AcquireTokenSilentIT.java

// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

package com.microsoft.aad.msal4j;

import com.microsoft.aad.msal4j.labapi.*;
import static com.microsoft.aad.msal4j.labapi.KeyVaultSecrets.*;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.TestInstance;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertThrows;

import java.net.MalformedURLException;
import java.util.*;
import java.util.concurrent.ExecutionException;

import static com.microsoft.aad.msal4j.TestConstants.KEYVAULT_DEFAULT_SCOPE;

@TestInstance(TestInstance.Lifecycle.PER_CLASS)
class AcquireTokenSilentIT {
    @Test
    void acquireTokenSilent_OrganizationAuthority_TokenRefreshed() throws Exception {
        // When using common, organization, or consumer tenants, cache has no way
        // of determining which access token to return therefore token is always refreshed
        IPublicClientApplication pca = getPublicClientApplicationWithTokensInCache();

        IAccount account = pca.getAccounts().join().iterator().next();
        IAuthenticationResult result = acquireTokenSilently(pca, account, TestConstants.GRAPH_DEFAULT_SCOPE, false);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);
    }

    @Test
    void acquireTokenSilent_LabAuthority_TokenNotRefreshed() throws Exception {
        // Access token should be returned from cache, and not using refresh token
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        IAuthenticationResult result = acquireTokenUsernamePassword(user, pca, TestConstants.GRAPH_DEFAULT_SCOPE);

        IAccount account = pca.getAccounts().join().iterator().next();
        IAuthenticationResult acquireSilentResult = acquireTokenSilently(pca, account, TestConstants.GRAPH_DEFAULT_SCOPE, false);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);

        // Check that access and id tokens are coming from cache
        assertEquals(result.accessToken(), acquireSilentResult.accessToken());
        assertEquals(result.idToken(), acquireSilentResult.idToken());
        assertEquals(TokenSource.IDENTITY_PROVIDER, result.metadata().tokenSource());
        assertEquals(TokenSource.CACHE, acquireSilentResult.metadata().tokenSource());
    }

    @Test
    void acquireTokenSilent_ForceRefresh() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        IAuthenticationResult result = acquireTokenUsernamePassword(user, pca, TestConstants.GRAPH_DEFAULT_SCOPE);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);

        IAccount account = pca.getAccounts().join().iterator().next();
        IAuthenticationResult resultAfterRefresh = acquireTokenSilently(pca, account, TestConstants.GRAPH_DEFAULT_SCOPE, true);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(resultAfterRefresh);

        // Check that new refresh and id tokens are being returned
        IntegrationTestHelper.assertTokensAreNotEqual(result, resultAfterRefresh);
        assertEquals(TokenSource.IDENTITY_PROVIDER, result.metadata().tokenSource());
        assertEquals(TokenSource.IDENTITY_PROVIDER, resultAfterRefresh.metadata().tokenSource());
    }

    @Test
    void acquireTokenSilent_usingOrganizationsAuthority_returnCachedAt() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        acquireTokenSilent_returnCachedTokens(app.getAppId(), TestConstants.ORGANIZATIONS_AUTHORITY, user);
    }

    @Test
    void acquireTokenSilent_usingTenantSpecificAuthority_returnCachedAt() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        acquireTokenSilent_returnCachedTokens(app.getAppId(), TestConstants.MICROSOFT_AUTHORITY_HOST + user.getTenantId(), user);
    }

    @Test
    void acquireTokenSilent_ConfidentialClient_acquireTokenSilent() throws Exception {
        IConfidentialClientApplication cca = getConfidentialClientApplications();
        //test that adding extra query parameters does not break the flow
        Map<String, String> extraParameters = new HashMap<>();
        extraParameters.put("test","test");
        IAuthenticationResult result = cca.acquireToken(ClientCredentialParameters
                .builder(Collections.singleton(TestConstants.GRAPH_DEFAULT_SCOPE))
                        .extraQueryParameters(extraParameters)
                .build())
                .get();

        IntegrationTestHelper.assertAccessTokenNotNull(result);

        String cachedAt = result.accessToken();

        result = cca.acquireTokenSilently(SilentParameters
                .builder(Collections.singleton(TestConstants.GRAPH_DEFAULT_SCOPE))
                        .extraQueryParameters(extraParameters)
                .build())
                .get();

        assertNotNull(result);
        assertEquals(result.accessToken(), cachedAt);
    }

    @Test
    void acquireTokenSilent_ConfidentialClient_acquireTokenSilentDifferentScopeThrowsException()
            throws Exception {

        IConfidentialClientApplication cca = getConfidentialClientApplications();

