Implemented functionality to skip the cache for MI when claims are provided

change/@azure-msal-common-e4f59bc0-0846-4b3a-a6bd-b8a4829c5bff.json

@@ -0,0 +1,7 @@
+{
+  "type": "minor",
+  "comment": "Implemented functionality to skip the cache for MI when claims are provided #7207",
+  "packageName": "@azure/msal-common",
+  "email": "[email protected]",
+  "dependentChangeType": "patch"
+}

change/@azure-msal-node-61f7f536-1cf8-4eef-ac92-89902d8e6963.json

@@ -0,0 +1,7 @@
+{
+  "type": "minor",
+  "comment": "Implemented functionality to skip the cache for MI when claims are provided #7207",
+  "packageName": "@azure/msal-node",
+  "email": "[email protected]",
+  "dependentChangeType": "patch"
+}

lib/msal-common/apiReview/msal-common.api.md

@@ -1073,6 +1073,7 @@ export type ClientAssertionCallback = (config: ClientAssertionConfig) => Promise
 export type ClientAssertionConfig = {
     clientId: string;
     tokenEndpoint?: string;
+    claims?: string;
 };
 
 declare namespace ClientAssertionUtils {
@@ -1996,7 +1997,7 @@ function generateCredentialKey(credentialEntity: CredentialEntity): string;
 // Warning: (ae-missing-release-tag) "getClientAssertion" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export function getClientAssertion(clientAssertion: string | ClientAssertionCallback, clientId: string, tokenEndpoint?: string): Promise<string>;
+export function getClientAssertion(clientAssertion: string | ClientAssertionCallback, clientId: string, tokenEndpoint?: string, claims?: string): Promise<string>;
 
 // Warning: (ae-missing-release-tag) "getDeserializedResponse" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //

lib/msal-common/src/account/ClientCredentials.ts

@@ -6,6 +6,7 @@
 export type ClientAssertionConfig = {
     clientId: string;
     tokenEndpoint?: string;
+    claims?: string;
 };
 
 export type ClientAssertionCallback = (

lib/msal-common/src/utils/ClientAssertionUtils.ts

@@ -11,14 +11,16 @@ import {
 export async function getClientAssertion(
     clientAssertion: string | ClientAssertionCallback,
     clientId: string,
-    tokenEndpoint?: string
+    tokenEndpoint?: string,
+    claims?: string
 ): Promise<string> {
     if (typeof clientAssertion === "string") {
         return clientAssertion;
     } else {
         const config: ClientAssertionConfig = {
             clientId: clientId,
             tokenEndpoint: tokenEndpoint,
+            claims: claims,
         };
         return clientAssertion(config);
     }

lib/msal-node/apiReview/msal-node.api.md

@@ -449,6 +449,7 @@ export type ManagedIdentityIdParams = {
 //
 // @public
 export type ManagedIdentityRequestParams = {
+    claims?: string;
     forceRefresh?: boolean;
     resource: string;
 };

lib/msal-node/src/client/ManagedIdentityApplication.ts

@@ -130,6 +130,7 @@ export class ManagedIdentityApplication {
         }
 
         const managedIdentityRequest: ManagedIdentityRequest = {
+            claims: managedIdentityRequestParams.claims,
             forceRefresh: managedIdentityRequestParams.forceRefresh,
             resource: managedIdentityRequestParams.resource.replace(
                 "/.default",
@@ -142,7 +143,10 @@ export class ManagedIdentityApplication {
             correlationId: this.cryptoProvider.createNewGuid(),
         };
 
-        if (managedIdentityRequest.forceRefresh) {
+        if (
+            managedIdentityRequest.claims ||
+            managedIdentityRequest.forceRefresh
+        ) {
             // make a network call to the managed identity source
             return this.managedIdentityClient.sendManagedIdentityTokenRequest(
                 managedIdentityRequest,

lib/msal-node/src/client/ManagedIdentitySources/BaseManagedIdentitySource.ts

@@ -19,6 +19,7 @@ import {
     createClientAuthError,
     AuthenticationResult,
     UrlString,
+    AADServerParamKeys,
 } from "@azure/msal-common";
 import { ManagedIdentityId } from "../../config/ManagedIdentityId";
 import { ManagedIdentityRequestParameters } from "../../config/ManagedIdentityRequestParameters";
@@ -138,6 +139,11 @@ export abstract class BaseManagedIdentitySource {
 
         const networkRequestOptions: NetworkRequestOptions = { headers };
 
