Bump MSAL to version 4.79.2 and handle changes to deprecated WithExtraQueryParameters APIs (#3583)

Avery-Dunn · web-flow · commit 9ad887156f75 · 2025-11-17T15:16:25.000-08:00
* Handle deprecation of WithExtraQueryParameters APIs in MSAL.NET * Update MicrosoftIdentityClientVersion * Update SystemFormatsAsn1Version * Add missing Unshipped.txt declaration * Handle deprecation of WithExtraQueryParameters APIs in MSAL.NET * Update MicrosoftIdentityClientVersion * Update SystemFormatsAsn1Version * Add missing Unshipped.txt declaration * Update MSAL version * Revert "Update MSAL version" This reverts commit 7cce634. * Update MSAL version * Adjust dependencies
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -83,7 +83,7 @@
 
   <PropertyGroup Label="Common dependency versions">
     <MicrosoftIdentityModelVersion Condition="'$(MicrosoftIdentityModelVersion)' == ''">8.14.0</MicrosoftIdentityModelVersion>
-    <MicrosoftIdentityClientVersion Condition="'$(MicrosoftIdentityClientVersion)' == ''">4.77.1</MicrosoftIdentityClientVersion>
+    <MicrosoftIdentityClientVersion Condition="'$(MicrosoftIdentityClientVersion)' == ''">4.79.2</MicrosoftIdentityClientVersion>
     <MicrosoftIdentityAbstractionsVersion Condition="'$(MicrosoftIdentityAbstractionsVersion)' == ''">9.5.0</MicrosoftIdentityAbstractionsVersion>
     <FxCopAnalyzersVersion>3.3.0</FxCopAnalyzersVersion>
     <SystemTextEncodingsWebVersion>4.7.2</SystemTextEncodingsWebVersion>
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net10.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net10.0/InternalAPI.Unshipped.txt
@@ -1,3 +1,4 @@
 #nullable enable
 const Microsoft.Identity.Web.Constants.UserIdKey = "IDWEB_USER_ID" -> string!
 readonly Microsoft.Identity.Web.TokenAcquisition._certificatesObservers -> System.Collections.Generic.IReadOnlyList<Microsoft.Identity.Web.Experimental.ICertificatesObserver!>!
+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/InternalAPI.Unshipped.txt
@@ -1 +1,2 @@
 #nullable enable
+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/InternalAPI.Unshipped.txt
@@ -1 +1,2 @@
 #nullable enable
+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/InternalAPI.Unshipped.txt
@@ -1 +1,2 @@
 #nullable enable
+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/InternalAPI.Unshipped.txt
@@ -1 +1,2 @@
 #nullable enable
+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/InternalAPI.Unshipped.txt
@@ -1 +1,2 @@
 #nullable enable
+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs
@@ -154,7 +154,7 @@ public async Task<AcquireTokenResult> AddAccountToCacheFromAuthorizationCodeAsyn
 
                 if (mergedOptions.ExtraQueryParameters != null)
                 {
-                    builder.WithExtraQueryParameters((Dictionary<string, string>)mergedOptions.ExtraQueryParameters);
+                    builder.WithExtraQueryParameters(MergeExtraQueryParameters(mergedOptions, null));
                 }
 
                 if (!string.IsNullOrEmpty(authCodeRedemptionParameters.Tenant))
@@ -1145,8 +1145,8 @@ private void NotifyCertificateSelection(
                             // Special case when the OBO inbound token is composite (for instance PFT)
                             if (dict.ContainsKey(assertionConstant) && dict.ContainsKey(subAssertionConstant))
                             {
-                                string assertion = dict[assertionConstant];
-                                string subAssertion = dict[subAssertionConstant];
+                                string assertion = dict[assertionConstant].value;
+                                string subAssertion = dict[subAssertionConstant].value;
 
                                 // Check assertion and sub_assertion passed from merging extra query parameters to ensure they do not contain unsupported character(s).
                                 CheckAssertionsForInjectionAttempt(assertion, subAssertion);
@@ -1164,7 +1164,6 @@ private void NotifyCertificateSelection(
                                 dict.Remove(assertionConstant);
                                 dict.Remove(subAssertionConstant);
                             }
-
                             builder.WithExtraQueryParameters(dict);
                         }
                         if (tokenAcquisitionOptions.ExtraHeadersParameters != null)
@@ -1362,25 +1361,40 @@ private Task<AuthenticationResult> GetAuthenticationResultForWebAppWithAccountFr
             return builder.ExecuteAsync(tokenAcquisitionOptions != null ? tokenAcquisitionOptions.CancellationToken : CancellationToken.None);
         }
 
