Bump Microsoft.Identity.Client from 4.10.0 to 4.15.0 in /src/02-Corporate

[dependabot-preview]

Bumps Microsoft.Identity.Client from 4.10.0 to 4.15.0.

Release notes

Sourced from Microsoft.Identity.Client's releases.

MSAL.NET 4.15.0

4.15.0

New Features:

MSAL has been upgraded to use Android X. MSAL.NET will now use the latest Android SDKs for it's Xamarin.Android platform. Issue for details

GetAccounts() can now filter by user flow for B2C accounts. MSAL's GetAccounts() api will now allow you to pass in a user flow to filter B2C accounts when quering the cache. Issue for details

Bug Fixes:

MSAL can now migrate from ADALV3 to MSALV3 when multiple resourceId's are used. MSAL will now ignore ADAL resource strings when fetching RT to enable migration from ADALV3 to MSALV3 cachetokens. Issue for details

MSAL will now maintain the correlation ID of the authentication request with broker specific interactions throughout it's entire execution. Issue for details

MSAL will now return the correct value for ExpiresOn in the authentication result during brokered authentication. Issue for details

MSAL now has improved logic for AcquireTokenSilent(), GetAccounts() and RemoveAccount() during brokered authentication. During brokered authentication, MSAL will now check its local cache for tokens first before sending the silent authentication request to broker. GetAccounts() will now merge the accounts from the local MSAL and broker caches when returning results. RemoveAccount() will now remove the account from both the local cache and the broker cache. Issue for details

MSAL now has better error reporting during Integrated Windows Authentication. MSAL will now return the error in the body on WsTrust parse errors. Issue for details

MSAL will now handle null intents returned to SetAuthenticationContinuationEventArgs. MSAL will now handle null intents returned to SetAuthenticationContinuationEventArgs to avoid throwing null reference exceptions. Issue for details

4.14.0

New Features

MSAL no longer calls the OIDC metadata endpoint, as it can infer the authorization and token URLs based on the authority URL. This will speed up token acquisition, especially for multi-tenant applications, as fewer network calls will be made. For details see Issue for details

Client throttling extended support MSAL will throttle all /token calls during an event in which the server sends a Retry-After header, thus ensuring the Retry-After instruction is observed. MSAL will also throttle server requests that result in MsalUiRequiredException being thrown, for example when the user is required to perform MFA but the app keeps trying to acquire a token silently. For details see Issue for details

Bug Fixes

MSAL .NET now respects the ValidateAuthority=false flag. See Issue for details

Resolved an issue with the Android broker - when Authenticator / Company Portal is configured but it is not installed, MSAL should revert to using its own cache to try to perform the AcquireTokenSilent call. Issue for details

Fixed android broker prompt parameter MSAL will now send the correct UI Behavior prompt value to the broker for authentication.

4.13.0

New Features

Client throttling is supported in Public Client Applications MSAL will now implement client side throttling to reduce excessive authentication requests sent to the service: In the case where the Azure AD service replies with an HTTP error implying throttling, MSAL.NET now respects itself the delay imposed by the service by throwing an exception telling the application after which delay/when it will be able to acquire a token again without even attempting to call the service. For details see Issue for details

MSAL now can perform device authentication on Desktop On Operating systems prior to Windows 10 (Windows 7, 8, 8.1 and their server conterparts) MSAL.NET is able to perform device authentication using PKey Authentication. Issue for details

Bug Fixes

MSAL .NET would throw a null ref when no authentication type was specified when creating a confidential client application MSAL .NET now verifies the developer has specified one client credential (client secret, certificate, or client assertion) when using a confidential client application. See Issue for details

... (truncated)

Changelog

Sourced from Microsoft.Identity.Client's changelog.

