MSAL 1.4.0 was released, and is causing infinite redirection loop

[kumarunster]

Library

• msal@1.4.0
• @azure/msal-browser@2.x.x
• @azure/msal-angular@0.x.x
• @azure/msal-angular@1.x.x
• @azure/msal-angularjs@1.x.x

Framework

React

Description

We noticed an upgrade of msal to the version 1.4.0 today in our dev environment. It was released at the same day (25. Aug. 2020). The login with underlying msal library does not work anymore and is ending in infinite redirection loop to login.microsoft.com.

More, after short search on this project side I cannot find any migration guide or release note to the released version. Was this version released by accident? Could someone clarify?

For now we changed the version back to the latest 1.3.x and everything works fine.

Error Message

Security

• Is this issue security related?

Regression

• Did this behavior work before?
  Version:

MSAL Configuration

// Provide configuration values here.
// For Azure B2C issues, please include your policies.

Reproduction steps

// Provide relevant code snippets here.
// For Azure B2C issues, please include your policies.

Expected behavior

Browsers/Environment

• Chrome
• Firefox
• Edge
• Safari
• IE
• Other (Please add browser name here)

[hectormmg]

Hi @kumarunster . Can you please provide the following information:

1. Your MSAL configuration
2. Code snippets demonstrating your usage (specifically interested in usage of acquireTokenSilent and loginRedirect/acquireTokenRedirect)
3. Are there any errors from the browser console?
4. Logs from the MSAL Logger
5. Have you performed any debugging steps to determine why MSAL is looping?
6. Does this happen in all browsers, or just Chrome?
7. Are third-party cookies enabled in your browser?

The changelog can be found here.

[kumarunster]

Hi @Technical-Boy, thanks for your reply. We are using msal with react-aad-msal.

hereby our provider instantiation:

            authProvider = new MsalAuthProvider(
            {
              auth: {
                authority: authority,
                clientId: clientId,
                postLogoutRedirectUri: window.location.origin,
                redirectUri: redirectUri,
                validateAuthority: false,
                
                // After being redirected to the "redirectUri" page, should user
                // be redirected back to the Url where their login originated from?
                navigateToLoginRequestUrl: false
              },
              cache: {
                cacheLocation: 'localStorage',
                storeAuthStateInCookie: false,
              },
              system: {
                tokenRenewalOffsetSeconds: 600
              }
            },
            {
              scopes: scopes,
            },
            {
            loginType
            }
          );

the scopes we are using are
in AAD case: https://graph.microsoft.com/openid,https://graph.microsoft.com/profile
in B2C case: https://xyz.onmicrosoft.com/api/openid,https://xyz.onmicrosoft.com/api/profile

so far we did't any further debugging why exactly the loop is caused, we quickly reverted the version and everything is working again as expected.

[hectormmg]

Hi, @kumarunster, thanks for following up. Could you please use the MSAL Logger, reproduce the bug and send us the logs? Thanks.

[kumarunster]

here is the log file

localhost-1598434880293.log

seems something to be wrong with cached id token or/and with access to cached token by key. MSAL returns id token with access token as tokenType instead, although a correct id token exists in local storage multiple times. Hence this is the cause for infinite login loop. Could it be related to the changes in PR#2022? Could another method be used to determine the correctness of tokenType?

AuthCache.ts:
(see screenshot from local storage. Key is without scopes).

UserAgentApplication.ts#getCachedToken:

LocalStorage:

[hectormmg]

@kumarunster could you clarify if you're calling acquireTokenSilent with the scopes in the "https://graph.microsoft.com/openid" "https://graph.microsoft.com/profile" format? Does the loop still happen if you add the scopes as just "openid" and "profile"?

[kumarunster]

@Technical-Boy acquireTokenSilent is invoked inside react-aad-msal, with clientId as the only scope, see here. MSAL 1.4.0 replaces client id with list of default scopes. You can see the scopes in the log file I provided in my last comment:

....
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose-pii Serialized scopes: openid profile
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose Account set from MSAL Cache
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose Response type: id_token
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose Finished building server authentication request
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose Query parameters populated from existing SSO or account
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose GetCachedToken has been called
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose Getting all cached access tokens
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose No matching tokens found when filtered by clientId and account
VM2349 main.chunk.js:48523 MSAL: - Wed, 26 Aug 2020 09:11:49 GMT:1234-1.4.0-Verbose No token found in cache lookup
....

as explained before, the id token is correctly returned from server, but msal library is not able to find it in local storage.

[hectormmg]

Hey, @kumarunster. I can confirm this is in fact a bug in the acquireTokenSilent API. I'm working on fixing it. While we get it fixed, do you have a pressing reason to move to 1.4.0 or can you stay at 1.3.x in the meantime?

[kumarunster]

@Technical-Boy thanks for confirmation. yes we stay with 1.3.4.

[kumarunster]

Hello, @Technical-Boy, @tnorling any issues with PR #2206 ? It is two weeks already since the pr is hanging, is any further help required?

[hectormmg]

Hi @kumarunster . We're currently working on testing the changes in the PR, we'll let you know if we need more information. Thanks!

[hectormmg]

Closing since msal@1.4.1, which includes a fix for this issue, has been published. Please let us know if the issue persists after upgrading to msal@1.4.1.