 release (#269) * 1.6.2 release * Make DefaultHttpClient timeouts settable * Refactor timeout names Co-authored-by: SomkaPe <[email protected]> * Bewaters certchain (#276) * Support for certificate chain * 1.7.0 release (#277) * Update DefaultHttpClient.java * Fixed parsing ClientInfo: on some accounts, the server response contained characters that are incorrect for Base64 encoding, but acceptable for Base64URL (#282) * sendX5c api (#285) * refactoring (#287) * refactoring * refactoring * refactoring * Add AcquireTokenSilent tests for B2C and ADFS2019, refactor duplicate code in tests (#293) * Add public constants for cloud endpoints (#298) * Add public constants for cloud endpoints * Add license header * Added javadocs * Removed unneeded test * Make IAccount serializable (#297) * Make IAccount objects serializable * Make AuthenticationResult objects not serializable * Add tenant profile/id claims to auth result (#300) * Add tenant profile/id claims to auth result * Minor fix * treat null password as default one - empty string (#304) * treat null password as default one - empty string * Support for refresh_in (#305) * Support for refresh_in * Tests for refresh_in * Add extra null check * Add test for refreshOn cache persistence * refresh on is optional field (#312) * refresh on optional field * 1.8.0 Release (#313) 1.8.0 release * Fix spelling mistake in Prompt.java * Remove use of Nimbus Oauth2 SDK's CommonContentTypes (#322) * Remove use of Nimbus Oauth2 SDK's CommonContentTypes * Add enum for HTTP content-type constants * Remove use of javax.mail.internet.ContentType * Support for claims request parameter (#315) * ClaimsRequest classes * Support for claims request parameter * Tests for claims request * Use Jackson library for JSON processing * Change access level of userinfo and access_token claims * Better merge tests * Remove ability to set claims in userinfo field * Refactor claims field naming * 1.8.1 release (#326) * Version number updates for 1.8.1 release * Minor rewording Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> * Add helper method for creating ClaimsRequest from a string * Version number updates for 1.9.0 release Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: SomkaPe <[email protected]> Co-authored-by: Roman Nosachev <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: Santiago Gonzalez <[email protected]> Co-authored-by: henrikm <[email protected]>
1 parent e34e382 commit 5f4ca84

File tree

13 files changed

+268
-24
lines changed

13 files changed

+268
-24
lines changed

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
`master` branch | `dev` branch | Reference Docs
44
--------------------|-----------------|---------------
5-
[![Build status](https://identitydivision.visualstudio.com/IDDP/_apis/build/status/CI/Java/MSAL%20Java%20CI%20Build?branchName=master)](https://identitydivision.visualstudio.com/IDDP/_build/latest?definitionId=762) | [![Build status](https://identitydivision.visualstudio.com/IDDP/_apis/build/status/CI/Java/MSAL%20Java%20CI%20Build?branchName=dev)](https://identitydivision.visualstudio.com/IDDP/_build/latest?definitionId=762)| [![Javadocs](http://javadoc.io/badge/com.microsoft.azure/msal4j.svg)](http://javadoc.io/doc/com.microsoft.azure/msal4j)
5+
[![Build status](https://identitydivision.visualstudio.com/IDDP/_apis/build/status/CI/Java/MSAL%20Java%20CI%20Build?branchName=main)](https://identitydivision.visualstudio.com/IDDP/_build/latest?definitionId=762) | [![Build status](https://identitydivision.visualstudio.com/IDDP/_apis/build/status/CI/Java/MSAL%20Java%20CI%20Build?branchName=dev)](https://identitydivision.visualstudio.com/IDDP/_build/latest?definitionId=762)| [![Javadocs](http://javadoc.io/badge/com.microsoft.azure/msal4j.svg)](http://javadoc.io/doc/com.microsoft.azure/msal4j)
66

77
The Microsoft Authentication Library for Java (MSAL4J) enables applications to integrate with the [Microsoft identity platform](https://aka.ms/aaddevv2). It allows you to sign in users or apps with Microsoft identities (Azure AD, Microsoft accounts and Azure AD B2C accounts) and obtain tokens to call Microsoft APIs such as [Microsoft Graph](https://graph.microsoft.io/) or your own APIs registered with the Microsoft identity platform. It is built using industry standard OAuth2 and OpenID Connect protocols.
88