        IAuthenticationResult result = cca.acquireToken(ClientCredentialParameters
                .builder(Collections.singleton(KEYVAULT_DEFAULT_SCOPE))
                .build())
                .get();

        IntegrationTestHelper.assertAccessTokenNotNull(result);

        //Acquiring token for different scope, expect exception to be thrown
        assertThrows(ExecutionException.class, () -> cca.acquireTokenSilently(SilentParameters
                        .builder(Collections.singleton(TestConstants.GRAPH_DEFAULT_SCOPE))
                        .build())
                .get());
    }

    @Test
    void acquireTokenSilent_WithRefreshOn() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        IAuthenticationResult resultOriginal = acquireTokenUsernamePassword(user, pca, TestConstants.GRAPH_DEFAULT_SCOPE);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(resultOriginal);

        IAuthenticationResult resultSilent = acquireTokenSilently(pca, resultOriginal.account(), TestConstants.GRAPH_DEFAULT_SCOPE, false);
        assertNotNull(resultSilent);
        IntegrationTestHelper.assertTokensAreEqual(resultOriginal, resultSilent);

        //When this test was made, token responses did not contain the refresh_in field needed for an end-to-end test.
        //In order to test silent flow behavior as though the service returned refresh_in, we manually change a cached
        // token's refreshOn value from 0 (default if refresh_in missing) to a minute before/after the current time
        String key = pca.tokenCache.accessTokens.keySet().iterator().next();
        AccessTokenCacheEntity token = pca.tokenCache.accessTokens.get(key);
        long currTimestampSec = new Date().getTime() / 1000;

        token.refreshOn(Long.toString(currTimestampSec + 60));
        pca.tokenCache.accessTokens.put(key, token);

        IAuthenticationResult resultSilentWithRefreshOn = acquireTokenSilently(pca, resultOriginal.account(), TestConstants.GRAPH_DEFAULT_SCOPE, false);
        //Current time is before refreshOn, so token should not have been refreshed
        assertNotNull(resultSilentWithRefreshOn);
        assertEquals(pca.tokenCache.accessTokens.get(key).refreshOn(), Long.toString(currTimestampSec + 60));
        IntegrationTestHelper.assertTokensAreEqual(resultSilent, resultSilentWithRefreshOn);

        token = pca.tokenCache.accessTokens.get(key);
        token.refreshOn(Long.toString(currTimestampSec - 60));
        pca.tokenCache.accessTokens.put(key, token);

        resultSilentWithRefreshOn = acquireTokenSilently(pca, resultOriginal.account(), TestConstants.GRAPH_DEFAULT_SCOPE, false);
        //Current time is after refreshOn, so token should be refreshed
        assertNotNull(resultSilentWithRefreshOn);
        IntegrationTestHelper.assertTokensAreNotEqual(resultSilent, resultSilentWithRefreshOn);
        assertEquals(TokenSource.CACHE, resultSilent.metadata().tokenSource());
        assertEquals(TokenSource.IDENTITY_PROVIDER, resultSilentWithRefreshOn.metadata().tokenSource());
    }

    @Test
    void acquireTokenSilent_TenantAsParameter() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        IAuthenticationResult result = pca.acquireToken(UserNamePasswordParameters.
                builder(Collections.singleton(TestConstants.GRAPH_DEFAULT_SCOPE),
                        user.getUpn(),
                        user.getPassword().toCharArray())
                .build()).get();
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);

        IAccount account = pca.getAccounts().join().iterator().next();
        IAuthenticationResult silentResult = acquireTokenSilently(pca, account, TestConstants.GRAPH_DEFAULT_SCOPE, false);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(silentResult);
        IntegrationTestHelper.assertTokensAreEqual(result, silentResult);

        IAuthenticationResult resultWithTenantParam = pca.acquireTokenSilently(SilentParameters.
                builder(Collections.singleton(TestConstants.GRAPH_DEFAULT_SCOPE), account).
                    tenant(user.getTenantId()).
                build()).get();
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(resultWithTenantParam);
        IntegrationTestHelper.assertTokensAreNotEqual(result, resultWithTenantParam);
    }

    @Test
    void acquireTokenSilent_emptyStringScope() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        String emptyScope = StringHelper.EMPTY_STRING;
        IAuthenticationResult result = acquireTokenUsernamePassword(user, pca, emptyScope);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);

        IAccount account = pca.getAccounts().join().iterator().next();
        IAuthenticationResult silentResult = acquireTokenSilently(pca, account, emptyScope, false);
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(silentResult);
        assertEquals(result.accessToken(), silentResult.accessToken());
    }

    @Test
    void acquireTokenSilent_emptyScopeSet() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        Set<String> scopes = new HashSet<>();
        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        IAuthenticationResult result = pca.acquireToken(UserNamePasswordParameters.
                builder(scopes,
                        user.getUpn(),
                        user.getPassword().toCharArray())
                .build())
                .get();
        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);

