Skip to content

Commit 30b15d8

Browse files
unpluggedkunpluggedk
authored
Merge pull request #140 from AzureAD/oldalton/msal_updates_to_cache
Additional fixes based on MSAL integration
2 parents d347abf + cec6650 commit 30b15d8

9 files changed

+229
-45
lines changed

‎IdentityCore/src/cache/accessor/MSIDDefaultTokenCacheAccessor.h

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -48,18 +48,18 @@
4848
context:(id<MSIDRequestContext>)context
4949
error:(NSError **)error;
5050

51-
- (BOOL)removeAllTokensForAccount:(MSIDAccountIdentifier *)account
52-
environment:(NSString *)environment
53-
clientId:(NSString *)clientId
54-
context:(id<MSIDRequestContext>)context
55-
error:(NSError **)error;
51+
- (BOOL)clearCacheForAccount:(MSIDAccountIdentifier *)account
52+
environment:(NSString *)environment
53+
clientId:(NSString *)clientId
54+
context:(id<MSIDRequestContext>)context
55+
error:(NSError **)error;
5656

5757
- (BOOL)validateAndRemoveRefreshToken:(MSIDRefreshToken *)token
5858
context:(id<MSIDRequestContext>)context
5959
error:(NSError **)error;
6060

61-
- (BOOL)removeAccessToken:(MSIDAccessToken *)token
62-
context:(id<MSIDRequestContext>)context
63-
error:(NSError **)error;
61+
- (BOOL)removeToken:(MSIDBaseToken *)token
62+
context:(id<MSIDRequestContext>)context
63+
error:(NSError **)error;
6464

6565
@end

‎IdentityCore/src/cache/accessor/MSIDDefaultTokenCacheAccessor.m

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,7 @@ - (MSIDIdToken *)getIDTokenForAccount:(MSIDAccountIdentifier *)account
246246
NSArray<NSString *> *environmentAliases = [[MSIDAadAuthorityCache sharedInstance] cacheAliasesForEnvironment:environment];
247247
__auto_type accountsPerUserId = [self getAccountsPerUserIdForAliases:environmentAliases context:context error:error];
248248

249-
if (![accountsPerUserId count])
249+
if (!accountsPerUserId)
250250
{
251251
MSID_LOG_INFO(context, @"No accounts found, returning!");
252252
[self stopCacheEvent:event withItem:nil success:NO context:context];
@@ -304,11 +304,11 @@ - (BOOL)removeAccount:(MSIDAccount *)account
304304
return result;
305305
}
306306

307-
- (BOOL)removeAllTokensForAccount:(MSIDAccountIdentifier *)account
308-
environment:(NSString *)environment
309-
clientId:(NSString *)clientId
310-
context:(id<MSIDRequestContext>)context
311-
error:(NSError **)error
307+
- (BOOL)clearCacheForAccount:(MSIDAccountIdentifier *)account
308+
environment:(NSString *)environment
309+
clientId:(NSString *)clientId
310+
context:(id<MSIDRequestContext>)context
311+
error:(NSError **)error
312312
{
313313
if (!account
314314
|| !environment
@@ -328,6 +328,18 @@ - (BOOL)removeAllTokensForAccount:(MSIDAccountIdentifier *)account
328328

329329
BOOL result = [_accountCredentialCache removeCredetialsWithQuery:query context:context error:error];
330330

331+
if (!result)
332+
{
333+
[self stopCacheEvent:event withItem:nil success:NO context:context];
334+
return NO;
335+
}
336+
337+
MSIDDefaultAccountCacheQuery *accountsQuery = [MSIDDefaultAccountCacheQuery new];
338+
accountsQuery.homeAccountId = account.homeAccountId;
339+
accountsQuery.environment = environment;
340+
341+
result = [_accountCredentialCache removeAccountsWithQuery:accountsQuery context:context error:error];
342+
331343
[self stopCacheEvent:event withItem:nil success:result context:context];
332344
return result;
333345
}
@@ -368,13 +380,6 @@ - (BOOL)validateAndRemoveRefreshToken:(MSIDRefreshToken *)token
368380
return YES;
369381
}
370382

371-
- (BOOL)removeAccessToken:(MSIDAccessToken *)token
372-
context:(id<MSIDRequestContext>)context
373-
error:(NSError **)error
374-
{
375-
return [self removeToken:token context:context error:error];
376-
}
377-
378383
#pragma mark - Input validation
379384

380385
- (BOOL)checkUserIdentifier:(NSString *)userIdentifier

‎IdentityCore/src/cache/accessor/MSIDLegacyTokenCacheAccessor.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,8 @@
5353
context:(id<MSIDRequestContext>)context
5454
error:(NSError **)error;
5555

56+
- (BOOL)clearCacheForAccount:(MSIDAccountIdentifier *)account
57+
context:(id<MSIDRequestContext>)context
58+
error:(NSError **)error;
59+
5660
@end

‎IdentityCore/src/cache/accessor/MSIDLegacyTokenCacheAccessor.m

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ - (BOOL)clearWithContext:(id<MSIDRequestContext>)context
214214
NSArray<NSString *> *environmentAliases = [[MSIDAadAuthorityCache sharedInstance] cacheAliasesForEnvironment:environment];
215215

216216
BOOL (^filterBlock)(MSIDCredentialCacheItem *tokenCacheItem) = ^BOOL(MSIDCredentialCacheItem *tokenCacheItem) {
217-
if (![tokenCacheItem.environment msidIsEquivalentWithAnyAlias:environmentAliases])
217+
if ([environmentAliases count] && ![tokenCacheItem.environment msidIsEquivalentWithAnyAlias:environmentAliases])
218218
{
219219
return NO;
220220
}
@@ -329,6 +329,32 @@ - (BOOL)removeAccessToken:(MSIDLegacyAccessToken *)token
329329
return [self removeToken:token userId:token.legacyUserId context:context error:error];
330330
}
331331

