[Bug] "offline_access" "openid" scope causes token cache misses

Which Version of MSAL are you using ? Microsoft Identity 4.7.1

Platform Xamarin.Forms on iOS and Android

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)

Other? - AcquireTokenSilent

Is this a new or existing app? This is a new app.

Repro Login to AD B2C with email credentials. Create a loop that calls AcquireTokensSilent repeatedly. Notice that a new access token is returned every time, even though it is not close to expiring.

        public async Task<UserContext> AcquireAccessToken()
        {
            IEnumerable<IAccount> accounts = await PCA.GetAccountsAsync();

            AuthenticationResult authResult = await PCA.AcquireTokenSilent(_configuration.Scopes, GetAccountByPolicy(accounts, _configuration.PolicySignUpIn))
               .WithB2CAuthority(_configuration.AuthoritySignInUp)
               .ExecuteAsync();

            var newContext = UpdateUserInfo(authResult);

            AccessToken = newContext.AccessToken;
            Debug.WriteLine($"Access token is {newContext.AccessToken}");

            return newContext;
        }

Expected behavior I expected that the access token would be pulled from cache and not refreshed.

Actual behavior Access token is refreshed every time, even when it doesn’t need to be.

[henrik-me]

As per internal discussion seems like we have to improve the cache lookup filtering out OIDC scopes? I don’t think we should ask people to do anything we should be able to filter correctly and do appropriate cache lookup.

[bgavrilMS]

Yeah, I think this is the problem. MSAL requests offline_access but ESTS when it responds does not add offline_access to the response (mind you, it does give you a refresh token). This causes a problem in the token cache.

@jmprieur @henrik-me, @shoatman - I think we can make a small fix for this in MSAL, i.e. if the developer asks for offline_access, do not use this scope to look in the cache. Alternatively, we can ban people from explicitly asking for offline_access, but that is more intrusive.