@@ -16,7 +16,7 @@ Quick links:
1616
The library supports the following Java environments:
1717
- Java 8 (or higher)
1818

19-
Current version - 1.8.1
19+
Current version - 1.9.0
2020

2121
You can find the changes for each version in the [change log](https://github.com/AzureAD/microsoft-authentication-library-for-java/blob/master/changelog.txt).
2222

@@ -28,13 +28,13 @@ Find [the latest package in the Maven repository](https://mvnrepository.com/arti
2828
<dependency>
2929
<groupId>com.microsoft.azure</groupId>
3030
<artifactId>msal4j</artifactId>
31-
<version>1.8.1</version>
31+
<version>1.9.0</version>
3232
</dependency>
3333
```
3434
### Gradle
3535

3636
```
37-
compile group: 'com.microsoft.azure', name: 'msal4j', version: '1.8.1'
37+
compile group: 'com.microsoft.azure', name: 'msal4j', version: '1.9.0'
3838
```
3939

4040
## Usage

‎changelog.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
Version 1.9.0
2+
=============
3+
- Add support for Azure region discovery to keep token traffic regional when possible
4+
- New helper methods in ClaimsRequest class to convert Strings of claims to ClaimsRequest objects
5+
- Upgrade nimbusds.oauth2-oidc-sdk dependency to better support newer Spring Framework versions
6+
17
Version 1.8.1
28
=============
39
- New ClaimsRequest class to allow ID token claims to be requested as part of any token request

‎pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<modelVersion>4.0.0</modelVersion>
44
<groupId>com.microsoft.azure</groupId>
55
<artifactId>msal4j</artifactId>
6-
<version>1.8.1</version>
6+
<version>1.9.0</version>
77
<packaging>jar</packaging>
88
<name>msal4j</name>
99
<description>
@@ -36,7 +36,7 @@
3636
<dependency>
3737
<groupId>com.nimbusds</groupId>
3838
<artifactId>oauth2-oidc-sdk</artifactId>
39-
<version>7.4</version>
39+
<version>8.23.1</version>
4040
</dependency>
4141
<dependency>
4242
<groupId>org.slf4j</groupId>

‎src/integrationtest/java/labapi/LabConstants.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ public class LabConstants {
99
public final static String LAB_APP_ENDPOINT = "https://msidlab.com/api/App";
1010
public final static String LAB_LAB_ENDPOINT = "https://msidlab.com/api/Lab";
1111

12-
public final static String APP_ID_KEY_VAULT_SECRET = "https://msidlabs.vault.azure.net/secrets/LabVaultAppID/4032a45f48dc424d8edd445a42d25960";
13-
public final static String APP_PASSWORD_KEY_VAULT_SECRET = "https://msidlabs.vault.azure.net/secrets/LabVaultAppSecret/c2be68b1f01d4861819d6afde2ec71e3";
14-
public final static String USER_MSA_USERNAME_URL = "https://msidlabs.vault.azure.net/secrets/MSA-MSIDLAB4-UserName/a6df85b08cf54347a64db17fe34d9a5f";
15-
public final static String USER_MSA_PASSWORD_URL= "https://msidlabs.vault.azure.net/secrets/MSA-MSIDLAB4-Password/69850200618d43cf86c5b51e4cf8a7e5";
16-
public final static String OBO_APP_PASSWORD_URL = "https://msidlabs.vault.azure.net/secrets/TodoListServiceV2-OBO/c58ba97c34ca4464886943a847d1db56";
12+
public final static String APP_ID_KEY_VAULT_SECRET = "https://msidlabs.vault.azure.net/secrets/LabVaultAppID";
13+
public final static String APP_PASSWORD_KEY_VAULT_SECRET = "https://msidlabs.vault.azure.net/secrets/LabVaultAppSecret";
14+
public final static String USER_MSA_USERNAME_URL = "https://msidlabs.vault.azure.net/secrets/MSA-MSIDLAB4-UserName";
15+
public final static String USER_MSA_PASSWORD_URL= "https://msidlabs.vault.azure.net/secrets/MSA-MSIDLAB4-Password";
16+
public final static String OBO_APP_PASSWORD_URL = "https://msidlabs.vault.azure.net/secrets/TodoListServiceV2-OBO";
1717

1818
