Merge branch 'main' of https://github.com/AzureAD/microsoft-authentication-library-for-java into main

# Conflicts:
#	msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/InstanceDiscoveryTest.java
#	msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/InvalidAuthorityIT.java
#	msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/CIAMAuthority.java
#	src/main/java/com/microsoft/aad/msal4j/B2CAuthority.java

Author: Avery-Dunn

.github/workflows/codeql.yml

@@ -21,15 +21,15 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below).
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -43,4 +43,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2

.gitignore renamed to msal4j-sdk/.gitignore

@@ -20,7 +20,7 @@
 *.rar
 
 # Intellij
-.idea/
+../.idea/
 
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*

changelog.txt renamed to msal4j-sdk/changelog.txt

@@ -206,12 +206,12 @@ private void assertAcquireTokenInstanceAware(User user) {
         Assert.assertEquals(result.account().environment(), cachedResult.environment());
     }
 
-    @Test
+    //@Test
     public void acquireTokensInHomeAndGuestClouds_ArlingtonAccount() throws MalformedURLException, ExecutionException, InterruptedException {
         acquireTokensInHomeAndGuestClouds(AzureEnvironment.AZURE_US_GOVERNMENT);
     }
 
-    @Test
+    //@Test
     public void acquireTokensInHomeAndGuestClouds_MooncakeAccount() throws MalformedURLException, ExecutionException, InterruptedException {
         acquireTokensInHomeAndGuestClouds(AzureEnvironment.AZURE_CHINA);
     }

contributing.md renamed to msal4j-sdk/contributing.md

@@ -6,6 +6,9 @@
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ExecutionException;
 
+/** Disclaimer - This  class is meant to be used by the Azure SDK team only.
+ *  Any other teams are discouraged from using this class to prevent any side effects.
+ */
 class AcquireTokenByAppProviderSupplier extends AuthenticationResultSupplier {
 
     private static final int TWO_HOURS = 2*3600;
@@ -65,9 +68,14 @@ AuthenticationResult execute() throws Exception {
 
     public AuthenticationResult fetchTokenUsingAppTokenProvider(AppTokenProviderParameters appTokenProviderParameters) throws ExecutionException, InterruptedException {
 
-        CompletableFuture<TokenProviderResult> completableFuture = this.clientCredentialRequest.appTokenProvider.apply(appTokenProviderParameters);
+        TokenProviderResult tokenProviderResult;
+        try{
+            CompletableFuture<TokenProviderResult> completableFuture = this.clientCredentialRequest.appTokenProvider.apply(appTokenProviderParameters);
+            tokenProviderResult = completableFuture.get();
 
-        TokenProviderResult tokenProviderResult = completableFuture.get();
+        } catch (Exception ex){
+            throw new MsalAzureSDKException(ex);
+        }
 
         validateAndUpdateTokenProviderResult(tokenProviderResult);
 
@@ -78,6 +86,5 @@ public AuthenticationResult fetchTokenUsingAppTokenProvider(AppTokenProviderPara
                 .expiresOn(tokenProviderResult.getExpiresInSeconds())
                 .refreshOn(tokenProviderResult.getRefreshInSeconds())
                 .build();
-
     }
 }

src/integrationtest/java/com.microsoft.aad.msal4j/AcquireTokenInteractiveIT.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/AcquireTokenInteractiveIT.java

@@ -115,4 +115,9 @@ public class AuthenticationErrorCode {
      * A JWT parsing failure, indicating the JWT provided to MSAL is of invalid format.
      */
     public final static String INVALID_JWT = "invalid_jwt";
+    /**
+     * Indicates that a Broker implementation is missing from the device, such as when an app developer
+     * does not include one of our broker packages as a dependency in their project, or otherwise cannot
+     * be accessed by MSAL Java*/
+    public final static String MISSING_BROKER = "missing_broker";
 }

src/integrationtest/java/com.microsoft.aad.msal4j/AcquireTokenSilentIT.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/AcquireTokenSilentIT.java

@@ -4,16 +4,14 @@
 package com.microsoft.aad.msal4j;
 
