Merge pull request #1635 from AzureAD/ameyapat/save-bart-only-when-rt-type-bart

Save bound app refresh token only when rt type in token response = bart

Author: ameyapat

IdentityCore/src/network/response_serializer/preprocessor/MSIDJweResponseDecryptPreProcessor.m

@@ -26,6 +26,7 @@
 #import "MSIDJweResponse.h"
 #import "MSIDJweResponse+EcdhAesGcm.h"
 #import "MSIDJsonResponsePreprocessor.h"
+#import "MSIDBrokerConstants.h"
 
 @implementation MSIDJweResponseDecryptPreProcessor
 
@@ -75,6 +76,12 @@ - (nullable NSDictionary *)decryptJweResponseData:(NSData *)data
     {
         NSMutableDictionary *mutableDecryptedResponse = [decryptedResponse mutableCopy];
         [mutableDecryptedResponse addEntriesFromDictionary:self.additionalResponseClaims];
+        // bart_device_id should be present in response only when refresh_token_type=bound_app_rt is present in token response from server.
+        if (![decryptedResponse[MSID_REFRESH_TOKEN_TYPE] isEqualToString:MSID_REFRESH_TOKEN_TYPE_BOUND_APP_RT])
+        {
+            [mutableDecryptedResponse removeObjectForKey:MSID_BART_DEVICE_ID_KEY];
+        }
+
         decryptedResponse = [mutableDecryptedResponse copy];
     }
     return decryptedResponse;

IdentityCore/src/oauth2/MSIDOauth2Factory.m

@@ -418,9 +418,8 @@ - (BOOL)fillAppMetadata:(MSIDAppMetadataCacheItem *)metadata
 
 - (BOOL)doesResponseHaveBoundAppRefreshToken:(MSIDTokenResponse *)response
 {
-    return ![NSString msidIsStringNilOrBlank:response.boundAppRefreshTokenDeviceId] &&
-    ([MSID_REFRESH_TOKEN_TYPE_BOUND_APP_RT isEqualToString:response.additionalServerInfo[MSID_REFRESH_TOKEN_TYPE]] ||
-                [response.additionalServerInfo[MSID_BART_DEVICE_ID_KEY] length] > 0);
+    return ![NSString msidIsStringNilOrBlank:response.boundAppRefreshTokenDeviceId] ||
+                [response.additionalServerInfo[MSID_BART_DEVICE_ID_KEY] length] > 0;
 }
 
 #pragma mark - Webview

changelog.txt

@@ -1,3 +1,6 @@
+TBD
+* Add logic to save bound app RT only when token response has refresh_token_type=bound_app_rt
+
 Version 1.18.0
 * Silent token request should use FRT first when single FRT is enabled #1624
 * Use autolayout for loading indicator #1628