pr comments

Author: GladwinJohnson

src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs

@@ -105,15 +105,12 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
                         cachedAccessTokenItem,
                             () =>
                             {
-                                // Use a linked token source, in case the original cts is disposed
+                                // Use a linked token source, in case the original cancellation token source is disposed before this background task completes.
                                 using var tokenSource = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
                                 return GetAccessTokenAsync(tokenSource.Token, logger);
-                            },
-                            logger,
-                            ServiceBundle,
-                            AuthenticationRequestParameters.RequestContext.ApiEvent,
-                            AuthenticationRequestParameters.RequestContext.ApiEvent.CallerSdkApiId,
-                            AuthenticationRequestParameters.RequestContext.ApiEvent.CallerSdkVersion);
+                            }, logger, ServiceBundle, AuthenticationRequestParameters.RequestContext.ApiEvent,
+                        AuthenticationRequestParameters.RequestContext.ApiEvent.CallerSdkApiId,
+                        AuthenticationRequestParameters.RequestContext.ApiEvent.CallerSdkVersion);
                     }
                 }
                 catch (MsalServiceException e)
@@ -154,9 +151,12 @@ private async Task<AuthenticationResult> GetAccessTokenAsync(
 
             try
             {
-                // Bypass cache and send request to token endpoint, when
-                // 1. Force refresh is requested, or
-                // 2. If the access token needs to be refreshed proactively.
+                // While holding the semaphore, decide whether to bypass the cache.
+                // Re-check because another thread may have filled the cache while we waited.
+                // Bypass when:
+                // 1) ForceRefresh is requested
+                // 2) Proactive refresh is in effect
+                // 3) Claims are present (revocation flow)
                 if (_managedIdentityParameters.ForceRefresh || 
                     AuthenticationRequestParameters.RequestContext.ApiEvent.CacheInfo == CacheRefreshReason.ProactivelyRefreshed ||
                     !string.IsNullOrEmpty(_managedIdentityParameters.Claims))

src/client/Microsoft.Identity.Client/ManagedIdentity/AbstractManagedIdentity.cs

@@ -55,7 +55,7 @@ public virtual async Task<ManagedIdentityResponse> AuthenticateAsync(
             // Convert the scopes to a resource string.
             string resource = parameters.Resource;
 
-            ManagedIdentityRequest request = CreateRequest(resource, parameters);
+            ManagedIdentityRequest request = CreateRequest(resource);
 
             // Automatically add claims / capabilities if this MI source supports them
             if (_sourceType.SupportsClaimsAndCapabilities())
@@ -149,7 +149,7 @@ protected virtual Task<ManagedIdentityResponse> HandleResponseAsync(
             throw exception;
         }
 
-        protected abstract ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters);
+        protected abstract ManagedIdentityRequest CreateRequest(string resource);
 
         protected ManagedIdentityResponse GetSuccessfulResponse(HttpResponse response)
         {

src/client/Microsoft.Identity.Client/ManagedIdentity/AppServiceManagedIdentitySource.cs

@@ -66,8 +66,7 @@ private static bool TryValidateEnvVars(string msiEndpoint, ILoggerAdapter logger
             return true;
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource, 
-            AcquireTokenForManagedIdentityParameters parameters)
+        protected override ManagedIdentityRequest CreateRequest(string resource)
         {
             ManagedIdentityRequest request = new(System.Net.Http.HttpMethod.Get, _endpoint);
 

src/client/Microsoft.Identity.Client/ManagedIdentity/AzureArcManagedIdentitySource.cs

@@ -79,8 +79,7 @@ private AzureArcManagedIdentitySource(Uri endpoint, RequestContext requestContex
             }
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource, 
-            AcquireTokenForManagedIdentityParameters parameters)
+        protected override ManagedIdentityRequest CreateRequest(string resource)
         {
             ManagedIdentityRequest request = new ManagedIdentityRequest(System.Net.Http.HttpMethod.Get, _endpoint);
 
@@ -120,7 +119,7 @@ protected override async Task<ManagedIdentityResponse> HandleResponseAsync(
 
                 var authHeaderValue = "Basic " + File.ReadAllText(splitChallenge[1]);
 
-                ManagedIdentityRequest request = CreateRequest(parameters.Resource, parameters);
+                ManagedIdentityRequest request = CreateRequest(parameters.Resource);
 
                 _requestContext.Logger.Verbose(() => "[Managed Identity] Adding authorization header to the request.");
                 request.Headers.Add("Authorization", authHeaderValue);

src/client/Microsoft.Identity.Client/ManagedIdentity/CloudShellManagedIdentitySource.cs

@@ -74,8 +74,7 @@ private CloudShellManagedIdentitySource(Uri endpoint, RequestContext requestCont
             }
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource, 
-            AcquireTokenForManagedIdentityParameters parameters)
+        protected override ManagedIdentityRequest CreateRequest(string resource)
         {
             ManagedIdentityRequest request = new ManagedIdentityRequest(HttpMethod.Post, _endpoint);
 

src/client/Microsoft.Identity.Client/ManagedIdentity/ImdsManagedIdentitySource.cs

@@ -55,8 +55,7 @@ internal ImdsManagedIdentitySource(RequestContext requestContext) :
             requestContext.Logger.Verbose(() => "[Managed Identity] Creating IMDS managed identity source. Endpoint URI: " + _imdsEndpoint);
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource, 
-            AcquireTokenForManagedIdentityParameters parameters)
+        protected override ManagedIdentityRequest CreateRequest(string resource)
         {
             ManagedIdentityRequest request = new(HttpMethod.Get, _imdsEndpoint);
 

src/client/Microsoft.Identity.Client/ManagedIdentity/MachineLearningManagedIdentitySource.cs

@@ -64,8 +64,7 @@ private static bool TryValidateEnvVars(string msiEndpoint, ILoggerAdapter logger
             return true;
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource, 
-            AcquireTokenForManagedIdentityParameters parameters)
+        protected override ManagedIdentityRequest CreateRequest(string resource)
         {
             ManagedIdentityRequest request = new(System.Net.Http.HttpMethod.Get, _endpoint);
 

src/client/Microsoft.Identity.Client/ManagedIdentity/ManagedIdentitySourceExtensions.cs

@@ -8,10 +8,10 @@ namespace Microsoft.Identity.Client.ManagedIdentity
     internal static class ManagedIdentitySourceExtensions
     {
         private static readonly HashSet<ManagedIdentitySource> s_supportsClaimsAndCaps =
-            [
-            // add other sources here as they light up
-            ManagedIdentitySource.ServiceFabric,
-            ];
+        [
+        // add other sources here as they light up
+        ManagedIdentitySource.ServiceFabric,
+        ];
 
         internal static bool SupportsClaimsAndCapabilities(
             this ManagedIdentitySource source) => s_supportsClaimsAndCaps.Contains(source);

src/client/Microsoft.Identity.Client/ManagedIdentity/ServiceFabricManagedIdentitySource.cs

@@ -75,8 +75,7 @@ private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri en
             }
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource, 
-            AcquireTokenForManagedIdentityParameters parameters)
+        protected override ManagedIdentityRequest CreateRequest(string resource)
         {
             ManagedIdentityRequest request = new ManagedIdentityRequest(HttpMethod.Get, _endpoint);