[Bug] The JSON value could not be converted to System.Int64. ROPC flow

Logs and network traces

System.Text.Json.JsonException
The JSON value could not be converted to System.Int64. Path: $.expires_in | LineNumber: 0 | BytePositionInLine: 1332.
   at System.Text.Json.ThrowHelper.ReThrowWithPath(ReadStack& state, Utf8JsonReader& reader, Exception ex)
   at System.Text.Json.Serialization.JsonConverter`1.ReadCore(Utf8JsonReader& reader, JsonSerializerOptions options, ReadStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.ReadCoreAsObject(Utf8JsonReader& reader, JsonSerializerOptions options, ReadStack& state)
   at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 utf8Json, JsonTypeInfo jsonTypeInfo, Nullable`1 actualByteCount)
   at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 json, JsonTypeInfo jsonTypeInfo)
   at System.Text.Json.JsonSerializer.Deserialize(String json, Type returnType, JsonSerializerContext context)
   at Microsoft.Identity.Client.Utils.JsonHelper.DeserializeFromJson[T](String json)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func`2 onBeforePostRequestHandler)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
   at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.GetTokenResponseAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByUsernamePasswordParameters usernamePasswordParameters, CancellationToken cancellationToken)

Which version of MSAL.NET are you using? MSAL.NET 4.49.x, 4.48.x - Problem Works in 4.47.2 - No Issues

Platform .Net 7.0, .Net 6.0 (.Net 4.8 not tested)

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Authentication
  • Username Password
  • Device code flow (browserless)
• Web app
  • Authorization code
  • On-Behalf-Of
• Daemon app
  • Service to Service calls

Other?

Is this a new or existing app? a. The app is in production, and I have upgraded to a new version of MSAL. –>

Repro

                    var publicClientBuilder = PublicClientApplicationBuilder.CreateWithApplicationOptions(options);
                    publicClientBuilder.WithB2CAuthority('MY AUTHORITY');
                    var publicClient = publicClientBuilder.Build();
                    
                    // Gives exception only after upgrade to 4.48+
                    var result = await publicClient.AcquireTokenByUsernamePassword(
                            new string[]{'MyScopes1', 'MyScope2'},
                            'MyUserName',
                            password)
                        .ExecuteAsync().ConfigureAwait(false);

Some guess about the issue:

Probably something went wrong when STJ deseriailzer Source Generator ignored the settings that are defined here:

Azure AD B2C returns expires_in field as a string 😦 https://learn.microsoft.com/en-us/answers/questions/877384/azure-active-directory-b2c-authorization-code-flow.html

[trwalke]

opened bug on .NET 7 repo https://github.com/dotnet/runtime/issues/80634

[trwalke]

I can confirm with my testing that targeting .NET 7 causes this issue. Targeting .NET 6 seems to resolve it with the latest version of MSAL so targeting 6.0.7 seems to be a temporary work around