[Bug] Token acquisition from different tenant not working

Which version of Microsoft Identity Web are you using? Commit ID 8a043b704a4ad89faaa635451ee7fc6d85979bf9 , but the same problem experienced also with -master dated 2020-07-21.

Where is the issue?

• Web API
  • Protected web APIs call downstream web APIs

Is this a new or an existing app? The app is in production and I have upgraded to a new version of Microsoft Identity Web.

Repro

            var tokenAcquisition = httpContext.RequestServices.GetRequiredService<Microsoft.Identity.Web.ITokenAcquisition>();
            var tid = httpContext.User.FindFirst("tid").Value;
            return tokenAcquisition.GetAccessTokenForUserAsync(new string[] { scope }, tid);

Expected behavior Token issued by tenant B.

Actual behavior When user in tenant A is a guest user in tenant B (identified by “tid”), this call returns a token issued by tenant A instead of token issued by tenant B (“tid”).

Possible solution Please see the attached patch. This is the same bug I previously reported for an older version.

TokenAcquisition.cs.txt

[jennyf19]

This issue is fixed in microsoft identity web, but there is an additional fix needed in msal .net, so moving this to blocked for now. That work will be in progress soon.

[jennyf19]

Included in 0.2.2-preview release