4.15

New Features:

MSAL has been upgraded to use Android X. MSAL.NET will now use the latest Android SDKs for it's Xamarin.Android platform. Issue for details

GetAccounts() can now filter by user flow for B2C accounts. MSAL's GetAccounts() api will now allow you to pass in a user flow to filter B2C accounts when quering the cache. Issue for details

Bug Fixes:

MSAL can now migrate from ADALV3 to MSALV3 when multiple resourceId's are used. MSAL will now ignore ADAL resource strings when fetching RT to enable migration from ADALV3 to MSALV3 cachetokens. Issue for details

MSAL will now maintain the correlation ID of the authentication request with broker specific interactions throughout it's entire execution. Issue for details

MSAL will now return the correct value for ExpiresOn in the authentication result during brokered authentication. Issue for details

MSAL now has improved logic for AcquireTokenSilent(), GetAccounts() and RemoveAccount() during brokered authentication. During brokered authentication, MSAL will now check its local cache for tokens first before sending the silent authentication request to broker. GetAccounts() will now merge the accounts from the local MSAL and broker caches when returning results. RemoveAccount() will now remove the account from both the local cache and the broker cache. Issue for details

MSAL now has better error reporting during Integrated Windows Authentication. MSAL will now return the error in the body on WsTrust parse errors. Issue for details

MSAL will now handle null intents returned to SetAuthenticationContinuationEventArgs. MSAL will now handle null intents returned to SetAuthenticationContinuationEventArgs to avoid throwing null reference exceptions. Issue for details

4.14.0

New Features:

**MSAL no longer calls the OIDC metadata endpoint, as it can infer the authorization and token URLs based on the authority URL. This will speed up token acquisition, especially for multi-tenant applications, as fewer network calls will be made. For details see Issue for details

Client throttling extended support MSAL will throttle all /token calls during an event in which the server sends a Retry-After header, thus ensuring the Retry-After instruction is observed. MSAL will also throttle server requests that result in MsalUiRequiredException being thrown, for example when the user is required to perform MFA but the app keeps trying to acquire a token silently. For details see Issue for details

Bug Fixes:

**MSAL .NET now respects the ValidateAuthority=false flag. See Issue for details

**When the Android broker (Authenticator / Company Portal) is configured but it is not installed, MSAL should revert to using its own cache to try to perform the AcquireTokenSilent call. Issue for details

4.13.0

New Features:

Client throttling is supported in Public Client Applications MSAL will now implement client side throttling to reduce excessive authentication requests sent to the service: In the case where the Azure AD service replies with an HTTP error implying throttling, MSAL.NET now respects itself the delay imposed by the service by throwing an exception telling the application after which delay/when it will be able to acquire a token again without even attempting to call the service. For details see Issue for details

MSAL now can perform device authentication on Desktop On Operating systems prior to Windows 10 (Windows 7, 8, 8.1 and their server conterparts) MSAL.NET is able to perform device authentication using PKey Authentication. Issue for details

Bug Fixes:

MSAL .NET would throw a null ref when no authentication type was specified when creating a confidential client application MSAL .NET now verifies the developer has specified one client credential (client secret, certificate, or client assertion) when using a confidential client application. See Issue for details

GetAccountsAsync() used to return 0 accounts when the broker was not installed (on Xamarin.Android). MSAL will now return accounts from the local MSAL cache when the broker is not installed and WithBroker(trus) is used. Issue for details

... (truncated)

Commits

• 950d2e9 Android nuget workaround for System.Drawing error (#1895)
• 58993ad Change log for MSAL 4.15 (#1894)
• ad3b9f4 Fix missing using namespace statement
• 986b2d8 add method to get accounts by userflow for B2C scenarios (#1869)
• 0ac7b9f Fix accidental csproj changes
• 4db0960 Minor cleanup of SilentRequest and moving files around
• 741f09d Make iOS broker key handling more robust and fix redirect uri
• 3da3191 Silent request refactoring and Broker bug fix (#1873)
• cdf467b Use tenant id from lab response (#1882)
• 9526d22 Fix for #1851 - ignore ADAL resource string when fetching RTs (#1884)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #56.