Unobsolete GetAccountsAsync #4976
Conversation
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
| @@ -96,8 +96,6 @@ AcquireTokenByAuthorizationCodeParameterBuilder AcquireTokenByAuthorizationCode( | |||
| /// <summary> | |||
| /// Use <see cref="IClientApplicationBase.GetAccountAsync(string)"/> in web apps and web APIs, and use a token cache serializer for better security and performance. See https://aka.ms/msal-net-cca-token-cache-serialization. | |||
There was a problem hiding this comment.
Pls add a remark that this is only for use with ROPC
There was a problem hiding this comment.
we have no way to enforce that it's only used for ROPC in CCA, though
Are we sure that the cache is always partitioned?
There was a problem hiding this comment.
AFAIK the cache is always partitioned.
There was a problem hiding this comment.
It is partitioned. But please add a unit test (or update the integration test) @neha-bhargava, where you show that TokenCacheNotificationArgs has the correct SuggestedCacheKey.
There was a problem hiding this comment.
@neha-bhargava and I had a chat and concluded that AcquireTokenForUsernamePassword is partitioned, but GetAccounts() is not partitioned (and can't really be partitioned).
From MSAL perspective, we can ask ppl to use GetAccount(id).
For Id.Web, this gets a bit tricky.
There was a problem hiding this comment.
How would that work in MSAL? where do they get the id from? (assuming this is tid.oid?)?
There was a problem hiding this comment.
Proposing that CCA.AcquireTokenByUserPassword first checks the cache, and if not found or error, goes to ESTS.
Like OBO does.
|
@bgavrilMS @neha-bhargava - given that this is only for ROPC in CCA, no concerns on my part. This will effectively just list out the accounts in the cache? |
Yes, this will list the accounts in the cache. Only recommended for ROPC. |
Fixes #
Changes proposed in this request
Remove the obsolete attribute from the GetAccountsAsync method in the IConfidentialClientApplication interface to make it available for ROPC silent flow in Id web
Testing
Performance impact
Documentation