From f70dca2b44d6171471cbe2bfc40ebc1fd1c09af5 Mon Sep 17 00:00:00 2001 From: Jean-Marc Prieur Date: Tue, 9 Sep 2025 13:36:07 -0700 Subject: [PATCH 1/4] Fixes #3470 Tested manually with a client secret. --- .../AgentUserIdentityMsalAddIn.cs | 3 +-- .../TokenAcquisition.cs | 7 ++++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs b/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs index f8bc1f935..75ed9c5ed 100644 --- a/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs +++ b/src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs @@ -70,8 +70,7 @@ internal static Task OnBeforeUserFicForAgentUserIdentityAsync( request.BodyParameters["grant_type"] = "user_fic"; request.BodyParameters.Remove("password"); - if (request.BodyParameters.TryGetValue("client_secret", out var secret) - && secret.Equals("default", StringComparison.OrdinalIgnoreCase)) + if (request.BodyParameters.TryGetValue("client_secret", out var secret)) { request.BodyParameters.Remove("client_secret"); } diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs index 8ada50622..1c65bf3ce 100644 --- a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs +++ b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs @@ -869,7 +869,12 @@ public async Task RemoveAccountAsync( private bool IsInvalidClientCertificateOrSignedAssertionError(MsalServiceException exMsal) { return !_retryClientCertificate && - string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase); + string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase) && + !exMsal.ResponseBody.Contains("AADSTS7000215" // ?No retry when wrong client secret. +#if NET6_0_OR_GREATER + , StringComparison.OrdinalIgnoreCase +#endif + ); } From 76fffa2c07a9a3e92bd8152a160ce41fe11f7739 Mon Sep 17 00:00:00 2001 From: Jean-Marc Prieur Date: Tue, 9 Sep 2025 13:39:01 -0700 Subject: [PATCH 2/4] Fixing typo --- src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs index 1c65bf3ce..2f371921e 100644 --- a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs +++ b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs @@ -870,7 +870,7 @@ private bool IsInvalidClientCertificateOrSignedAssertionError(MsalServiceExcepti { return !_retryClientCertificate && string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase) && - !exMsal.ResponseBody.Contains("AADSTS7000215" // ?No retry when wrong client secret. + !exMsal.ResponseBody.Contains("AADSTS7000215" // No retry when wrong client secret. #if NET6_0_OR_GREATER , StringComparison.OrdinalIgnoreCase #endif From 7ef6b20759c05aa85b7a36ceb8f5ea4b07a0522b Mon Sep 17 00:00:00 2001 From: Jean-Marc Prieur Date: Tue, 9 Sep 2025 13:55:03 -0700 Subject: [PATCH 3/4] Update Directory.Build.props --- Directory.Build.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Build.props b/Directory.Build.props index 66ead6dab..15e64a792 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -2,7 +2,7 @@ - 3.13.2 + 3.14.1 $(MicrosoftIdentityWebVersion) From 34391073f7406b7753da5e2f410aab4a00994f5c Mon Sep 17 00:00:00 2001 From: Jean-Marc Prieur Date: Tue, 9 Sep 2025 13:56:18 -0700 Subject: [PATCH 4/4] Update changelog for version 3.14.1 --- changelog.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changelog.md b/changelog.md index 68bf3ca0a..ef18e35e9 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,8 @@ +3.14.1 +======= +## Bug fix +- Support client secrets with agent user identities. See [#3470](https://github.com/AzureAD/microsoft-identity-web/issues/3470) for details. + 3.14.0 ======= ## New features