ropc

Author: rayluo

msal/application.py

@@ -470,6 +470,9 @@ def __init__(
                     self.http_client, validate_authority=False)
             else:
                 raise
+        self._enable_broker = (
+            isinstance(self, PublicClientApplication)  # Exclude Confidential ROPC
+            and sys.platform == "win32" and not self.authority.is_adfs)
 
         self.token_cache = token_cache or TokenCache()
         self._region_configured = azure_region
@@ -1221,7 +1224,8 @@ def _acquire_token_silent_from_cache_and_possibly_refresh_it(
             refresh_reason = msal.telemetry.FORCE_REFRESH  # TODO: It could also mean claims_challenge
         assert refresh_reason, "It should have been established at this point"
         try:
-            if sys.platform == "win32":
+            if self._enable_broker:  # If interactive flow or ROPC were not through broker,
+                    # the _acquire_token_silently() is unlikely to locate the account.
                 try:
                     from .wam import _acquire_token_silently
                     response = _acquire_token_silently(
@@ -1432,14 +1436,43 @@ def acquire_token_by_username_password(
             - A successful response would contain "access_token" key,
             - an error response would contain "error" and usually "error_description".
         """
+        claims = _merge_claims_challenge_and_capabilities(
+                self._client_capabilities, claims_challenge)
+        if self._enable_broker:
+            try:
+                from .wam import _signin_silently, RedirectUriError
+                response = _signin_silently(
+                    "https://{}/{}".format(self.authority.instance, self.authority.tenant),  # TODO: What about B2C?
+                    self.client_id,
+                    scopes,  # Decorated scopes won't work due to offline_access
+                    MSALRuntime_Username=username,
+                    MSALRuntime_Password=password,
+                    validateAuthority="no"
+                        if self.authority._validate_authority is False
+                        or self.authority.is_adfs
+                        else None,
+                    claims=claims,
+                    )
+                if "error" not in response:
+                    self.token_cache.add(dict(
+                        client_id=self.client_id,
+                        scope=response["scope"].split() if "scope" in response else scopes,
+                        token_endpoint=self.authority.token_endpoint,
+                        response=response.copy(),
+                        data=kwargs.get("data", {}),
+                        _account_id=response["_account_id"],
+                        ))
+                return _clean_up(response)
+            except ImportError:
+                logger.warning("PyMsalRuntime is not available")
+            except RedirectUriError as e:  # Experimental: Catch, log, and fallback
+                logger.warning(str(e) + " Now we fallback to use non-broker.")
+
         scopes = self._decorate_scope(scopes)
         telemetry_context = self._build_telemetry_context(
             self.ACQUIRE_TOKEN_BY_USERNAME_PASSWORD_ID)
         headers = telemetry_context.generate_headers()
-        data = dict(
-            kwargs.pop("data", {}),
-            claims=_merge_claims_challenge_and_capabilities(
-                self._client_capabilities, claims_challenge))
+        data = dict(kwargs.pop("data", {}), claims=claims)
         if not self.authority.is_adfs:
             user_realm_result = self.authority.user_realm_discovery(
                 username, correlation_id=headers[msal.telemetry.CLIENT_REQUEST_ID])
@@ -1586,7 +1619,7 @@ def acquire_token_interactive(
         """
         claims = _merge_claims_challenge_and_capabilities(
             self._client_capabilities, claims_challenge)
-        if sys.platform == "win32":
+        if self._enable_broker:
             try:
                 from .wam import _signin_interactively, RedirectUriError
                 if extra_scopes_to_consent:  # TODO: Not supported in WAM/Mid-tier

msal/wam.py

@@ -75,10 +75,13 @@ def _convert_result(result, client_id):  # Mimic an on-the-wire response from AA
     return return_value
 
 
-def _signin_silently(authority, client_id, scopes):
+def _signin_silently(authority, client_id, scopes, **kwargs):
     params = pymsalruntime.MSALRuntimeAuthParameters(client_id, authority)
     params.set_requested_scopes(scopes)
     callback_data = _CallbackData()
+    for k, v in kwargs.items():  # This can be used to support domain_hint, max_age, etc.
+        if v is not None:
+            params.set_additional_parameter(k, str(v))
     pymsalruntime.signin_silently(
         params,
         "correlation", # TODO