public final static String ARLINGTON_APP_ID = "cb7faed4-b8c0-49ee-b421-f5ed16894c83";
1919
public final static String ARLINGTON_OBO_APP_ID = "c0555d2d-02f2-4838-802e-3463422e571d";

‎src/main/java/com/microsoft/aad/msal4j/AadInstanceDiscoveryProvider.java

Lines changed: 94 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,36 @@
33

44
package com.microsoft.aad.msal4j;
55

6+
import com.nimbusds.oauth2.sdk.http.HTTPResponse;
7+
8+
import org.slf4j.Logger;
9+
import org.slf4j.LoggerFactory;
10+
611
import java.net.URL;
712
import java.util.Arrays;
813
import java.util.Collections;
914
import java.util.Set;
1015
import java.util.TreeSet;
16+
import java.util.Map;
17+
import java.util.HashMap;
1118
import java.util.concurrent.ConcurrentHashMap;
1219

1320
class AadInstanceDiscoveryProvider {
1421

1522
private final static String DEFAULT_TRUSTED_HOST = "login.microsoftonline.com";
1623
private final static String AUTHORIZE_ENDPOINT_TEMPLATE = "https://{host}/{tenant}/oauth2/v2.0/authorize";
1724
private final static String INSTANCE_DISCOVERY_ENDPOINT_TEMPLATE = "https://{host}/common/discovery/instance";
25+
private final static String INSTANCE_DISCOVERY_ENDPOINT_TEMPLATE_WITH_REGION = "https://{region}.{host}/common/discovery/instance";
1826
private final static String INSTANCE_DISCOVERY_REQUEST_PARAMETERS_TEMPLATE = "?api-version=1.1&authorization_endpoint={authorizeEndpoint}";
27+
private final static String REGION_NAME = "REGION_NAME";
28+
// For information of the current api-version refer: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service#versioning
29+
private final static String DEFAULT_API_VERSION = "2020-06-01";
30+
private final static String IMDS_ENDPOINT = "https://169.254.169.254/metadata/instance/compute/location?" + DEFAULT_API_VERSION + "&format=text";
1931

2032
final static TreeSet<String> TRUSTED_HOSTS_SET = new TreeSet<>(String.CASE_INSENSITIVE_ORDER);
2133

34+
private final static Logger log = LoggerFactory.getLogger(HttpHelper.class);
35+
2236
static ConcurrentHashMap<String, InstanceDiscoveryMetadataEntry> cache = new ConcurrentHashMap<>();
2337

2438
static {
@@ -102,26 +116,98 @@ private static String getInstanceDiscoveryEndpoint(String host) {
102116
replace("{host}", discoveryHost);
103117
}
104118

119+
private static String getInstanceDiscoveryEndpointWithRegion(String host, String region) {
120+
121+
String discoveryHost = TRUSTED_HOSTS_SET.contains(host) ? host : DEFAULT_TRUSTED_HOST;
122+
123+
return INSTANCE_DISCOVERY_ENDPOINT_TEMPLATE_WITH_REGION.
124+
replace("{region}", region).
125+
replace("{host}", discoveryHost);
126+
}
127+
105128
private static AadInstanceDiscoveryResponse sendInstanceDiscoveryRequest(URL authorityUrl,
106129
MsalRequest msalRequest,
107130
ServiceBundle serviceBundle) {
108131

109-
String instanceDiscoveryRequestUrl = getInstanceDiscoveryEndpoint(authorityUrl.getAuthority()) +
110-
INSTANCE_DISCOVERY_REQUEST_PARAMETERS_TEMPLATE.replace("{authorizeEndpoint}",
111-
getAuthorizeEndpoint(authorityUrl.getAuthority(),
112-
Authority.getTenant(authorityUrl, Authority.detectAuthorityType(authorityUrl))));
132+
String region = StringHelper.EMPTY_STRING;
133+
IHttpResponse httpResponse = null;
134+
135+
//If the autoDetectRegion parameter in the request is set, attempt to discover the region
136+
if (msalRequest.application().autoDetectRegion()) {
137+
region = discoverRegion(msalRequest, serviceBundle);
138+
}
139+
140+
//If the region is known, attempt to make instance discovery request with region endpoint
141+
if (!region.isEmpty()) {
142+