        IAccount account = pca.getAccounts().join().iterator().next();
        IAuthenticationResult silentResult = pca.acquireTokenSilently(SilentParameters.
                builder(scopes, account)
                .build())
                .get();

        IntegrationTestHelper.assertAccessAndIdTokensNotNull(silentResult);
        assertEquals(result.accessToken(), silentResult.accessToken());
    }

    @Test
    public void acquireTokenSilent_ClaimsForceRefresh() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        Set<String> scopes = new HashSet<>();
        PublicClientApplication pca = PublicClientApplication.builder(
                        app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        IAuthenticationResult result = pca.acquireToken(UserNamePasswordParameters.
                        builder(scopes,
                                user.getUpn(),
                                user.getPassword().toCharArray())
                        .build())
                .get();

        IntegrationTestHelper.assertAccessAndIdTokensNotNull(result);

        IAuthenticationResult silentResultWithoutClaims = pca.acquireTokenSilently(SilentParameters.
                        builder(scopes, result.account())
                        .build())
                .get();

        IntegrationTestHelper.assertAccessAndIdTokensNotNull(silentResultWithoutClaims);
        assertEquals(result.accessToken(), silentResultWithoutClaims.accessToken());

        //If claims are added to a silent request, it should trigger the refresh flow and return a new token
        ClaimsRequest cr = new ClaimsRequest();
        cr.requestClaimInAccessToken("email", null);

        IAuthenticationResult silentResultWithClaims = pca.acquireTokenSilently(SilentParameters.
                        builder(scopes, result.account())
                        .claims(cr)
                        .build())
                .get();

        IntegrationTestHelper.assertAccessAndIdTokensNotNull(silentResultWithClaims);
        assertNotEquals(result.accessToken(), silentResultWithClaims.accessToken());
    }

    private IConfidentialClientApplication getConfidentialClientApplications() throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_WEBAPI);
        String password = KeyVaultRegistry.getMsalTeamProvider().getSecretByName(app.getClientSecret()).getValue();

        IClientCredential credential = ClientCredentialFactory.createFromSecret(password);

        return ConfidentialClientApplication.builder(
                app.getAppId(), credential).
                        authority(TestConstants.AUTHORITY_PUBLIC_TENANT_SPECIFIC).
                        build();
    }

    private void acquireTokenSilent_returnCachedTokens(String appId, String authority, UserConfig user) throws Exception {

        PublicClientApplication pca = PublicClientApplication.builder(
                        appId).
                authority(authority).
                build();

        IAuthenticationResult interactiveAuthResult = acquireTokenUsernamePassword(user, pca, TestConstants.GRAPH_DEFAULT_SCOPE);

        assertNotNull(interactiveAuthResult);

        IAuthenticationResult silentAuthResult = pca.acquireTokenSilently(
                SilentParameters.builder(
                        Collections.singleton(TestConstants.GRAPH_DEFAULT_SCOPE), interactiveAuthResult.account())
                        .build())
                .get();

        assertNotNull(silentAuthResult);
        assertEquals(interactiveAuthResult.accessToken(), silentAuthResult.accessToken());
    }

    private IPublicClientApplication getPublicClientApplicationWithTokensInCache()
            throws Exception {
        AppConfig app = LabResponseHelper.getAppConfig(APP_PCACLIENT);
        UserConfig user = LabResponseHelper.getUserConfig(USER_PUBLIC_CLOUD);

        PublicClientApplication pca = PublicClientApplication.builder(
                app.getAppId()).
                authority(TestConstants.ORGANIZATIONS_AUTHORITY).
                build();

        acquireTokenUsernamePassword(user, pca, TestConstants.GRAPH_DEFAULT_SCOPE);
        return pca;
    }

    private IAuthenticationResult acquireTokenSilently(IPublicClientApplication pca, IAccount account, String scope, Boolean forceRefresh) throws InterruptedException, ExecutionException, MalformedURLException {
        return pca.acquireTokenSilently(SilentParameters.
                builder(Collections.singleton(scope), account).
                forceRefresh(forceRefresh).
                build())
                .get();
    }

    private IAuthenticationResult acquireTokenUsernamePassword(UserConfig user, IPublicClientApplication pca, String scope) throws InterruptedException, ExecutionException {
        Map<String, String> map = new HashMap<>();
        map.put("test","test");
        return pca.acquireToken(UserNamePasswordParameters.
                builder(Collections.singleton(scope),
                        user.getUpn(),
                        user.getPassword().toCharArray())
                        .extraQueryParameters(map)
                .build())
                .get();
    }

}