Silent authentication call results in unexpected network call

[mjcheetham]

Which Version of MSAL are you using ?
MSAL.NET 3.0.8

Platform
net45

What authentication flow has the issue?

• Desktop / Mobile
  • Silent

Is this a new or existing app?
This is a new app or experiment.

Repro
Please see the following command line app which is a simplified model of how we are using MSAL:
https://gist.github.com/mjcheetham/d3faa36325beef54527a5434e6445ddb

The specific offending code is line 80:

app.AcquireTokenSilent(Scopes, account).ExecuteAsync()

Running the application once will perform an interactive authentication and store the AT/RT in a cache at %UserProfile%\.gettoken\msal.cache (using MSAL's cache extensibility APIs).

Running the application a second time will perform a silent authentication for the same user as previous.

Expected behavior
No web call is performed (unless the access token has expired).

Actual behavior
An instance discovery web call is made.

Possible Solution
Unknown.

Additional context/ Logs / Screenshots
Fiddler shows the following request:

..with the following response:

[bgavrilMS]

CC @henrik-me @MarkZuber

[henrik-me]

This is current expected behavior when starting a new process. We will look into how we can optimize this. If you have one process the result is stored in a process level static.

[mjcheetham]

This is current expected behavior when starting a new process. We will look into how we can optimize this. If you have one process the result is stored in a process level static.

Is there a possibility to store this kind of configuration information in a similar way to tokens (UserTokenCache .. ConfigurationCache)?

[bgavrilMS]

@mjcheetham - yes, this is our current approach but I need to figure out how we do expiration (i.e. 24h expiry? more? ) and refresh (i.e. refresh when the info is missing or expired, or also try to refresh whenever a non silent request is made).

Other proposals are:

• use HTTP request caching
• let the developers pass in a list of aliases

[stevehurcombe]

@jmprieur You pointed me at this issue, from #1040 but you also tagged this as Desktop. We're getting this on mobile.

[stevehurcombe]

@bgavrilMS my expectation is that if the token hasn't expired yet then there should no need to go out and update anything. If you have to do this then can it be done in a way that doesn't impact startup, especially on mobile?

How often is this information expected to change?