Skip to content

Use tenant id for building the cache key. Right now the cache key used is using tenant as common, but should be managed-identity #710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
neha-bhargava opened this issue Sep 14, 2023 · 2 comments · Fixed by #746
Assignees
Labels
Enhancement A request or suggestion to improve some aspect of the library

Comments

@neha-bhargava
Copy link
Collaborator

neha-bhargava commented Sep 14, 2023

The cache key for managed identity should be same for MSAL.Net and MSAL Java.

Currently, the difference between the cache key is the tenant.
Cache key in MSAL.Net: -login.microsoftonline.com-accesstoken-system_assigned_managed_identity-managed_identity-https://management.azure.com
Cache key in MSAL Java: -login.microsoftonline.com-accesstoken-system_assigned_managed_identity-common-https://management.azure.com

The format of the cache key: --accesstoken---

Since the authority is not used in case of managed identity, the default authority is used for managed identity. But also after adding managed-identity as tenant the common tenant id is used for cache key.

MSAL.Net follows this algorithm to get the tenant.

We can either implement this algorithm or modify the default authority for managed identity.

Preference to have consistency with MSAL.Net and have the same logic to use the tenant id unless there is a concern.

@Avery-Dunn Avery-Dunn added the Enhancement A request or suggestion to improve some aspect of the library label Sep 18, 2023
@bgavrilMS
Copy link
Member

@neha-bhargava - the 2 cache keys you described seem to be identical.

The algorithm you describe is pretty complex because it takes into consideration user scenarios. But in app scenario, there are only:

  • authority specified at app level
  • authority or tenant specified at request level (which wins)

Are you saying that MSAL Java does not correctly resolve the tenant id in client_credentials scenarios?

@Avery-Dunn
Copy link
Collaborator

This was resolved in #746 and released as part of 1.14.4-beta

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Enhancement A request or suggestion to improve some aspect of the library
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants