Graceful fallback when account does not exist in broker

Author: rayluo

msal/application.py

@@ -1234,16 +1234,17 @@ def _acquire_token_silent_from_cache_and_possibly_refresh_it(
                         claims=_merge_claims_challenge_and_capabilities(
                             self._client_capabilities, claims_challenge),
                         )
-                    if "error" not in response:
-                        self.token_cache.add(dict(
-                            client_id=self.client_id,
-                            scope=response["scope"].split() if "scope" in response else scopes,
-                            token_endpoint=self.authority.token_endpoint,
-                            response=response.copy(),
-                            data=kwargs.get("data", {}),
-                            _account_id=response["_account_id"],
-                            ))
-                    return _clean_up(response)
+                    if response:  # It means broker was able to provide a decisive outcome
+                        if "error" not in response:
+                            self.token_cache.add(dict(
+                                client_id=self.client_id,
+                                scope=response["scope"].split() if "scope" in response else scopes,
+                                token_endpoint=self.authority.token_endpoint,
+                                response=response.copy(),
+                                data=kwargs.get("data", {}),
+                                _account_id=response["_account_id"],
+                                ))
+                        return _clean_up(response)  # Then we use the broker's result
                 except ImportError:
                     logger.warning("PyMsalRuntime is not available")
             result = _clean_up(self._acquire_token_silent_by_finding_rt_belongs_to_me_or_my_family(

msal/wam.py

@@ -139,6 +139,8 @@ def _acquire_token_silently(authority, client_id, account_id, scopes, claims=Non
     error = account.get_error()
     if error:
         return _convert_error(error, client_id)
+    if not account.get_account():  # It happens when the account was not created by broker
+        return
     params = pymsalruntime.MSALRuntimeAuthParameters(client_id, authority)
     params.set_requested_scopes(scopes)
     if claims: