MsalClientException during AcquireTokenSilentAsync with forcerefresh true
See original GitHub issuename: Bug report about: MsalClientException during AcquireTokenSilentAsync with forcerefresh true
Which Version of MSAL are you using ? Note that to get help, you need to run the latest preview or non-preview version For ADAL, please log issues to https://github.com/AzureAD/azure-activedirectory-library-for-dotnet
v2.5.0-preview
Which platform has the issue?
net45
What authentication flow has the issue?
- Desktop
- Interactive
- Integrated Windows Auth
- Username / Password
- Device code flow (browserless)
- Mobile
- Xamarin.iOS
- Xamarin.Android
- UWP
- Web App
- Authorization code
- OBO
- Web API
- OBO
- Daemon App
- Client credentials
Other? - please describe;
What is the identity provider ?
- Azure AD
- Azure AD B2C
If B2C, what social identity did you use?
Repro
public static async Task<AuthenticationResult> AcquireTokenWithPromptAsync(string resource, string tenant)
{
string authority = $"{ProductionAuthority}/{tenant}";
string[] scopes = { resource + ".default" };
string clientId = Client;
var app = new PublicClientApplication(clientId: clientId, authority: authority, userTokenCache: TokenCacheHelper.GetUserCache());
return await app.AcquireTokenAsync(scopes).ConfigureAwait(false);
}
public static async Task<AuthenticationResult> AcquireTokenSilentAsync(string resource, string tenant, string userId)
{
string authority = $"{ProductionAuthority}/{tenant}";
string[] scopes = { resource + ".default" };
string clientId = Client;
AuthenticationResult result = null;
var app = new PublicClientApplication(clientId: clientId, authority: authority, userTokenCache: TokenCacheHelper.GetUserCache());
var account = await app.GetAccountAsync(userId).ConfigureAwait(false);
result = await app.AcquireTokenSilentAsync(scopes, account, authority, true).ConfigureAwait(false);
return result;
}
var authResult = await AcquireTokenWithPromptAsync("https://management.azure.com", "Common");
// suppose the home tenantId for the user is foo and it is also part of another tenant with tenantId bar
// this call works and get a token for foo
var result = await AcquireTokenSilentAsync("https://graph.microsoft.com/", foo, authResult.Account.HomeAccountId.Identifier).ConfigureAwait(false);
// this one fails and throws an exception
var result = await AcquireTokenSilentAsync("https://graph.microsoft.com/", bar, authResult.Account.HomeAccountId.Identifier).ConfigureAwait(false);
Expected behavior A token for the requested tenant
Actual behavior An exception - Microsoft.Identity.Client.MsalClientException: The cache contains multiple tokens satisfying the requirements. Try to clear token cache at Microsoft.Identity.Client.TokenCache.FindAccessTokenCommon(AuthenticationRequestParameters requestParams, String preferredEnvironmentAlias, ISet`1 environmentAliases) at Microsoft.Identity.Client.TokenCache.<FindAccessTokenAsync>d__47.MoveNext()
If force refresh is set to false, then the call returns a token for the home tenant.
Possible Solution
Additional context/ Logs / Screenshots Add any other context about the problem here, such as logs and screebshots. Logging is described at https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/logging
Issue Analytics
- State:
- Created 5 years ago
- Comments:7 (2 by maintainers)
@jennyf19 @jmprieur this problem does not occur in v3.0.4.
Thanks for confirming, @ferronsw