[Bug] Possible regression when tenantId passed to `WithAuthority` differs from `WithTenantIdFromAuthority`

[christothes]

Library version used

4.73.1

.NET version

.NET 8.0.18

Scenario

ConfidentialClient - service to service (AcquireTokenForClient)

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

If WithAuthority is called with tenantA and WithTenantIdFromAuthority is called with tenantB, the token request goes to <authorityHost>/<tenantA>

Relevant code snippets

see https://github.com/Azure/azure-sdk-for-net/issues/51401

Expected behavior

If WithAuthority is called with tenantA and WithTenantIdFromAuthority is called with tenantB, the token request goes to <authorityHost>/<tenantB>

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

4.61.3 (not verified if any higher versions also work)

Solution and workarounds

n/a

[christothes]

related Azure/azure-sdk-for-net#51401

[bgavrilMS]

Hi @christothes - we designed the tenant override option to only work if you specify common or organization and CCA level and an actual tenantID at request level.

It seems that in your scenario, you specify an actual tenant ID at CCA level and another one at request level. What are you trying to acomplish?

[christothes]

In this scenario, the application is in tenantA and the resource is in tenantB. I believe the resource sends a challenge with the home tenant of the resource and we then send a request using that tenant. This code logic has been unchanged for many versions of Azure.Identity which is why I suspect a behavior change in MSAL here.

[bgavrilMS]

Hi @christothes - can you help me understand how I can repro this at MSAL level. I tried this test below and it works as expected:

         var app = ConfidentialClientApplicationBuilder.Create(TestConstants.ClientId)
             .WithAuthority("https://login.microsoftonline.com/tenanta")
             .WithClientSecret(TestConstants.ClientSecret)
             .Build();
        
         var handler = httpManager.AddMockHandlerSuccessfulClientCredentialTokenResponseMessage();

         var result = await app
             .AcquireTokenForClient(TestConstants.s_scope)
             .WithTenantIdFromAuthority(new Uri("https://login.microsoftonline.com/tenantb"))
             .ExecuteAsync().ConfigureAwait(false);

         Assert.AreEqual(
             "https://login.microsoftonline.com/tenantb/oauth2/v2.0/token",  // request made on b
             handler.ActualRequestMessage.RequestUri.AbsoluteUri);

[bgavrilMS]

Investigated and found that the root cauase is using an authority string like "https://login.microsoftonline.com/GUID1/GUID2" This is not a valid Entra authority and MSAL cannot figure out the correct tenant ID.