String instanceDiscoveryRequestUrl = getInstanceDiscoveryEndpointWithRegion(authorityUrl.getAuthority(), region) +
143+
formInstanceDiscoveryParameters(authorityUrl);
144+
145+
httpResponse = httpRequest(instanceDiscoveryRequestUrl, msalRequest.headers().getReadonlyHeaderMap(), msalRequest, serviceBundle);
146+
}
147+
148+
//If the region is unknown or the instance discovery failed at the region endpoint, try the global endpoint
149+
if (region.isEmpty() || httpResponse == null || httpResponse.statusCode() != HTTPResponse.SC_OK) {
150+
if (!region.isEmpty()) {
151+
log.warn("Could not retrieve regional instance discovery metadata, falling back to global endpoint");
152+
}
153+
154+
String instanceDiscoveryRequestUrl = getInstanceDiscoveryEndpoint(authorityUrl.getAuthority()) +
155+
formInstanceDiscoveryParameters(authorityUrl);
156+
157+
httpResponse = httpRequest(instanceDiscoveryRequestUrl, msalRequest.headers().getReadonlyHeaderMap(), msalRequest, serviceBundle);
158+
}
113159

160+
return JsonHelper.convertJsonToObject(httpResponse.body(), AadInstanceDiscoveryResponse.class);
161+
}
162+
163+
private static String formInstanceDiscoveryParameters(URL authorityUrl) {
164+
return INSTANCE_DISCOVERY_REQUEST_PARAMETERS_TEMPLATE.replace("{authorizeEndpoint}",
165+
getAuthorizeEndpoint(authorityUrl.getAuthority(),
166+
Authority.getTenant(authorityUrl, Authority.detectAuthorityType(authorityUrl))));
167+
}
168+
169+
private static IHttpResponse httpRequest(String requestUrl, Map<String, String> headers, MsalRequest msalRequest, ServiceBundle serviceBundle) {
114170
HttpRequest httpRequest = new HttpRequest(
115171
HttpMethod.GET,
116-
instanceDiscoveryRequestUrl,
117-
msalRequest.headers().getReadonlyHeaderMap());
172+
requestUrl,
173+
headers);
118174

119-
IHttpResponse httpResponse= HttpHelper.executeHttpRequest(
175+
return HttpHelper.executeHttpRequest(
120176
httpRequest,
121177
msalRequest.requestContext(),
122178
serviceBundle);
179+
}
123180

124-
return JsonHelper.convertJsonToObject(httpResponse.body(), AadInstanceDiscoveryResponse.class);
181+
private static String discoverRegion(MsalRequest msalRequest, ServiceBundle serviceBundle) {
182+
183+
//Check if the REGION_NAME environment variable has a value for the region
184+
if (System.getenv(REGION_NAME) != null) {
185+
log.info("Region found in environment variable: " + System.getenv(REGION_NAME));
186+
187+
return System.getenv(REGION_NAME);
188+
}
189+
190+
try {
191+
//Check the IMDS endpoint to retrieve current region (will only work if application is running in an Azure VM)
192+
Map<String, String> headers = new HashMap<>();
193+
headers.put("Metadata", "true");
194+
IHttpResponse httpResponse = httpRequest(IMDS_ENDPOINT, headers, msalRequest, serviceBundle);
195+
196+
//If call to IMDS endpoint was successful, return region from response body
197+
if (httpResponse.statusCode() == HTTPResponse.SC_OK && !httpResponse.body().isEmpty()) {
198+
log.info("Region retrieved from IMDS endpoint: " + httpResponse.body());
199+
200+
return httpResponse.body();
201+
}
202+
203+
log.warn(String.format("Call to local IMDS failed with status code: %s, or response was empty", httpResponse.statusCode()));
204+
205+
return StringHelper.EMPTY_STRING;
206+
} catch (Exception e) {
207+
//IMDS call failed, cannot find region
208+
log.warn(String.format("Exception during call to local IMDS endpoint: %s", e.getMessage()));
209+
return StringHelper.EMPTY_STRING;
210+
}
125211
}
126212

127213
private static void doInstanceDiscoveryAndCache(URL authorityUrl,

