Process composite OBO tokens (#2221)

* Investigation (to understand requirements)

* Updating comments

* Remove assertion and sub_assertion from
extra query parameters.

src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

@@ -715,9 +715,28 @@ private IConfidentialClientApplication BuildConfidentialClientApplication(Merged
                     if (tokenAcquisitionOptions != null)
                     {
                         var dict = MergeExtraQueryParameters(mergedOptions, tokenAcquisitionOptions);
-
                         if (dict != null)
                         {
+                            const string assertionConstant = "assertion";
+                            const string subAssertionConstant = "sub_assertion";
+
+                            // Special case when the OBO inbound token is composite (for instance PFT)
+                            if (dict.ContainsKey(assertionConstant) && dict.ContainsKey(subAssertionConstant))
+                            {
+                                builder.OnBeforeTokenRequest((data) =>
+                                {
+                                    // Replace the assertion and adds sub_assertion with the values from the extra query parameters
+                                    data.BodyParameters[assertionConstant] = dict[assertionConstant];
+                                    data.BodyParameters.Add(subAssertionConstant, dict[subAssertionConstant]);
+                                    return Task.CompletedTask;
+                                });
+
+                                // Remove the assertion and sub_assertion from the extra query parameters
+                                // as they are already handled as body parameters.
+                                dict.Remove(assertionConstant);
+                                dict.Remove(subAssertionConstant);
+                            }
+
                             builder.WithExtraQueryParameters(dict);
                         }
                         if (tokenAcquisitionOptions.ExtraHeadersParameters != null)