Specifying and validating nonce in auth code flow

[rayluo]

The nonce is a behavior defined in Open ID Connect.

This PR adds a nonce parameter into the get_authorization_request_url(..., nonce=...) so that it would be sent to Azure AD.

This PR also adds a nonce parameter into the acquire_token_by_authorization_code(..., nonce=...) so that this method will perform the nonce check on the returned id token, automatically. We test it here. By the way, validating nonce has been embedded in msal .net, although it happens implicitly when using public client application.

[henrik-me]

Suggestion, add functionality which combines the two steps into one?

[henrik-me]

    return self.client.obtain_token_by_authorization_code(

does this already do nonce validation?

---

Refers to: msal/application.py:332 in ea137ae. [](commit_id = ea137ae, deletion_comment = False)

[rayluo]

Thanks for the review!

Answering two high level questions here:

does this already do nonce validation?

   return self.client.obtain_token_by_authorization_code(

The answer is yes. In fact we changed unit test case this time and ran test to confirm that. This PR is mainly about the public API surface change.

Suggestion, add functionality which combines the two steps into one?

We will, but not in this PR. Combining the two steps is essentially the other task in backlog of "providing acquire_token_interactive()".

And the 3rd question is answered below, inline.

[abhidnya13]

Thanks @rayluo for the efforts 👍