‎src/main/java/com/microsoft/aad/msal4j/AbstractClientApplicationBase.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,10 @@ abstract class AbstractClientApplicationBase implements IClientApplicationBase {
9696
@Getter
9797
private String clientCapabilities;
9898

99+
@Accessors(fluent = true)
100+
@Getter
101+
private boolean autoDetectRegion;
102+
99103
@Override
100104
public CompletableFuture<IAuthenticationResult> acquireToken(AuthorizationCodeParameters parameters) {
101105

@@ -292,6 +296,7 @@ abstract static class Builder<T extends Builder<T>> {
292296
private ITokenCacheAccessAspect tokenCacheAccessAspect;
293297
private AadInstanceDiscoveryResponse aadInstanceDiscoveryResponse;
294298
private String clientCapabilities;
299+
private boolean autoDetectRegion;
295300
private Integer connectTimeoutForDefaultHttpClient;
296301
private Integer readTimeoutForDefaultHttpClient;
297302

@@ -573,6 +578,22 @@ public T clientCapabilities(Set<String> capabilities) {
573578
return self();
574579
}
575580

581+
/**
582+
* Indicates that the library should attempt to discover the Azure region the application is running in when
583+
* fetching the instance discovery metadata.
584+
*
585+
* If the region is found, token requests will be sent to the regional ESTS endpoint rather than the global endpoint.
586+
* If region information could not be found, the library will fall back to using the global endpoint, which is also
587+
* the default behavior if this value is not set.
588+
*
589+
* @param val boolean (default is false)
590+
* @return instance of the Builder on which method was called
591+
*/
592+
public T autoDetectRegion(boolean val) {
593+
autoDetectRegion = val;
594+
return self();
595+
}
596+
576597
abstract AbstractClientApplicationBase build();
577598
}
578599

@@ -599,6 +620,7 @@ public T clientCapabilities(Set<String> capabilities) {
599620
tokenCache = new TokenCache(builder.tokenCacheAccessAspect);
600621
aadAadInstanceDiscoveryResponse = builder.aadInstanceDiscoveryResponse;
601622
clientCapabilities = builder.clientCapabilities;
623+
autoDetectRegion = builder.autoDetectRegion;
602624

603625
if(aadAadInstanceDiscoveryResponse != null){
604626
AadInstanceDiscoveryProvider.cacheInstanceDiscoveryMetadata(

‎src/main/java/com/microsoft/aad/msal4j/AuthenticationResult.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ private IAccount getAccount() {
7272
private final ITenantProfile tenantProfile = getTenantProfile();
7373

7474
private ITenantProfile getTenantProfile() {
75-
if (idToken == null) {
75+
if (StringHelper.isBlank(idToken)) {
7676
return null;
7777
}
7878

‎src/main/java/com/microsoft/aad/msal4j/ClaimsRequest.java

Lines changed: 73 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,17 @@
33

44
package com.microsoft.aad.msal4j;
55

6+
7+
import com.fasterxml.jackson.core.type.TypeReference;
8+
import com.fasterxml.jackson.databind.JsonNode;
69
import com.fasterxml.jackson.databind.ObjectMapper;
10+
import com.fasterxml.jackson.databind.ObjectReader;
711
import com.fasterxml.jackson.databind.node.ObjectNode;
812
import lombok.Getter;
913
import lombok.Setter;
14+
15+
import java.util.Iterator;
16+
import java.io.IOException;
1017
import java.util.ArrayList;
1118
import java.util.List;
1219

@@ -34,6 +41,17 @@ public void requestClaimInIdToken(String claim, RequestedClaimAdditionalInfo req
3441
idTokenRequestedClaims.add(new RequestedClaim(claim, requestedClaimAdditionalInfo));
3542
}
3643

44+
/**
45+
46+
* Inserts a claim into the list of claims to be added to the "userinfo" section of an OIDC claims request
47+
*
48+
* @param claim the name of the claim to be requested
49+
