MsalClientException during AcquireTokenSilentAsync with forcerefresh true

---

name: Bug report about: MsalClientException during AcquireTokenSilentAsync with forcerefresh true

Which Version of MSAL are you using ? Note that to get help, you need to run the latest preview or non-preview version For ADAL, please log issues to https://github.com/AzureAD/azure-activedirectory-library-for-dotnet

v2.5.0-preview

Which platform has the issue?

net45

What authentication flow has the issue?

• Desktop
  • Interactive
  • Integrated Windows Auth
  • Username / Password
  • Device code flow (browserless)
• Mobile
  • Xamarin.iOS
  • Xamarin.Android
  • UWP
• Web App
  • Authorization code
  • OBO
• Web API
  • OBO
• Daemon App
  • Client credentials

Other? - please describe;

What is the identity provider ?

• Azure AD
• Azure AD B2C

If B2C, what social identity did you use?

Repro

public static async Task<AuthenticationResult> AcquireTokenWithPromptAsync(string resource, string tenant)
        {
            string authority = $"{ProductionAuthority}/{tenant}";
            string[] scopes = { resource + ".default" };
            string clientId = Client;
            var app = new PublicClientApplication(clientId: clientId, authority: authority, userTokenCache: TokenCacheHelper.GetUserCache());

            return await app.AcquireTokenAsync(scopes).ConfigureAwait(false);
        }

        public static async Task<AuthenticationResult> AcquireTokenSilentAsync(string resource, string tenant, string userId)
        {
            string authority = $"{ProductionAuthority}/{tenant}";
            string[] scopes = { resource + ".default" };
            string clientId = Client;
            AuthenticationResult result = null;
            var app = new PublicClientApplication(clientId: clientId, authority: authority, userTokenCache: TokenCacheHelper.GetUserCache());
            var account = await app.GetAccountAsync(userId).ConfigureAwait(false);
            result = await app.AcquireTokenSilentAsync(scopes, account, authority, true).ConfigureAwait(false);
            return result;
        }

var authResult = await AcquireTokenWithPromptAsync("https://management.azure.com", "Common");

// suppose the home tenantId for the user is foo and it is also part of another tenant with tenantId bar

// this call works and get a token for foo
var result = await AcquireTokenSilentAsync("https://graph.microsoft.com/", foo, authResult.Account.HomeAccountId.Identifier).ConfigureAwait(false);

// this one fails and throws an exception
var result = await AcquireTokenSilentAsync("https://graph.microsoft.com/", bar, authResult.Account.HomeAccountId.Identifier).ConfigureAwait(false);

Expected behavior A token for the requested tenant

Actual behavior An exception - Microsoft.Identity.Client.MsalClientException: The cache contains multiple tokens satisfying the requirements. Try to clear token cache at Microsoft.Identity.Client.TokenCache.FindAccessTokenCommon(AuthenticationRequestParameters requestParams, String preferredEnvironmentAlias, ISet`1 environmentAliases) at Microsoft.Identity.Client.TokenCache.<FindAccessTokenAsync>d__47.MoveNext()

If force refresh is set to false, then the call returns a token for the home tenant.

Possible Solution

Additional context/ Logs / Screenshots Add any other context about the problem here, such as logs and screebshots. Logging is described at https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/logging

[ferronsw]

@jennyf19 @jmprieur this problem does not occur in v3.0.4.

[jmprieur]

Thanks for confirming, @ferronsw