Skip to content

Commit c5c5e08

Browse files
committed
Support ADFS (pending PyMsalRuntime's ADFS support)
Experimental welcome_template support for testing Adjust test cases to expect PyMsalRuntime failure on ADFS
1 parent c9cab4b commit c5c5e08

File tree

3 files changed

+23
-7
lines changed

3 files changed

+23
-7
lines changed

msal/application.py

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1589,10 +1589,16 @@ def acquire_token_interactive(
15891589
logger.warning(
15901590
"Ignoring parameter extra_scopes_to_consent, "
15911591
"which is not supported on current platform")
1592+
if "welcome_template" in kwargs:
1593+
logger.debug(kwargs["welcome_template"]) # Experimental
15921594
response = _signin_interactively(
1593-
"https://{}/{}".format(self.authority.instance, self.authority.tenant), # TODO: What about B2C & ADFS?
1595+
"https://{}/{}".format(self.authority.instance, self.authority.tenant), # TODO: What about B2C?
15941596
self.client_id,
15951597
scopes,
1598+
validateAuthority="no"
1599+
if self.authority._validate_authority is False
1600+
or self.authority.is_adfs
1601+
else None,
15961602
login_hint=login_hint,
15971603
prompt=prompt,
15981604
claims=claims,

msal/authority.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,8 @@ def __init__(self, authority_url, http_client, validate_authority=True):
7979
parts = authority.path.split('/')
8080
is_b2c = any(self.instance.endswith("." + d) for d in WELL_KNOWN_B2C_HOSTS) or (
8181
len(parts) == 3 and parts[2].lower().startswith("b2c_"))
82-
if (tenant != "adfs" and (not is_b2c) and validate_authority
82+
self._validate_authority = True if validate_authority is None else bool(validate_authority)
83+
if (tenant != "adfs" and (not is_b2c) and self._validate_authority
8384
and self.instance not in WELL_KNOWN_AUTHORITY_HOSTS):
8485
payload = instance_discovery(
8586
"https://{}{}/oauth2/v2.0/authorize".format(

tests/test_e2e.py

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ def assertCacheWorksForUser(
8686
self.assertNotEqual(0, len(accounts))
8787
account = accounts[0]
8888
if ("scope" not in result_from_wire # This is the usual case
89-
or # Authority server could reject some scopes
89+
or # Authority server could return different set of scopes
9090
set(scope) <= set(result_from_wire["scope"].split(" "))
9191
):
9292
# Going to test acquire_token_silent(...) to locate an AT from cache
@@ -115,7 +115,7 @@ def assertCacheWorksForUser(
115115
# result_from_wire['access_token'] != result_from_cache['access_token']
116116
# but ROPC in B2C tends to return the same AT we obtained seconds ago.
117117
# Now looking back, "refresh_token grant would return a brand new AT"
118-
# was just an empirical observation but never a committment in specs,
118+
# was just an empirical observation but never a commitment in specs,
119119
# so we adjust our way to assert here.
120120
(result_from_cache or {}).get("access_token"),
121121
"We should get an AT from acquire_token_silent(...) call")
@@ -683,9 +683,18 @@ def test_adfs2019_onprem_acquire_token_interactive(self):
683683
config["authority"] = "https://fs.%s.com/adfs" % config["lab_name"]
684684
config["scope"] = self.adfs2019_scopes
685685
config["port"] = 8080
686-
self._test_acquire_token_interactive(
687-
username_uri="https://msidlab.com/api/user?usertype=onprem&federationprovider=ADFSv2019",
688-
**config)
686+
username_uri = "https://msidlab.com/api/user?usertype=onprem&federationprovider=ADFSv2019"
687+
try:
688+
import pymsalruntime
689+
logger.warning("Absorbing an AssertionError because PyMsalRuntime does not yet support onprem ADFS")
690+
with self.assertRaises(AssertionError): # Expecting a failure because
691+
# PyMsalRuntime does not yet support on-prem ADFS.
692+
# But if this expectation is not met,
693+
# it would mean the latest PyMsalRuntime supports onprem ADFS.
694+
# At that time we would revert this patch.
695+
self._test_acquire_token_interactive(username_uri=username_uri, **config)
696+
except ImportError: # Then use browser-based interactive flow, which will work
697+
self._test_acquire_token_interactive(username_uri=username_uri, **config)
689698

690699
@unittest.skipUnless(
691700
os.getenv("LAB_OBO_CLIENT_SECRET"),

0 commit comments

Comments
 (0)