 
-import java.nio.charset.StandardCharsets;
 import java.net.MalformedURLException;
-import java.util.Base64;
-
-import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
 import java.util.concurrent.CompletionException;
 import java.util.function.Supplier;
 
@@ -114,8 +112,8 @@ private void logResult(AuthenticationResult result, HttpHeaders headers) {
                         .refreshToken());
                 if (clientApplication.logPii()) {
                     clientApplication.log.debug(LogHelper.createMessage(String.format(
-                            "Access Token with hash '%s' and Refresh Token with hash '%s' returned",
-                            accessTokenHash, refreshTokenHash),
+                                    "Access Token with hash '%s' and Refresh Token with hash '%s' returned",
+                                    accessTokenHash, refreshTokenHash),
                             headers.getHeaderCorrelationIdValue()));
                 } else {
                     clientApplication.log.debug(
@@ -126,7 +124,7 @@ private void logResult(AuthenticationResult result, HttpHeaders headers) {
             } else {
                 if (clientApplication.logPii()) {
                     clientApplication.log.debug(LogHelper.createMessage(String.format(
-                            "Access Token with hash '%s' returned", accessTokenHash),
+                                    "Access Token with hash '%s' returned", accessTokenHash),
                             headers.getHeaderCorrelationIdValue()));
                 } else {
                     clientApplication.log.debug(LogHelper.createMessage(
@@ -149,6 +147,9 @@ private void logException(Exception ex) {
                 clientApplication.log.debug(logMessage, ex);
                 return;
             }
+        } else if (ex instanceof MsalAzureSDKException) {
+            clientApplication.log.debug(ex.getMessage(), ex);
+            return;
         }
 
         clientApplication.log.error(logMessage, ex);
@@ -163,11 +164,7 @@ private ApiEvent initializeApiEvent(MsalRequest msalRequest) {
         apiEvent.setRequestId(msalRequest.requestContext().telemetryRequestId());
         apiEvent.setWasSuccessful(false);
 
-        if (clientApplication instanceof ConfidentialClientApplication) {
-            apiEvent.setIsConfidentialClient(true);
-        } else {
-            apiEvent.setIsConfidentialClient(false);
-        }
+        apiEvent.setIsConfidentialClient(clientApplication instanceof ConfidentialClientApplication);
 
         try {
             Authority authenticationAuthority = clientApplication.authenticationAuthority;

src/integrationtest/java/com.microsoft.aad.msal4j/ApacheHttpClientAdapter.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/ApacheHttpClientAdapter.java

@@ -3,6 +3,9 @@
 
 package com.microsoft.aad.msal4j;
 
+import lombok.Getter;
+import lombok.experimental.Accessors;
+
 import java.io.IOException;
 import java.io.InputStream;
 import java.lang.reflect.InvocationTargetException;
@@ -19,10 +22,11 @@
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPrivateKey;
-import java.util.*;
-
-import lombok.Getter;
-import lombok.experimental.Accessors;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Enumeration;
+import java.util.List;
 
 final class ClientCertificate implements IClientCertificate {
 
@@ -97,14 +101,7 @@ static ClientCertificate create(InputStream pkcs12Certificate, String password)
         final KeyStore keystore = KeyStore.getInstance("PKCS12");
         keystore.load(pkcs12Certificate, password.toCharArray());
 
-        final Enumeration<String> aliases = keystore.aliases();
-        if (!aliases.hasMoreElements()) {
-            throw new IllegalArgumentException("certificate not loaded from input stream");
-        }
-        String alias = aliases.nextElement();
-        if (aliases.hasMoreElements()) {
-            throw new IllegalArgumentException("more than one certificate alias found in input stream");
-        }
+        String alias = getPrivateKeyAlias(keystore);
 
         ArrayList<X509Certificate> publicKeyCertificateChain = new ArrayList<>();
         PrivateKey privateKey = (PrivateKey) keystore.getKey(alias, password.toCharArray());
@@ -123,6 +120,26 @@ static ClientCertificate create(InputStream pkcs12Certificate, String password)
         return new ClientCertificate(privateKey, publicKeyCertificateChain);
     }
 