* @param requestedClaimAdditionalInfo additional information about the claim being requested
50+
*/
51+
protected void requestClaimInUserInfo(String claim, RequestedClaimAdditionalInfo requestedClaimAdditionalInfo) {
52+
userInfoRequestedClaims.add(new RequestedClaim(claim, requestedClaimAdditionalInfo));
53+
}
54+
3755
/**
3856
* Inserts a claim into the list of claims to be added to the "access_token" section of an OIDC claims request
3957
*
@@ -70,9 +88,63 @@ private ObjectNode convertClaimsToObjectNode(List<RequestedClaim> claims) {
7088
ObjectMapper mapper = new ObjectMapper();
7189
ObjectNode claimsNode = mapper.createObjectNode();
7290

73-
for (RequestedClaim claim: claims) {
91+
92+
for (RequestedClaim claim : claims) {
7493
claimsNode.setAll((ObjectNode) mapper.valueToTree(claim));
7594
}
7695
return claimsNode;
7796
}
97+
98+
/**
99+
* Creates an instance of ClaimsRequest from a JSON-formatted String which follows the specification for the OIDC claims request parameter
100+
*
101+
* @param claims a String following JSON formatting
102+
* @return a ClaimsRequest instance
103+
*/
104+
public static ClaimsRequest formatAsClaimsRequest(String claims) {
105+
try {
106+
ClaimsRequest cr = new ClaimsRequest();
107+
108+
ObjectMapper mapper = new ObjectMapper();
109+
ObjectReader reader = mapper.readerFor(new TypeReference<List<String>>() {});
110+
111+
JsonNode jsonClaims = mapper.readTree(claims);
112+
113+
addClaimsFromJsonNode(jsonClaims.get("id_token"), "id_token", cr, reader);
114+
addClaimsFromJsonNode(jsonClaims.get("userinfo"), "userinfo", cr, reader);
115+
addClaimsFromJsonNode(jsonClaims.get("access_token"), "access_token", cr, reader);
116+
117+
return cr;
118+
} catch (IOException e) {
119+
throw new MsalClientException("Could not convert string to ClaimsRequest: " + e.getMessage(), AuthenticationErrorCode.INVALID_JSON);
120+
}
121+
}
122+
123+
private static void addClaimsFromJsonNode(JsonNode claims, String group, ClaimsRequest cr, ObjectReader reader) throws IOException {
124+
Iterator<String> claimsIterator;
125+
126+
if (claims != null) {
127+
claimsIterator = claims.fieldNames();
128+
while (claimsIterator.hasNext()) {
129+
String claim = claimsIterator.next();
130+
Boolean essential = null;
131+
String value = null;
132+
List<String> values = null;
133+
RequestedClaimAdditionalInfo claimInfo = null;
134+
135+
if (claims.get(claim).has("essential")) essential = claims.get(claim).get("essential").asBoolean();
136+
if (claims.get(claim).has("value")) value = claims.get(claim).get("value").textValue();
137+
if (claims.get(claim).has("values")) values = reader.readValue(claims.get(claim).get("values"));
138+
139+
//'null' is a valid value for RequestedClaimAdditionalInfo, so only initialize it if one of the parameters is not null
140+
if (essential != null || value != null || values != null) {
141+
claimInfo = new RequestedClaimAdditionalInfo(essential == null ? false : essential, value, values);
142+
}
143+
144+
if (group.equals("id_token")) cr.requestClaimInIdToken(claim, claimInfo);
145+
if (group.equals("userinfo")) cr.requestClaimInUserInfo(claim, claimInfo);
146+
if (group.equals("access_token")) cr.requestClaimInAccessToken(claim, claimInfo);
147+
}
148+
}
149+
}
78150
}

‎src/samples/msal-b2c-web-sample/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
<dependency>
2424
<groupId>com.microsoft.azure</groupId>
2525
<artifactId>msal4j</artifactId>
26-
<version>1.8.1</version>
26+
<version>1.9.0</version>
2727
</dependency>
2828
<dependency>
2929
<groupId>com.nimbusds</groupId>

0 commit comments

Comments
 (0)