+        if (managedIdentityRequest.claims) {
+            networkRequest.bodyParameters[AADServerParamKeys.CLAIMS] =
+                encodeURIComponent(managedIdentityRequest.claims);
+        }
+
         if (Object.keys(networkRequest.bodyParameters).length) {
             networkRequestOptions.body =
                 networkRequest.computeParametersBodyString();

lib/msal-node/src/request/ManagedIdentityRequestParams.ts

@@ -5,10 +5,12 @@
 
 /**
  * ManagedIdentityRequest
+ * - claims       - a stringified claims request which will be added to all /authorize and /token calls
  * - forceRefresh - forces managed identity requests to skip the cache and make network calls if true
- * - resource  - resource requested to access the protected API. It should be of the form "{ResourceIdUri}" or {ResourceIdUri/.default}. For instance https://management.azure.net or, for Microsoft Graph, https://graph.microsoft.com/.default
+ * - resource     - resource requested to access the protected API. It should be of the form "{ResourceIdUri}" or {ResourceIdUri/.default}. For instance https://management.azure.net or, for Microsoft Graph, https://graph.microsoft.com/.default
  */
 export type ManagedIdentityRequestParams = {
+    claims?: string;
     forceRefresh?: boolean;
     resource: string;
 };

lib/msal-node/test/client/ManagedIdentitySources/Imds.spec.ts

@@ -14,6 +14,7 @@ import {
     MANAGED_IDENTITY_RESOURCE_ID,
     MANAGED_IDENTITY_RESOURCE_ID_2,
     MANAGED_IDENTITY_TOKEN_RETRIEVAL_ERROR_MESSAGE,
+    TEST_CONFIG,
     THREE_SECONDS_IN_MILLI,
     getCacheKey,
 } from "../../test_kit/StringConstants";
@@ -31,6 +32,7 @@ import {
     ManagedIdentitySourceNames,
 } from "../../../src/utils/Constants";
 import {
+    AADServerParamKeys,
     AccessTokenEntity,
     AuthenticationResult,
     CacheHelpers,
@@ -548,6 +550,51 @@ describe("Acquires a token successfully via an IMDS Managed Identity", () => {
             );
         });
 
+        test("ignores a cached token when claims are provided", async () => {
+            const sendGetRequestAsyncSpy: jest.SpyInstance = jest.spyOn(
+                networkClient,
+                <any>"sendGetRequestAsync"
+            );
+
+            let networkManagedIdentityResult: AuthenticationResult =
+                await systemAssignedManagedIdentityApplication.acquireToken({
+                    resource: MANAGED_IDENTITY_RESOURCE,
+                });
+            expect(networkManagedIdentityResult.fromCache).toBe(false);
+
+            expect(networkManagedIdentityResult.accessToken).toEqual(
+                DEFAULT_SYSTEM_ASSIGNED_MANAGED_IDENTITY_AUTHENTICATION_RESULT.accessToken
+            );
+
+            const cachedManagedIdentityResult: AuthenticationResult =
+                await systemAssignedManagedIdentityApplication.acquireToken({
+                    resource: MANAGED_IDENTITY_RESOURCE,
+                });
+            expect(cachedManagedIdentityResult.fromCache).toBe(true);
+            expect(cachedManagedIdentityResult.accessToken).toEqual(
+                DEFAULT_SYSTEM_ASSIGNED_MANAGED_IDENTITY_AUTHENTICATION_RESULT.accessToken
+            );
+
+            networkManagedIdentityResult =
+                await systemAssignedManagedIdentityApplication.acquireToken({
+                    claims: TEST_CONFIG.CLAIMS,
+                    resource: MANAGED_IDENTITY_RESOURCE,
+                });
+            expect(networkManagedIdentityResult.fromCache).toBe(false);
+
+            expect(
+                sendGetRequestAsyncSpy.mock.lastCall[1].body.includes(
+                    `${AADServerParamKeys.CLAIMS}=${encodeURIComponent(
+                        TEST_CONFIG.CLAIMS
+                    )}`
+                )
+            ).toBe(true);
+
+            expect(networkManagedIdentityResult.accessToken).toEqual(
+                DEFAULT_SYSTEM_ASSIGNED_MANAGED_IDENTITY_AUTHENTICATION_RESULT.accessToken
+            );
+        });
+
         test("ignores a cached token when forceRefresh is set to true", async () => {
             let networkManagedIdentityResult: AuthenticationResult =
                 await systemAssignedManagedIdentityApplication.acquireToken({