WwwAuthenticateParameters fails to create response from headers

[Trimack]

The WWWAuthenticate helper fails for

Bearer authorization_uri=https://login.microsoftonline.com/12345678-268e-46c2-8d30-1ad8ad2cd49d/oauth2/authorize, resource_id=https://testingorg0127.crm10.dynamics.com/

There seem to be 2 problems:

1. MSAL does not know how to parse authorization_uri property
2. The WWWAUtheticate collection has 1 element, but .Any() returns false

For more details please see here

[bgavrilMS]

Hi @Trimack - can you please provide an example header that this helper fails on? We do have some unit tests around it, and even integration tests, so I find it hard to believe that it will always fail.

[Trimack]

I just did in what I believe to be a related issue in #3027 (comment).

I honestly do not understand why this doesn't work and how is the property supposed to work but here's a screenshot from the VS:

[bgavrilMS]

Is there a public URI I can access to get this 401 + authenticate header?

[Trimack]

An example URI is https://mktcxptip11111810sg891crm08.crm10.dynamics.com/api/data/v9.1.

[trwalke]

So I am able to reproduce this and it Looks like there are some additional configurations that are needed in order for us ot access the data in this header. Not sure why it is different for this endpoint.

This looks like something along the lines of what we need but not 100% sure yet:
https://stackoverflow.com/questions/52333446/core-2-1-refuses-to-respond-with-access-control-expose-headers

Looks like similar things happen in other languages as well
https://stackoverflow.com/questions/61357247/why-is-the-www-authenticate-header-missing-from-when-i-call-api-from-react-app
Based on what I am seeing here, we need the .NET equivalent of "Access-Control-Expose-Headers"

Still investigating

[alvin-h]

Will a fix for this be prioritized?

I've tried using CreateFromResourceResponseAsync() to which all properties I need (Authority, Resource) returns null.

Manually using a GET request with HttpClient to the resourceUri and passing in the HttpResponseHeaders object from that into CreateFromResponseHeaders() also returns null.

Manually passing in the WWW-Authenticate header value as a string into CreateFromWwwAuthenticateHeaderValue() also returns null.

This is how the header string looks like:
Bearer authorization_uri=https://login.microsoftonline.com/<our-tenant-id>/oauth2/authorize, resource_id=https://<our-api-domain>/

[bgavrilMS]

Yes, you are right @alvin-h , this is important.

[bgavrilMS]

@trwalke - aren't you working on this?