[Bug] App Gets stuck in "Client Request Loop" due to User.ReadBasic.All scope

Logs and Network traces I will work on getting logs.

Which Version of MSAL are you using ? MSAL 4.18 works without issue, but upgrading beyond 4.18 causes this exception loop to occur.

Platform UWP

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)

Other? - please describe;

Is this a new or existing app? The app (Ink Calendar) is in production, I haven’t upgraded MSAL, but started seeing this issue when upgrading beyond 4.18

Repro

try
{
    authResult = await PublicClientApp.AcquireTokenSilent(scopes, firstAccount)
                                                     .ExecuteAsync();
}
catch (MsalUiRequiredException ex)
{
    Debug.WriteLine($"MsalUiRequiredException: {ex.Message}");

    // This is where the looping failure occurs: ↓
    authResult = await PublicClientApp.AcquireTokenInteractive(scopes)
                                                  .ExecuteAsync()
                                                  .ConfigureAwait(false);
}
return authResult.AccessToken;

Expected behavior I expect versions beyond 4.18 to work as well as 4.18 does.

Actual behavior When the app tries to upload the ink file which is being saved there is an exception thrown “the file is in use by another process” then stops and tries again later. When upgrading MSAL beyond 4.18 this exception throws the MS Graph identity into a loop which asks the user to login again, over and over and over. Closing the app is the only way to stop the loop.

Possible Solution Stay on 4.18

[bgavrilMS]

That makes sense. I don’t know the Graph API that well, but generally the delegated scopes that end in “.All” probably don’t work with Microsoft users. AAD will not issue you a token that allows you to read the basic info of all Microsoft users 😃

I’m just wondering how we can change MSAL to showcase this, the current experience, where you get looping errors, is bad - it’s bad for you because you only discover it late and is bad for AAD because you inadvertently hammer it with requests.

[bgavrilMS]

@TheJoeFin - I added more logging to MSAL and produced a package. Please note that the package is signed by Microsoft.

Microsoft.Identity.Client.4.25.1-internal.nupkg.zip