Skip to content

Commit a108321

Browse files
committed
responed to comments
1 parent 050e3c0 commit a108321

File tree

1 file changed

+5
-61
lines changed

1 file changed

+5
-61
lines changed

articles/active-directory/develop/msal-error-handling-js.md

Lines changed: 5 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -100,10 +100,8 @@ myMSALObj.acquireTokenSilent(request).then(function (response) {
100100
// call API
101101
}).catch( function (error) {
102102
// call acquireTokenPopup in case of acquireTokenSilent failure
103-
// due to consent or interaction required
104-
if (error.errorCode === "consent_required"
105-
|| error.errorCode === "interaction_required"
106-
|| error.errorCode === "login_required") {
103+
// due interaction required
104+
if (error instanceof InteractionRequiredAuthError) {
107105
myMSALObj.acquireTokenPopup(request).then(
108106
function (response) {
109107
// call API
@@ -128,8 +126,7 @@ myMSALObj.acquireTokenSilent(accessTokenRequest).then(function(accessTokenRespon
128126

129127
// extract, if exists, claims from error message
130128
if (error.ErrorMessage.claims) {
131-
accessTokenRequest.claimsRequest = JSON.stringify(error.ErrorMessage.claims);
132-
}
129+
accessTokenRequest.claims = window.atob(error.ErrorMessage.claims), // decode the base64 string
133130

134131
// call acquireTokenPopup in case of InteractionRequiredAuthError failure
135132
myMSALObj.acquireTokenPopup(accessTokenRequest).then(function(accessTokenResponse) {
@@ -143,62 +140,9 @@ myMSALObj.acquireTokenSilent(accessTokenRequest).then(function(accessTokenRespon
143140
144141
Interactively acquiring the token prompts the user and gives them the opportunity to satisfy the required Conditional Access policy.
145142
146-
When calling an API requiring Conditional Access, you can receive a claims challenge in error from the API. In this case, you can extract the claims challenge from the `WWW-Authenticate` header from the API error response object as shown in the `handleClaimsChallenge` method.
147-
148-
```javascript
149-
fetch(apiEndpoint, options)
150-
.catch((response) => {
151-
if (response.status === 401 && response.headers.get('www-authenticate')) {
152-
153-
const authenticateHeader = response.headers.get('www-authenticate');
154-
const claimsChallenge = parseChallenges(authenticateHeader).claims;
155-
// use the claims challenge to acquire a new access token...
156-
}
157-
})
158-
159-
/**
160-
* This method parses WWW-Authenticate authentication headers
161-
* @param header
162-
* @return {Object} challengeMap
163-
*/
164-
const parseChallenges = (header) => {
165-
const schemeSeparator = header.indexOf(' ');
166-
const challenges = header.substring(schemeSeparator + 1).split(', ');
167-
const challengeMap = {};
168-
169-
challenges.forEach((challenge) => {
170-
const [key, value] = challenge.split('=');
171-
challengeMap[key.trim()] = window.decodeURI(value.replace(/(^"|"$)/g, ''));
172-
});
173-
174-
return challengeMap;
175-
}
176-
```
177-
178-
Then pass the claims returned in the respond error to the request object in the `acquireToken` APIs to receive a new token that contains the claims.
179-
180-
```javascript
181-
const accessTokenRequest = {
182-
claims: window.atob(claimsChallenge), // decode the base64 string
183-
scopes: [],
184-
};
185-
186-
myMSALObj.acquireTokenSilent(accessTokenRequest).then(function(accessTokenResponse) {
187-
// call API
188-
}).catch(function(error) {
189-
if (error instanceof InteractionRequiredAuthError) {
190-
191-
myMSALObj.acquireTokenPopup(accessTokenRequest).then(function(accessTokenResponse) {
192-
// call API
193-
}).catch(function(error) {
194-
console.log(error);
195-
});
196-
}
197-
});
198-
```
199-
200-
See [Requesting Additional Claims](active-directory-optional-claims.md) and [How to use Continuous Access Evaluation enabled APIs in your applications](./app-resilience-continuous-access-evaluation.md) for more detail.
143+
When calling an API requiring Conditional Access, you can receive a claims challenge in the error from the API. In this case, you can pass the claims returned in the error to the `claims` parameter in the [access token request object](https://learn.microsoft.com/azure/active-directory/develop/msal-js-pass-custom-state-authentication-request) to satisfy the appropriate policy.
201144
145+
See [How to use Continuous Access Evaluation enabled APIs in your applications](./app-resilience-continuous-access-evaluation.md) for more detail.
202146
203147
[!INCLUDE [Active directory error handling retries](../../../includes/active-directory-develop-error-handling-retries.md)]
204148

0 commit comments

Comments
 (0)