Always run MsalSilentBearerTokenProvider to provide cached and refreshed tokens #384
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously in ADAL AdalCacheBearerTokenProvider would be skipped if IsRetry was true, but rely on WindowsIntegratedAuthBearerTokenProvider to provide a cached token. In the MSAL variants, MsalSilentBearerTokenProvider would also be skipped if IsRetry was true, but in this case MsalWindowsIntegratedAuthBearerTokenProvider does not provide cached tokens, leading to a prompt.
In MSAL the AcquireTokenSilent calls obtain cached or refreshed tokens for both brokered and non-broker cases, and we should rely on the fact that this will always return a valid token. So MsalSilentBearerTokenProvider should always be run to provide cached tokens.
The context here is that we've seen some bad cases where NuGet clients are dropping or invalidating access tokens, getting Unauthorized (401) responses from external endpoints, then calling back into the credential provider for new tokens. These cases require both the token cache and/or silent authentication to be enabled otherwise users get constant prompts during package restore.