@@ -1204,6 +1204,7 @@ def acquire_token_silent(
1204
1204
authority = None , # See get_authorization_request_url()
1205
1205
force_refresh = False , # type: Optional[boolean]
1206
1206
claims_challenge = None ,
1207
+ auth_scheme = None ,
1207
1208
** kwargs ):
1208
1209
"""Acquire an access token for given account, without user interaction.
1209
1210
@@ -1224,6 +1225,12 @@ def acquire_token_silent(
1224
1225
returned from the UserInfo Endpoint and/or in the ID Token and/or Access Token.
1225
1226
It is a string of a JSON object which contains lists of claims being requested from these locations.
1226
1227
1228
+ :param object auth_scheme:
1229
+ You can provide an ``msal.auth_scheme.PopAuthScheme`` object
1230
+ so that MSAL will get a Proof-of-Possession (POP) token for you.
1231
+
1232
+ New in version 1.21.0.
1233
+
1227
1234
:return:
1228
1235
- A dict containing no "error" key,
1229
1236
and typically contains an "access_token" key,
@@ -1232,7 +1239,7 @@ def acquire_token_silent(
1232
1239
"""
1233
1240
result = self .acquire_token_silent_with_error (
1234
1241
scopes , account , authority = authority , force_refresh = force_refresh ,
1235
- claims_challenge = claims_challenge , ** kwargs )
1242
+ claims_challenge = claims_challenge , auth_scheme = auth_scheme , ** kwargs )
1236
1243
return result if result and "error" not in result else None
1237
1244
1238
1245
def acquire_token_silent_with_error (
@@ -1242,6 +1249,7 @@ def acquire_token_silent_with_error(
1242
1249
authority = None , # See get_authorization_request_url()
1243
1250
force_refresh = False , # type: Optional[boolean]
1244
1251
claims_challenge = None ,
1252
+ auth_scheme = None ,
1245
1253
** kwargs ):
1246
1254
"""Acquire an access token for given account, without user interaction.
1247
1255
@@ -1267,6 +1275,12 @@ def acquire_token_silent_with_error(
1267
1275
in the form of a claims_challenge directive in the www-authenticate header to be
1268
1276
returned from the UserInfo Endpoint and/or in the ID Token and/or Access Token.
1269
1277
It is a string of a JSON object which contains lists of claims being requested from these locations.
1278
+ :param object auth_scheme:
1279
+ You can provide an ``msal.auth_scheme.PopAuthScheme`` object
1280
+ so that MSAL will get a Proof-of-Possession (POP) token for you.
1281
+
1282
+ New in version 1.21.0.
1283
+
1270
1284
:return:
1271
1285
- A dict containing no "error" key,
1272
1286
and typically contains an "access_token" key,
@@ -1288,6 +1302,7 @@ def acquire_token_silent_with_error(
1288
1302
scopes , account , self .authority , force_refresh = force_refresh ,
1289
1303
claims_challenge = claims_challenge ,
1290
1304
correlation_id = correlation_id ,
1305
+ auth_scheme = auth_scheme ,
1291
1306
** kwargs )
1292
1307
if result and "error" not in result :
1293
1308
return result
@@ -1310,6 +1325,7 @@ def acquire_token_silent_with_error(
1310
1325
scopes , account , the_authority , force_refresh = force_refresh ,
1311
1326
claims_challenge = claims_challenge ,
1312
1327
correlation_id = correlation_id ,
1328
+ auth_scheme = auth_scheme ,
1313
1329
** kwargs )
1314
1330
if result :
1315
1331
if "error" not in result :
@@ -1333,9 +1349,10 @@ def _acquire_token_silent_from_cache_and_possibly_refresh_it(
1333
1349
force_refresh = False , # type: Optional[boolean]
1334
1350
claims_challenge = None ,
1335
1351
correlation_id = None ,
1352
+ auth_scheme = None ,
1336
1353
** kwargs ):
1337
1354
access_token_from_cache = None
1338
- if not (force_refresh or claims_challenge ): # Bypass AT when desired or using claims
1355
+ if not (force_refresh or claims_challenge or auth_scheme ): # Then attempt AT cache
1339
1356
query = {
1340
1357
"client_id" : self .client_id ,
1341
1358
"environment" : authority .instance ,
@@ -1373,6 +1390,8 @@ def _acquire_token_silent_from_cache_and_possibly_refresh_it(
1373
1390
try :
1374
1391
data = kwargs .get ("data" , {})
1375
1392
if account and account .get ("authority_type" ) == _AUTHORITY_TYPE_CLOUDSHELL :
1393
+ if auth_scheme :
1394
+ raise ValueError ("auth_scheme is not supported in Cloud Shell" )
1376
1395
return self ._acquire_token_by_cloud_shell (scopes , data = data )
1377
1396
1378
1397
if self ._enable_broker and account is not None and data .get ("token_type" ) != "ssh-cert" :
@@ -1385,10 +1404,13 @@ def _acquire_token_silent_from_cache_and_possibly_refresh_it(
1385
1404
claims = _merge_claims_challenge_and_capabilities (
1386
1405
self ._client_capabilities , claims_challenge ),
1387
1406
correlation_id = correlation_id ,
1407
+ auth_scheme = auth_scheme ,
1388
1408
** data )
1389
1409
if response : # The broker provided a decisive outcome, so we use it
1390
1410
return self ._process_broker_response (response , scopes , data )
1391
1411
1412
+ if auth_scheme :
1413
+ raise ValueError ("auth_scheme is currently only available from broker" )
1392
1414
result = _clean_up (self ._acquire_token_silent_by_finding_rt_belongs_to_me_or_my_family (
1393
1415
authority , self ._decorate_scope (scopes ), account ,
1394
1416
refresh_reason = refresh_reason , claims_challenge = claims_challenge ,
@@ -1569,7 +1591,11 @@ def acquire_token_by_refresh_token(self, refresh_token, scopes, **kwargs):
1569
1591
return response
1570
1592
1571
1593
def acquire_token_by_username_password (
1572
- self , username , password , scopes , claims_challenge = None , ** kwargs ):
1594
+ self , username , password , scopes , claims_challenge = None ,
1595
+ # Note: We shouldn't need to surface enable_msa_passthrough,
1596
+ # because this ROPC won't work with MSA account anyway.