+    static String getPrivateKeyAlias(KeyStore keystore) throws KeyStoreException {
+        String alias = null;
+        final Enumeration<String> aliases = keystore.aliases();
+        while (aliases.hasMoreElements()) {
+            String currentAlias = aliases.nextElement();
+            if (keystore.entryInstanceOf(currentAlias, KeyStore.PrivateKeyEntry.class)) {
+                if (alias != null) {
+                    throw new IllegalArgumentException("more than one certificate alias found in input stream");
+                }
+                alias = currentAlias;
+            }
+        }
+
+        if (alias == null) {
+            throw new IllegalArgumentException("certificate not loaded from input stream");
+        }
+
+        return alias;
+    }
+
     static ClientCertificate create(final PrivateKey key, final X509Certificate publicKeyCertificate) {
         return new ClientCertificate(key, Arrays.asList(publicKeyCertificate));
     }

src/integrationtest/java/com.microsoft.aad.msal4j/AuthorizationCodeIT.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/AuthorizationCodeIT.java

@@ -0,0 +1,60 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package com.microsoft.aad.msal4j;
+
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+
+/**
+ * Used to define the basic set of methods that all Brokers must implement
+ *
+ * All methods are so they can be referenced by MSAL Java without an implementation, and by default simply throw an
+ * exception saying that a broker implementation is missing
+ */
+public interface IBroker {
+
+    /**
+     * checks if a IBroker implementation exists
+     */
+
+    default boolean isAvailable(){
+        return false;
+    }
+    /**
+     * Acquire a token silently, i.e. without direct user interaction
+     *
+     * This may be accomplished by returning tokens from a token cache, using cached refresh tokens to get new tokens,
+     * or via any authentication flow where a user is not prompted to enter credentials
+     *
+     * @param requestParameters MsalRequest object which contains everything needed for the broker implementation to make a request
+     * @return IBroker implementations will return an AuthenticationResult object
+     */
+    default IAuthenticationResult acquireToken(PublicClientApplication application, SilentParameters requestParameters) {
+        throw new MsalClientException("Broker implementation missing", AuthenticationErrorCode.MISSING_BROKER);
+    }
+
+    /**
+     * Acquire a token interactively, by prompting users to enter their credentials in some way
+     *
+     * @param requestParameters MsalRequest object which contains everything needed for the broker implementation to make a request
+     * @return IBroker implementations will return an AuthenticationResult object
+     */
+    default IAuthenticationResult acquireToken(PublicClientApplication application, InteractiveRequestParameters requestParameters) {
+        throw new MsalClientException("Broker implementation missing", AuthenticationErrorCode.MISSING_BROKER);
+    }
+
+    /**
+     * Acquire a token silently, i.e. without direct user interaction, using username/password authentication
+     *
+     * @param requestParameters MsalRequest object which contains everything needed for the broker implementation to make a request
+     * @return IBroker implementations will return an AuthenticationResult object
+     */
+    default IAuthenticationResult acquireToken(PublicClientApplication application, UserNamePasswordParameters requestParameters) {
+        throw new MsalClientException("Broker implementation missing", AuthenticationErrorCode.MISSING_BROKER);
+    }
+
+    default CompletableFuture removeAccount(IAccount account) {
+        throw new MsalClientException("Broker implementation missing", AuthenticationErrorCode.MISSING_BROKER);
+    }
+}

src/integrationtest/java/com.microsoft.aad.msal4j/AzureEnvironmentIT.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/AzureEnvironmentIT.java

@@ -0,0 +1,14 @@
+package com.microsoft.aad.msal4j;
+
+/**
+ * Exception type thrown when Azure SDK returns an error response.
+ */
+public class MsalAzureSDKException extends MsalException{
+    public MsalAzureSDKException(Throwable throwable) {
+        super(throwable);
+    }
+
+    public MsalAzureSDKException(String message, String errorCode) {
+        super(message, errorCode);
+    }
+}

src/integrationtest/java/com.microsoft.aad.msal4j/CachePersistenceIT.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/CachePersistenceIT.java

@@ -3,8 +3,6 @@
 
 package com.microsoft.aad.msal4j;
 
