It's not possible to set extra query parameters on auth code redemption

[jmprieur]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.x

Web app

Sign-in users

Web API

Not Applicable

Token cache serialization

Not Applicable

Description

Why?

Sometimes, all calls to the IdP need to have extra query parameters (for instance a test slice):

1. Getting the OIDC metadata document (for web apps)
2. Going to the authorize endpoint (this is done by ASP.NET Core OIDC middleware)
3. Redeeming the code (done by MSAL going to the token endpoint. but no TokenAcquirerOptions possibliity)
4. Calling downstream APIs: MSAL going to the token endpoint, using TokenAcquirerOptions.

It's possible to pass-in extra query parameters for 1. and 2.

services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme,
  options =>
  {
      var previous = options.Events.OnRedirectToIdentityProvider;
      options.Events.OnRedirectToIdentityProvider = async context =>
      {
          // In the case you want to change the tenant ID based on the MyApp query parameter:
          context.ProtocolMessage.Parameters.Add("dc", "test-slice-name");
          await previous(context);
      };
  });

It's not possible for 3.

It's possible for 4, by setting extra query parameters in TokenAcquirerOptions

Reproduction steps

See above

Error message

No response

Id Web logs

No response

Relevant code snippets

See above

Regression

No response

Expected behavior

Have the possibility of setting the ExtraQueryParameters in the MicrosoftIdentityApplicationOptions, and apply them automatically to:

1. Getting the OIDC metadata document (for web apps)
2. Going to the authorize endpoint (this is done by ASP.NET Core OIDC middleware)
3. Redeeming the code (done by MSAL going to the token endpoint. but no TokenAcquirerOptions possibliity)

Then, for calling a downstream APIs override (if needed) these application options with the TokenAcquirerOptions.ExtraQueryParameters that would have the same key

[bgavrilMS]

In my testing, the code below did not add the param on (1)

services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme,
  options =>
  {
      var previous = options.Events.OnRedirectToIdentityProvider;
      options.Events.OnRedirectToIdentityProvider = async context =>
      {
          // In the case you want to change the tenant ID based on the MyApp query parameter:
          context.ProtocolMessage.Parameters.Add("dc", "test-slice-name");
          await previous(context);
      };
  });