Fix duplicate logging of MsalUiRequiredException

MsalUiRequiredException is already logged by MSAL.NET internally, so
re-logging it via Logger.TokenAcquisitionError in TokenAcquisition.cs
produced a duplicate log entry for every exception. Removed the
redundant logging in the two catch blocks that only rethrow/wrap the
exception.

Fixes #3528

Author: armin-azar

src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

@@ -387,8 +387,7 @@ private async Task<AuthenticationResult> GetAuthenticationResultForUserInternalA
             catch (MsalUiRequiredException ex)
             {
                 // GetAccessTokenForUserAsync is an abstraction that can be called from a web app or a web API
-                Logger.TokenAcquisitionError(_logger, ex.Message, ex);
-
+                // MsalUiRequiredException is already logged by MSAL. Re-logging here would produce duplicates.
                 // Case of the web app: we let the MsalUiRequiredException be caught by the
                 // AuthorizeForScopesAttribute exception filter so that the user can consent, do 2FA, etc ...
                 throw new MicrosoftIdentityWebChallengeUserException(ex, scopes.ToArray(), userFlow);
@@ -1426,12 +1425,9 @@ private void NotifyCertificateSelection(
 
                 return null;
             }
-            catch (MsalUiRequiredException ex)
+            catch (MsalUiRequiredException)
             {
-                Logger.TokenAcquisitionError(
-                    _logger,
-                    LogMessages.ErrorAcquiringTokenForDownstreamWebApi + ex.Message,
-                    ex);
+                // MsalUiRequiredException is already logged by MSAL. Re-logging here would produce duplicates.
                 throw;
             }
         }

tests/Microsoft.Identity.Web.Test/TokenAcquisitionTests.cs

@@ -4,15 +4,18 @@
 using System;
 using System.Collections.Generic;
 using System.Net.Http;
+using System.Security.Claims;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Microsoft.Identity.Abstractions;
 using Microsoft.Identity.Client;
 using Microsoft.Identity.Web.Extensibility;
 using Microsoft.Identity.Web.Test.Common;
 using Microsoft.Identity.Web.Test.Common.Mocks;
 using Microsoft.Identity.Web.TestOnly;
+using NSubstitute;
 using Xunit;
 
 
@@ -160,6 +163,44 @@ public async Task ExtraBodyParametersAreSentToEndpointTest()
             Assert.Equal("Bearer header.payload.signature", result);
         }
 
+        /// <summary>
+        /// Tests that a caught <see cref="MsalUiRequiredException"/> is not re-logged by Microsoft.Identity.Web,
+        /// since MSAL.NET already logs it. Re-logging produced duplicate log entries.
+        /// This addresses issue #3528.
+        /// </summary>
+        [Fact]
+        public async Task GetAuthenticationResultForUserAsync_DoesNotDuplicateLog_WhenMsalUiRequiredExceptionIsThrown()
+        {
+            // Arrange
+            var tokenAcquirerFactory = InitTokenAcquirerFactory();
+
+            var innerLogger = Substitute.For<ILogger<TokenAcquisition>>();
+            innerLogger.IsEnabled(Arg.Any<Microsoft.Extensions.Logging.LogLevel>()).Returns(true);
+            tokenAcquirerFactory.Services.AddSingleton<ILogger<TokenAcquisition>>(
+                new LoggerMock<TokenAcquisition>(innerLogger));
+
+            IServiceProvider serviceProvider = tokenAcquirerFactory.Build();
+            IAuthorizationHeaderProvider authorizationHeaderProvider = serviceProvider.GetRequiredService<IAuthorizationHeaderProvider>();
+
+            // No account/login-hint claims, so MSAL's AcquireTokenSilent throws MsalUiRequiredException
+            // synchronously (the exact scenario reported in issue #3528).
+            var user = new ClaimsPrincipal(new Microsoft.IdentityModel.Tokens.CaseSensitiveClaimsIdentity());
+
+            // Act & Assert
+            await Assert.ThrowsAsync<MicrosoftIdentityWebChallengeUserException>(() =>
+                authorizationHeaderProvider.CreateAuthorizationHeaderForUserAsync(
+                    new[] { "https://graph.microsoft.com/.default" },
+                    authorizationHeaderProviderOptions: null,
+                    claimsPrincipal: user));
+
+            innerLogger.DidNotReceive().Log(
+                Microsoft.Extensions.Logging.LogLevel.Information,
+                Arg.Is<EventId>(e => e.Id == 300), // LoggingEventId.TokenAcquisitionError
+                Arg.Any<object>(),
+                Arg.Any<Exception?>(),
+                Arg.Any<Func<object, Exception?, string>>());
+        }
+
         private TokenAcquirerFactory InitTokenAcquirerFactory()
         {
             TokenAcquirerFactoryTesting.ResetTokenAcquirerFactoryInTest();