[Request] WAM support for no scopes

[gladjohn]

Logs and network traces
none

Which version of MSAL.NET are you using?
latest

Platform
any

Repro

var authResult = await pca.AcquireTokenInteractive(new[] { "" })
                                          .ExecuteAsync();

Expected behavior
Friendly exception

Actual behavior
Flow proceeds and results in unfriednly exceptions

Fix: authenticationRequestParameters.HasScopes returns true if empty string is passed as scopes

[pmaytak]

@gladjohn @bgavrilMS Will C++ layer be updated to accept empty (or msal only) scopes? Couldn't find a related issue in DevOps.

cc: @azchohfi

[gladjohn]

here is the internal bug tracking this, but I do not think Interop/MSALRuntime (C++) will accept empty/null scopes. For the broker we did check to see if scopes are being passed. (by fixing authenticationRequestParameters.HasScopes logic)

This is what I see with the dev app for the new broker :

ATI without login_hint or account. It should display the account picker
Exception: MSAL.NetCore.4.46.0.0.MsalClientException: 
	ErrorCode: scopes_required_wam
Microsoft.Identity.Client.MsalClientException: At least one scope needs to be requested for this authentication flow. 

[bgavrilMS]

If you just want to login the user, please ask for "User.Read" Graph scope @azchohfi

Note that MSAL library isn't really meant for authentication, but for calling downstream APIs. As such, we don't offer a good developer experience for just logging in the user. In pure OIDC terms, you can rely strictly on id token for authentication, but MSAL's API are all targeted at access tokens. Concepts like expiration and silent refresh only look at access tokens.

ASP.NET Core handles the authentication part on its own, it does id token management etc. However, public client apps developers have to do this manually. Most applications, including big 1p apps, rely on access token / refresh token semantics, i.e. as long as GetAccounts() returns an Account, you can assume that the user is logged in. It may be the id token / access token expired, in which case most apps will fetch new ones (silently) when they need to call a new downstream API.

Hope this helps.

[gladjohn]

@azchohfi can you please start an email thread with our team for the requirement you have on no scopes, so we can better understand the situation

[bgavrilMS]

Let's revisit this when MSAL C++ supports the scenario - https://github.com/AzureAD/microsoft-authentication-library-for-cpp/pull/3299