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.http.HTTPResponse;
 import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
@@ -26,9 +24,6 @@
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Paths;
-import java.sql.Time;
-import java.time.Duration;
-import java.time.Instant;
 import java.util.*;
 
 import static com.microsoft.aad.msal4j.Constants.POINT_DELIMITER;

src/integrationtest/java/com.microsoft.aad.msal4j/CertificateHelper.java renamed to msal4j-sdk/src/integrationtest/java/com.microsoft.aad.msal4j/CertificateHelper.java

@@ -0,0 +1,75 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package com.microsoft.aad.msal4j;
+
+import org.easymock.EasyMock;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import java.security.KeyStore;
+import java.security.KeyStoreSpi;
+import java.util.Arrays;
+import java.util.Collections;
+
+import static org.testng.AssertJUnit.assertEquals;
+
+@Test
+public class ClientCertificatePkcs12Test extends AbstractMsalTests {
+
+    private KeyStoreSpi keyStoreSpi;
+    private KeyStore keystore;
+
+    @BeforeMethod
+    public void setUp() throws Exception {
+        keyStoreSpi = EasyMock.createMock(KeyStoreSpi.class);
+        keystore = new KeyStore(keyStoreSpi, null, "PKCS12") {};
+        keystore.load(null);
+    }
+
+    @Test(expectedExceptions = IllegalArgumentException.class, expectedExceptionsMessageRegExp = "certificate not loaded from input stream")
+    public void testNoEntries() throws Exception {
+        EasyMock.expect(keyStoreSpi.engineAliases())
+                .andReturn(Collections.enumeration(Collections.emptyList())).times(1);
+        EasyMock.replay(keyStoreSpi);
+
+        ClientCertificate.getPrivateKeyAlias(keystore);
+    }
+
+    @Test(expectedExceptions = IllegalArgumentException.class, expectedExceptionsMessageRegExp = "certificate not loaded from input stream")
+    public void testNoPrivateKey() throws Exception {
+        EasyMock.expect(keyStoreSpi.engineAliases())
+                .andReturn(Collections.enumeration(Arrays.asList("CA_cert1", "CA_cert2"))).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("CA_cert1", KeyStore.PrivateKeyEntry.class)).andReturn(false).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("CA_cert2", KeyStore.PrivateKeyEntry.class)).andReturn(false).times(1);
+        EasyMock.replay(keyStoreSpi);
+
+        ClientCertificate.getPrivateKeyAlias(keystore);
+    }
+
+    @Test(expectedExceptions = IllegalArgumentException.class, expectedExceptionsMessageRegExp = "more than one certificate alias found in input stream")
+    public void testMultiplePrivateKeyAliases() throws Exception {
+        EasyMock.expect(keyStoreSpi.engineAliases())
+                .andReturn(Collections.enumeration(Arrays.asList("private_key1", "private_key2", "CA_cert"))).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("private_key1", KeyStore.PrivateKeyEntry.class)).andReturn(true).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("private_key2", KeyStore.PrivateKeyEntry.class)).andReturn(true).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("CA_cert", KeyStore.PrivateKeyEntry.class)).andReturn(false).times(1);
+        EasyMock.replay(keyStoreSpi);
+
+        ClientCertificate.getPrivateKeyAlias(keystore);
+    }
+
+    @Test
+    public void testMultipleEntriesButOnlyOnePrivateKey() throws Exception {
+        EasyMock.expect(keyStoreSpi.engineAliases())
+                .andReturn(Collections.enumeration(Arrays.asList("CA_cert1", "private_key", "CA_cert2"))).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("CA_cert1", KeyStore.PrivateKeyEntry.class)).andReturn(false).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("private_key", KeyStore.PrivateKeyEntry.class)).andReturn(true).times(1);
+        EasyMock.expect(keyStoreSpi.engineEntryInstanceOf("CA_cert2", KeyStore.PrivateKeyEntry.class)).andReturn(false).times(1);
+        EasyMock.replay(keyStoreSpi);
+
+        String privateKeyAlias = ClientCertificate.getPrivateKeyAlias(keystore);
+        assertEquals("private_key", privateKeyAlias);
+    }
+
+}