-        internal static Dictionary<string, string>? MergeExtraQueryParameters(
+        internal static Dictionary<string, (string value, bool includeInCacheKey)>? MergeExtraQueryParameters(
             MergedOptions mergedOptions,
-            TokenAcquisitionOptions tokenAcquisitionOptions)
+            TokenAcquisitionOptions? tokenAcquisitionOptions)
         {
-            if (tokenAcquisitionOptions.ExtraQueryParameters != null)
+            // Return null if both sources are empty
+            if (tokenAcquisitionOptions?.ExtraQueryParameters == null && mergedOptions.ExtraQueryParameters == null)
             {
-                var mergedDict = new Dictionary<string, string>(tokenAcquisitionOptions.ExtraQueryParameters);
-                if (mergedOptions.ExtraQueryParameters != null)
+                return null;
+            }
+
+            var mergedDict = new Dictionary<string, (string value, bool includeInCacheKey)>(StringComparer.OrdinalIgnoreCase);
+
+            // Add from tokenAcquisitionOptions first (these take precedence)
+            if (tokenAcquisitionOptions?.ExtraQueryParameters != null)
+            {
+                foreach (var pair in tokenAcquisitionOptions.ExtraQueryParameters)
+                {
+                    mergedDict[pair.Key] = (pair.Value, true);
+                }
+            }
+
+            // Add from mergedOptions without overriding existing keys
+            if (mergedOptions.ExtraQueryParameters != null)
+            {
+                foreach (var pair in mergedOptions.ExtraQueryParameters)
                 {
-                    foreach (var pair in mergedOptions!.ExtraQueryParameters)
+                    if (!mergedDict.ContainsKey(pair.Key))
                     {
-                        if (!mergedDict!.ContainsKey(pair.Key))
-                            mergedDict.Add(pair.Key, pair.Value);
+                        mergedDict.Add(pair.Key, (pair.Value, true));
                     }
                 }
-                return mergedDict;
             }
 
-            return (Dictionary<string, string>?)mergedOptions.ExtraQueryParameters;
+            return mergedDict;
         }
 
         protected static bool AcceptedTokenVersionMismatch(MsalUiRequiredException msalServiceException)
diff --git a/tests/Microsoft.Identity.Web.Test/TokenAcquisitionAuthorityTests.cs b/tests/Microsoft.Identity.Web.Test/TokenAcquisitionAuthorityTests.cs
@@ -385,9 +385,9 @@ public void MergeExtraQueryParametersTest()
 
             // Assert
             Assert.Equal(3, mergedDict!.Count);
-            Assert.Equal("newvalue1", mergedDict["key1"]);
-            Assert.Equal("value2", mergedDict["key2"]);
-            Assert.Equal("value3", mergedDict["key3"]);
+            Assert.Equal("newvalue1", mergedDict["key1"].value);
+            Assert.Equal("value2", mergedDict["key2"].value);
+            Assert.Equal("value3", mergedDict["key3"].value);
         }
 
         [Fact]
@@ -411,8 +411,8 @@ public void MergeExtraQueryParameters_TokenAcquisitionOptionsNull_Test()
             var mergedDict = TokenAcquisition.MergeExtraQueryParameters(mergedOptions, tokenAcquisitionOptions);
 
             // Assert
-            Assert.Equal("value1", mergedDict!["key1"]);
-            Assert.Equal("value2", mergedDict["key2"]);
+            Assert.Equal("value1", mergedDict!["key1"].value);
+            Assert.Equal("value2", mergedDict["key2"].value);
         }
 
         [Fact]

