[Bug] In Web APIs we don't need to call AcquireTokenSilent before calling AcquireTokenOnBehalfOf

[jmprieur]

Which version of Microsoft Identity Web are you using?
0.2.1-preview

Where is the issue?

• Web app
  • Sign-in users
  • Sign-in users and call web APIs
• Web API
  • Protected web APIs (validating tokens)
  • Protected web APIs (validating scopes)
  • [x ] Protected web APIs call downstream web APIs
• Token cache serialization
  • In-memory caches
  • Session caches
  • Distributed caches
• Other (please describe)

Repro

tokenAcqusition.GetTokenForUserAsync()

Expected behavior

It's not necessary to call AcquireTokenSilent in the case of a Web API before calling AcquireTokenOnBehalfOf as AcquireTokenOnBehalfOf does a cache lookup (filtered with the hash of the incoming token). Suggesting to invert the conditions (testing first by if (validatedToken != null)), and in that case doing only OBO. In the other case do the AcquireToken from cache and process the exception to step-up.

microsoft-identity-web/src/Microsoft.Identity.Web/TokenAcquisition.cs

Line 268 in 3c77e3c

if (validatedToken != null)

BTW (but this might be another work item), in the other case (Web app) could we just challenge the user as we have all the information ?

Actual behavior
the code calls AcquireTokenSilent always, and then differentiates OBO or not. And therefore in Web APIs there are 2 cache lookups.

[jmprieur]

cc: @jennyf19 @bgavrilMS

[jennyf19]

Included in 0.2.2-preview release