{"action":"created","issue":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305","repository_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet","labels_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305/labels{/name}","comments_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305/comments","events_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305/events","html_url":"https://github.com/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305","id":367038452,"node_id":"MDU6SXNzdWUzNjcwMzg0NTI=","number":1305,"title":"ADAL is not returning cached tokens in multi-resource scenarios","user":{"login":"arunsmiles","id":18409899,"node_id":"MDQ6VXNlcjE4NDA5ODk5","avatar_url":"https://avatars1.githubusercontent.com/u/18409899?v=4","gravatar_id":"","url":"https://api.github.com/users/arunsmiles","html_url":"https://github.com/arunsmiles","followers_url":"https://api.github.com/users/arunsmiles/followers","following_url":"https://api.github.com/users/arunsmiles/following{/other_user}","gists_url":"https://api.github.com/users/arunsmiles/gists{/gist_id}","starred_url":"https://api.github.com/users/arunsmiles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arunsmiles/subscriptions","organizations_url":"https://api.github.com/users/arunsmiles/orgs","repos_url":"https://api.github.com/users/arunsmiles/repos","events_url":"https://api.github.com/users/arunsmiles/events{/privacy}","received_events_url":"https://api.github.com/users/arunsmiles/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-05T02:34:45Z","updated_at":"2018-10-05T15:43:13Z","closed_at":null,"author_association":"NONE","body":"ADAL Version that repros this issue: v3.19.8 (Latest Stable)\r\n\r\nAs part of our API call, we need on-behalf-of tokens for multiple resources like substrate, graph.windows.net, graph.microsoft.com etc. We expect ADAL to cache these tokens and return the cached tokens when we request the tokens for the same resource next time. But because of some issue with internal implementation of ADAL library, ADAL is not returning cached tokens in case multiple tokens (for different resources) are there in the cache for the same user, instead it is fetching a new token from AAD service. We are able to easily reproduce this issue locally also (even with latest version of ADAL library). \r\n\r\n```\r\nvar authenticationContext = new AuthenticationContext(authority, false, new Tokencache());\r\n \r\nvar userAssertion = new UserAssertion(serviceToken, JwtBearerAssertionType, userPrincipalName);\r\n \r\n// fetch token for Substrate. This fetches a new token from AAD and stores it in cache\r\nvar result = authenticationContext.AcquireTokenAsync(“https://substrate.office.com”, clientAssertionCert, userAssertion); \r\n \r\n// fetch token for Graph. Instead of using the user Assertion passed, ADAL uses the refresh token of Substrate from cache to fetch a new token and store it in cache\r\nvar result = authenticationContext.AcquireTokenAsync(\"https://graph.microsoft.com\", clientAssertionCert, userAssertion); \r\n \r\n// fetch token for Graph again. Because of the issue in ADAL library, instead of taking the token for Graph from the cache, it again fetches a new token from ADAL using the refresh token for Substrate\r\nvar result = authenticationContext.AcquireTokenAsync(\"https://graph.microsoft.com\", clientAssertionCert, userAssertion);\r\n```\r\n\r\nMore details to the ADAL cache implementation:\r\n\r\nWe digged into the ADAL library implementation, added logging to this and found that first time for a resource we fetch the token and store it in cache. The next time we try to fetch token for the same resource, it sees if there is a cached token for the resource. If it finds, it takes from the cache and return without making an ADAL call. But when we try to fetch token for a new resource, it sees if there is a cached token for the resource. If it doesn't find one, first it tries to see if there is a cached multi resource refresh token and instead of fetching a new token, it uses the multi resource refresh token(for the resource 1) and make call to ADAL to fetch a new token for the second resource. The userAssertionHash value in this case (case when we use refresh token to fetch token) is always set to null. So the next time, we try to fetch a token for resource2, it cannot find the matching token from cache as the userAssertionHash is null in the cache, but we pass the userAssertion. So it again uses the refresh token to fetch a new token for resource2. This happens everytime we try to fetch token for the resource2 resulting in an external ADAL call.\r\n\r\nIs this issue tracked already? How do we address this?"},"comment":{"url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet/issues/comments/427409842","html_url":"https://github.com/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305#issuecomment-427409842","issue_url":"https://api.github.com/repos/AzureAD/azure-activedirectory-library-for-dotnet/issues/1305","id":427409842,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzQwOTg0Mg==","user":{"login":"henrik-me","id":34380746,"node_id":"MDQ6VXNlcjM0MzgwNzQ2","avatar_url":"https://avatars1.githubusercontent.com/u/34380746?v=4","gravatar_id":"","url":"https://api.github.com/users/henrik-me","html_url":"https://github.com/henrik-me","followers_url":"https://api.github.com/users/henrik-me/followers","following_url":"https://api.github.com/users/henrik-me/following{/other_user}","gists_url":"https://api.github.com/users/henrik-me/gists{/gist_id}","starred_url":"https://api.github.com/users/henrik-me/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/henrik-me/subscriptions","organizations_url":"https://api.github.com/users/henrik-me/orgs","repos_url":"https://api.github.com/users/henrik-me/repos","events_url":"https://api.github.com/users/henrik-me/events{/privacy}","received_events_url":"https://api.github.com/users/henrik-me/received_events","type":"User","site_admin":false},"created_at":"2018-10-05T15:43:13Z","updated_at":"2018-10-05T15:43:13Z","author_association":"CONTRIBUTOR","body":"@arunsmiles : Can you pls. post a PR with your changes? We may put this change in v4 as we are about to remove the preview tag from that. Can you pls. try v4? (There is a binary breaking change, which is fixed by compiling otherwise you should not be seeing any differences)\r\n\r\n@MarkZuber and @jennyf19 will look at your solution and help evaluate and ship a fix"}}
{"actor":{"display_login":"henrik-me"}}