Original file line number	Diff line number	Diff line change
`@@ -1 +1,2 @@`
`1`	`1`	`#nullable enable`
	`2`	`+static Microsoft.Identity.Web.TokenAcquisition.MergeExtraQueryParameters(Microsoft.Identity.Web.MergedOptions! mergedOptions, Microsoft.Identity.Web.TokenAcquisitionOptions? tokenAcquisitionOptions) -> System.Collections.Generic.Dictionary<string!, (string! value, bool includeInCacheKey)>?`
Original file line number	Diff line number	Diff line change
`@@ -154,7 +154,7 @@ public async Task<AcquireTokenResult> AddAccountToCacheFromAuthorizationCodeAsyn`
`154`	`154`
`155`	`155`	`if (mergedOptions.ExtraQueryParameters != null)`
`156`	`156`	`{`
`157`		`- builder.WithExtraQueryParameters((Dictionary<string, string>)mergedOptions.ExtraQueryParameters);`
	`157`	`+ builder.WithExtraQueryParameters(MergeExtraQueryParameters(mergedOptions, null));`
`158`	`158`	`}`
`159`	`159`
`160`	`160`	`if (!string.IsNullOrEmpty(authCodeRedemptionParameters.Tenant))`
`@@ -1145,8 +1145,8 @@ private void NotifyCertificateSelection(`
`1145`	`1145`	`// Special case when the OBO inbound token is composite (for instance PFT)`
`1146`	`1146`	`if (dict.ContainsKey(assertionConstant) && dict.ContainsKey(subAssertionConstant))`
`1147`	`1147`	`{`
`1148`		`- string assertion = dict[assertionConstant];`
`1149`		`- string subAssertion = dict[subAssertionConstant];`
	`1148`	`+ string assertion = dict[assertionConstant].value;`
	`1149`	`+ string subAssertion = dict[subAssertionConstant].value;`
`1150`	`1150`
`1151`	`1151`	`// Check assertion and sub_assertion passed from merging extra query parameters to ensure they do not contain unsupported character(s).`
`1152`	`1152`	`CheckAssertionsForInjectionAttempt(assertion, subAssertion);`
`@@ -1164,7 +1164,6 @@ private void NotifyCertificateSelection(`
`1164`	`1164`	`dict.Remove(assertionConstant);`
`1165`	`1165`	`dict.Remove(subAssertionConstant);`
`1166`	`1166`	`}`
`1167`		`-`
`1168`	`1167`	`builder.WithExtraQueryParameters(dict);`
`1169`	`1168`	`}`
`1170`	`1169`	`if (tokenAcquisitionOptions.ExtraHeadersParameters != null)`
`@@ -1362,25 +1361,40 @@ private Task<AuthenticationResult> GetAuthenticationResultForWebAppWithAccountFr`
`1362`	`1361`	`return builder.ExecuteAsync(tokenAcquisitionOptions != null ? tokenAcquisitionOptions.CancellationToken : CancellationToken.None);`
`1363`	`1362`	`}`
`1364`	`1363`
`1365`		`- internal static Dictionary<string, string>? MergeExtraQueryParameters(`
	`1364`	`+ internal static Dictionary<string, (string value, bool includeInCacheKey)>? MergeExtraQueryParameters(`
`1366`	`1365`	`MergedOptions mergedOptions,`
`1367`		`- TokenAcquisitionOptions tokenAcquisitionOptions)`
	`1366`	`+ TokenAcquisitionOptions? tokenAcquisitionOptions)`
`1368`	`1367`	`{`
`1369`		`- if (tokenAcquisitionOptions.ExtraQueryParameters != null)`
	`1368`	`+ // Return null if both sources are empty`
	`1369`	`+ if (tokenAcquisitionOptions?.ExtraQueryParameters == null && mergedOptions.ExtraQueryParameters == null)`
`1370`	`1370`	`{`
`1371`		`- var mergedDict = new Dictionary<string, string>(tokenAcquisitionOptions.ExtraQueryParameters);`
`1372`		`- if (mergedOptions.ExtraQueryParameters != null)`
	`1371`	`+ return null;`
	`1372`	`+ }`
	`1373`	`+`
	`1374`	`+ var mergedDict = new Dictionary<string, (string value, bool includeInCacheKey)>(StringComparer.OrdinalIgnoreCase);`
	`1375`	`+`
	`1376`	`+ // Add from tokenAcquisitionOptions first (these take precedence)`
	`1377`	`+ if (tokenAcquisitionOptions?.ExtraQueryParameters != null)`
	`1378`	`+ {`
	`1379`	`+ foreach (var pair in tokenAcquisitionOptions.ExtraQueryParameters)`
	`1380`	`+ {`
	`1381`	`+ mergedDict[pair.Key] = (pair.Value, true);`
	`1382`	`+ }`
	`1383`	`+ }`
	`1384`	`+`
	`1385`	`+ // Add from mergedOptions without overriding existing keys`
	`1386`	`+ if (mergedOptions.ExtraQueryParameters != null)`
	`1387`	`+ {`
	`1388`	`+ foreach (var pair in mergedOptions.ExtraQueryParameters)`
`1373`	`1389`	`{`
`1374`		`- foreach (var pair in mergedOptions!.ExtraQueryParameters)`
	`1390`	`+ if (!mergedDict.ContainsKey(pair.Key))`
`1375`	`1391`	`{`
`1376`		`- if (!mergedDict!.ContainsKey(pair.Key))`
`1377`		`- mergedDict.Add(pair.Key, pair.Value);`
	`1392`	`+ mergedDict.Add(pair.Key, (pair.Value, true));`
`1378`	`1393`	`}`
`1379`	`1394`	`}`
`1380`		`- return mergedDict;`
`1381`	`1395`	`}`
`1382`	`1396`
`1383`		`- return (Dictionary<string, string>?)mergedOptions.ExtraQueryParameters;`
	`1397`	`+ return mergedDict;`
`1384`	`1398`	`}`
`1385`	`1399`
`1386`	`1400`	`protected static bool AcceptedTokenVersionMismatch(MsalUiRequiredException msalServiceException)`