Sample for ms-identity-aspnet-webapp-openidconnect-master throws exception on AcquireTokenSilent

I ran your sample app and replaced the values for ida:ClientId, ida:ClientSecret and the Authority with values from my Azure Active Directory Tenant. I registered an application within my tenant and set API permissions as shown in the image below

Authentication for the application is setup as shown in the image below

I get logged in successfully but when I press the Send Email link I notice that the call to app.AcquireTokenSilent always throws and exception. The exception is thrown because the call to await app.GetAccountAsync(ClaimsPrincipal.Current.GetAccountId()); always returns null.

See the partial code on the HomeController.cs below

        [Authorize]
	[HttpGet]
        public async Task<ActionResult> SendMail()
        {
            // Before we render the send email screen, we use the incremental consent to obtain and cache the access token with the correct scopes
            IConfidentialClientApplication app = await MsalAppBuilder.BuildConfidentialClientApplication();
            AuthenticationResult result = null;
            var account = await app.GetAccountAsync(ClaimsPrincipal.Current.GetAccountId());
            string[] scopes = { "Mail.Send" };

            try
            {
				// try to get an already cached token
				result = await app.AcquireTokenSilent(scopes, account).ExecuteAsync().ConfigureAwait(false);
            }

My assumption was that this sample would show that MSAL would have cached any of the tokens necessary for the call and that the call to GetAccountAsync would not return null. The Active Directory Tenant is not verified so the user login ends with onmicrosoft.com

I am seeing the same behavior in my ASP.NET MVC application using your code so I wondered if I am missing something?

[bmukes]

OK if a picture is worth a 1,000 words then code is worth 10,000 I have uploaded sample code to the github repository in the link below so that you can see my problems. To use the code

• Create an AAD Application in an AAD verified Tenant
• Add a user of member type Member to the AAD application
• Add a user of member type Guest to the AAD application. This guest should be from a different verified Tenant
• Set the AAD application to single tenant
• Set the redirect uri’s in the AAD application to https://localhost:44388/signin-oidc
• Set a client secret in the in the AAD application
• Modify the web.config app settings in the ASP.NET code to the AAD client id, client secret, tenant id
• configure the API permissions in the AAD application as shown in the image below:

At this point you should be able to do OIDC Authorization grant with the sample code. I have added Debug.WriteLine statements in the Startup.Auth.cs (line 95) and HomeController.cs (lines 17 - 27)

What you will observe in your output window.

• In Startup.Auth.cs you will see that one item is being cached and and you will see the IAccount.HomeAccountId displayed in the output window
• in HomeController.cs you will see that no IAccount instances will ever be returned.

GitHub of ASP.NET project using MSAL

[seannybgoode]

I’m experiencing a related issue. I don’t think this has anything to do with guest accounts, I think there are just some use-cases where GetAccount is returning null. GetAccounts will return a collection with a single account, but GetAccount will return null. Using MSAL 4.40.

I think the bug below has possibly been reintroduced. It should throw an exception rather than inexplicably return null, if this is as-designed behavior.

Possible related to the now closed #2141 issue there.