Prototype for rejecting MSAL cached token based on AuthOperation

src/client/Microsoft.Identity.Client/AuthScheme/Bearer/BearerAuthenticationOperation.cs

@@ -8,7 +8,7 @@
 
 namespace Microsoft.Identity.Client.AuthScheme.Bearer
 {
     internal class BearerAuthenticationOperation : IAuthenticationOperation
     {
         internal const string BearerTokenType = "bearer";
 
@@ -30,5 +30,11 @@
             // ESTS issues Bearer tokens by default, no need for any extra params
             return CollectionHelpers.GetEmptyDictionary<string, string>();
         }
+
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem)
+        {
+            // no-op
+            return true;
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/IAuthenticationOperation.cs

@@ -43,6 +43,13 @@ public interface IAuthenticationOperation
         /// <returns>Name and values of params</returns>
         IReadOnlyDictionary<string, string> GetTokenRequestParams();
 
+        /// <summary>
+        /// 
+        /// </summary>
+        /// <param name="cachedTokenItem"></param>
+        /// <returns></returns>
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem);
+
         /// <summary>
         /// Key ID of the public / private key pair used by the encryption algorithm, if any. 
         /// Tokens obtained by authentication schemes that use this are bound to the KeyId, i.e. 

src/client/Microsoft.Identity.Client/AuthScheme/MsalCacheValidationData.cs

@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System.Collections.Generic;
+
+namespace Microsoft.Identity.Client.AuthScheme
+{
+    /// <summary>
+    /// Data used to validate cache items for different authentication schemes.
+    /// </summary>
+    public class MsalCacheValidationData
+    {
+        /// <summary>
+        /// Gets the persisted parameters addded to the cache items.
+        /// </summary>
+        public IDictionary<string, string> PersistedCacheParameters { get; internal set; }
+    }
+}

src/client/Microsoft.Identity.Client/AuthScheme/PoP/MtlsPopAuthenticationOperation.cs

@@ -10,7 +10,7 @@
 
 namespace Microsoft.Identity.Client.AuthScheme.PoP
 {
     internal class MtlsPopAuthenticationOperation : IAuthenticationOperation
     {
         private readonly X509Certificate2 _mtlsCert;
 
@@ -40,5 +40,11 @@
         {
             authenticationResult.BindingCertificate = _mtlsCert;
         }
+
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem)
+        {
+            // no-op
+            return true;
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/PoP/PopAuthenticationOperation.cs

@@ -21,7 +21,7 @@
 
 namespace Microsoft.Identity.Client.AuthScheme.PoP
 {
     internal class PopAuthenticationOperation : IAuthenticationOperation
     {
         private readonly PoPAuthenticationConfiguration _popAuthenticationConfiguration;
         private readonly IPoPCryptoProvider _popCryptoProvider;
@@ -162,5 +162,11 @@
 
             return sb.ToString();
         }
+
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem)
+        {
+            // no-op
+            return true;
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/PoP/PopBrokerAuthenticationOperation.cs

@@ -15,7 +15,7 @@
     //Authentication Scheme used when MSAL Broker and pop are used together.
     //Tokens acquired from brokers will not be saved in the local ache and MSAL will not search the local cache during silent authentication.
     //This is because tokens are cached in the broker instead so MSAL will rely on the broker's cache for silent requests.
     internal class PopBrokerAuthenticationOperation : IAuthenticationOperation
     {
         public int TelemetryTokenType => TelemetryTokenTypeConstants.Pop;
 
@@ -34,5 +34,11 @@
         {
             return CollectionHelpers.GetEmptyDictionary<string, string>();
         }
+
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem)
+        {
+            // no-op
+            return true;
+        }
     }
 }

src/client/Microsoft.Identity.Client/AuthScheme/SSHCertificates/SSHCertAuthenticationOperation.cs

@@ -9,7 +9,7 @@
 
 namespace Microsoft.Identity.Client.AuthScheme.SSHCertificates
 {
     internal class SSHCertAuthenticationOperation : IAuthenticationOperation
     {
         internal const string SSHCertTokenType = "ssh-cert";
         private readonly string _jwk;
@@ -53,5 +53,11 @@
                 { OAuth2Parameter.RequestConfirmation , _jwk }
             };
         }
+
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem)
+        {
+            // no-op
+            return true;
+        }
     }
 }

src/client/Microsoft.Identity.Client/Extensibility/ExternalBoundTokenScheme.cs

@@ -37,5 +37,11 @@ public IReadOnlyDictionary<string, string> GetTokenRequestParams()
         {
             return CollectionHelpers.GetEmptyDictionary<string, string>();
         }
+
+        bool ValidateCachedToken(MsalCacheValidationData cachedTokenItem)
+        {
+            // no-op
+            return true;
+        }
     }
 }

src/client/Microsoft.Identity.Client/Internal/Requests/ClientCredentialRequest.cs

@@ -10,6 +10,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Identity.Client.ApiConfig.Parameters;
+using Microsoft.Identity.Client.AuthScheme;
 using Microsoft.Identity.Client.Cache.Items;
 using Microsoft.Identity.Client.Core;
 using Microsoft.Identity.Client.Extensibility;
@@ -76,6 +77,19 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
 
             MsalAccessTokenCacheItem cachedAccessTokenItem = await GetCachedAccessTokenAsync().ConfigureAwait(false);
 
+            // Validate the cached token using the authentication operation
+            if (AuthenticationRequestParameters.AuthenticationScheme != null &&
+                cachedAccessTokenItem != null)
+            {
+                var cacheValidationData = new MsalCacheValidationData();
+                cacheValidationData.PersistedCacheParameters = cachedAccessTokenItem.PersistedCacheParameters;
+                if (!AuthenticationRequestParameters.AuthenticationScheme.ValidateCachedToken(cacheValidationData))
+                {
+                    logger.Info("[ClientCredentialRequest] Cached token failed authentication operation validation.");
+                    cachedAccessTokenItem = null;
+                }
+            }
+
             // No access token or cached access token needs to be refreshed 
             if (cachedAccessTokenItem != null)
             {

src/client/Microsoft.Identity.Client/Microsoft.Identity.Client.csproj

@@ -80,6 +80,7 @@
     <Compile Include="$(PathToMsalSources)\**\*.cs" Exclude="$(PathToMsalSources)\obj\**\*.*" />
     <Compile Remove="$(PathToMsalSources)\Platforms\**\*.*;$(PathToMsalSources)\Resources\*.cs" />
     <Compile Remove="$(PathToMsalSources)\PlatformsCommon\PlatformNotSupported\ApiConfig\SystemWebViewOptions.cs" />
+    <None Remove="AuthScheme\MsalCacheValidationData.cs" />
     <EmbeddedResource Include="$(PathToMsalSources)\Properties\Microsoft.Identity.Client.rd.xml" />
     <None Include="$(PathToMsalSources)\..\..\..\README.md" Pack="true" PackagePath="\" />
     <None Include="Platforms\net\JsonObjectAttribute.cs" />
@@ -161,4 +162,8 @@
     <AdditionalFiles Include="PublicAPI/$(TargetFramework)/PublicAPI.Unshipped.txt" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Compile Include="AuthScheme\MsalCacheValidationData.cs" />
+  </ItemGroup>
+
 </Project>