1597
+ auth_scheme = None ,
1598
+ ** kwargs ):
1573
1599
"""Gets a token for a given resource via user credentials.
1574
1600
1575
1601
See this page for constraints of Username Password Flow.
@@ -1585,6 +1611,12 @@ def acquire_token_by_username_password(
1585
1611
returned from the UserInfo Endpoint and/or in the ID Token and/or Access Token.
1586
1612
It is a string of a JSON object which contains lists of claims being requested from these locations.
1587
1613
1614
+ :param object auth_scheme:
1615
+ You can provide an ``msal.auth_scheme.PopAuthScheme`` object
1616
+ so that MSAL will get a Proof-of-Possession (POP) token for you.
1617
+
1618
+ New in version 1.21.0.
1619
+
1588
1620
:return: A dict representing the json response from AAD:
1589
1621
1590
1622
- A successful response would contain "access_token" key,
@@ -1604,9 +1636,12 @@ def acquire_token_by_username_password(
1604
1636
self .authority ._is_known_to_developer
1605
1637
or self ._instance_discovery is False ) else None ,
1606
1638
claims = claims ,
1639
+ auth_scheme = auth_scheme ,
1607
1640
)
1608
1641
return self ._process_broker_response (response , scopes , kwargs .get ("data" , {}))
1609
1642
1643
+ if auth_scheme :
1644
+ raise ValueError ("auth_scheme is currently only available from broker" )
1610
1645
scopes = self ._decorate_scope (scopes )
1611
1646
telemetry_context = self ._build_telemetry_context (
1612
1647
self .ACQUIRE_TOKEN_BY_USERNAME_PASSWORD_ID )
@@ -1698,6 +1733,7 @@ def acquire_token_interactive(
1698
1733
max_age = None ,
1699
1734
parent_window_handle = None ,
1700
1735
on_before_launching_ui = None ,
1736
+ auth_scheme = None ,
1701
1737
** kwargs ):
1702
1738
"""Acquire token interactively i.e. via a local browser.
1703
1739
@@ -1773,6 +1809,12 @@ def acquire_token_interactive(
1773
1809
1774
1810
New in version 1.20.0.
1775
1811
1812
+ :param object auth_scheme:
1813
+ You can provide an ``msal.auth_scheme.PopAuthScheme`` object
1814
+ so that MSAL will get a Proof-of-Possession (POP) token for you.
1815
+
1816
+ New in version 1.21.0.
1817
+
1776
1818
:return:
1777
1819
- A dict containing no "error" key,
1778
1820
and typically contains an "access_token" key.
@@ -1817,11 +1859,14 @@ def acquire_token_interactive(
1817
1859
claims ,
1818
1860
data ,
1819
1861
on_before_launching_ui ,
1862
+ auth_scheme ,
1820
1863
prompt = prompt ,
1821
1864
login_hint = login_hint ,
1822
1865
max_age = max_age ,
1823
1866
)
1824
1867
1868
+ if auth_scheme :
1869
+ raise ValueError ("auth_scheme is currently only available from broker" )
1825
1870
on_before_launching_ui (ui = "browser" )
1826
1871
telemetry_context = self ._build_telemetry_context (
1827
1872
self .ACQUIRE_TOKEN_INTERACTIVE )
@@ -1854,6 +1899,7 @@ def _acquire_token_interactive_via_broker(
1854
1899
claims , # type: str
1855
1900
data , # type: dict
1856
1901
on_before_launching_ui , # type: callable
1902
+ auth_scheme , # type: object
1857
1903
prompt = None ,
1858
1904
login_hint = None , # type: Optional[str]
1859
1905
max_age = None ,
@@ -1877,6 +1923,7 @@ def _acquire_token_interactive_via_broker(
1877
1923
accounts [0 ]["local_account_id" ],
1878
1924
scopes ,
1879
1925
claims = claims ,
1926
+ auth_scheme = auth_scheme ,
1880
1927
** data )
1881
1928
if response and "error" not in response :
1882
1929
return self ._process_broker_response (response , scopes , data )
@@ -1889,6 +1936,7 @@ def _acquire_token_interactive_via_broker(
1889
1936
claims = claims ,
1890
1937
max_age = max_age ,
1891
1938
enable_msa_pt = enable_msa_passthrough ,
1939
+ auth_scheme = auth_scheme ,
1892
1940
** data )
1893
1941
is_wrong_account = bool (
1894
1942
# _signin_silently() only gets tokens for default account,
@@ -1931,6 +1979,7 @@ def _acquire_token_interactive_via_broker(
1931
1979
claims = claims ,
1932
1980
max_age = max_age ,
1933
1981
enable_msa_pt = enable_msa_passthrough ,
1982
+ auth_scheme = auth_scheme ,
1934
1983
** data )
1935
1984
return self ._process_broker_response (response , scopes , data )
1936
1985
0 commit comments