332+
- (BOOL)clearCacheForAccount:(MSIDAccountIdentifier *)account
333+
context:(id<MSIDRequestContext>)context
334+
error:(NSError **)error
335+
{
336+
if (!account.legacyAccountId)
337+
{
338+
[self fillInternalErrorWithMessage:@"Can't clear cache without user id" context:context error:error];
339+
return NO;
340+
}
341+
342+
MSID_LOG_VERBOSE(context, @"(Legacy accessor) Clearing cache with account");
343+
MSID_LOG_VERBOSE_PII(context, @"(Legacy accessor) Clearing cache with account %@", account.legacyAccountId);
344+
345+
MSIDTelemetryCacheEvent *event = [self startCacheEventWithName:MSID_TELEMETRY_EVENT_TOKEN_CACHE_DELETE context:context];
346+
347+
MSIDLegacyTokenCacheQuery *query = [MSIDLegacyTokenCacheQuery new];
348+
query.legacyUserId = account.legacyAccountId;
349+
350+
BOOL result = [_dataSource removeItemsWithKey:query context:context error:error];
351+
352+
[_dataSource saveWipeInfoWithContext:context error:nil];
353+
354+
[self stopTelemetryEvent:event withItem:nil success:result context:context];
355+
return result;
356+
}
357+
332358
#pragma mark - Input validation
333359

334360
- (void)fillInternalErrorWithMessage:(NSString *)message

‎IdentityCore/src/cache/mac/MSIDMacTokenCache.m

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,12 @@ - (BOOL)removeItemsWithKeyImpl:(MSIDCacheKey *)key
385385
{
386386
return YES;
387387
}
388+
389+
if (!key.service)
390+
{
391+
[self.cache[@"tokens"] removeObjectForKey:userId];
392+
return YES;
393+
}
388394

389395
if (![userTokens objectForKey:[self legacyKeyWithoutAccount:key]])
390396
{

‎IdentityCore/src/cache/token/MSIDAccountCacheItem.m

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ - (BOOL)matchesWithHomeAccountId:(nullable NSString *)homeAccountId
201201
return NO;
202202
}
203203

204-
if (environmentAliases && ![self.environment msidIsEquivalentWithAnyAlias:environmentAliases])
204+
if ([environmentAliases count] && ![self.environment msidIsEquivalentWithAnyAlias:environmentAliases])
205205
{
206206
return NO;
207207
}

‎IdentityCore/src/cache/token/MSIDCredentialCacheItem.m

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ - (BOOL)matchByEnvironment:(nullable NSString *)environment
284284
return NO;
285285
}
286286

287-
if (environmentAliases && ![self.environment msidIsEquivalentWithAnyAlias:environmentAliases])
287+
if ([environmentAliases count] && ![self.environment msidIsEquivalentWithAnyAlias:environmentAliases])
288288
{
289289
return NO;
290290
}
@@ -299,7 +299,7 @@ - (BOOL)matchesWithRealm:(nullable NSString *)realm
299299
targetMatching:(MSIDComparisonOptions)matchingOptions
300300
clientIdMatching:(MSIDComparisonOptions)clientIDMatchingOptions
301301
{
302-
if (clientIDMatchingOptions == SuperSet)
302+
if (clientIDMatchingOptions == SuperSet && (clientId || familyId))
303303
{
304304
if (![self.clientId isEqualToString:clientId]
305305
&& ![self.familyId isEqualToString:familyId])

‎IdentityCore/tests/integration/MSIDDefaultAccessorSSOIntegrationTests.m

Lines changed: 113 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1450,7 +1450,7 @@ - (void)testRemoveAccessToken_whenTokenProvided_shouldRemoveToken
14501450
MSIDAccessToken *secondToken = accessTokens[1];
14511451

14521452
NSError *error = nil;
1453-
BOOL result = [_defaultAccessor removeAccessToken:secondToken context:nil error:&error];
1453+
BOOL result = [_defaultAccessor removeToken:secondToken context:nil error:&error];
14541454
XCTAssertTrue(result);
14551455
XCTAssertNil(error);
14561456

@@ -1462,10 +1462,63 @@ - (void)testRemoveAccessToken_whenTokenProvided_shouldRemoveToken
14621462
XCTAssertEqual([remaininRefreshTokens count], 1);
14631463
}
14641464

1465+
- (void)testRemoveIDToken_whenTokenProvided_shouldRemoveToken
1466+
{
1467+
// Save first token
1468+
[self saveResponseWithUPN:@"[email protected]"
1469+
clientId:@"test_client_id2"
1470+
authority:@"https://login.windows.net/common"
1471+
responseScopes:@"user.read user.write"
1472+
inputScopes:@"user.read user.write"
1473+
uid:@"uid"
1474+
utid:@"utid"
1475+
accessToken:@"access token"
1476+
refreshToken:@"refresh token"
1477+
familyId:nil
1478+
accessor:_nonSSOAccessor];
1479+
1480+
// Save first token
1481+
[self saveResponseWithUPN:@"[email protected]"
1482+
clientId:@"test_client_id"
1483+
authority:@"https://login.windows.net/common"
1484+
responseScopes:@"user.sing"
1485+
inputScopes:@"user.sing"
1486+
uid:@"uid"
1487+
utid:@"utid"
1488+
accessToken:@"access token"
1489+
refreshToken:@"refresh token"
1490+
familyId:nil
1491+
accessor:_nonSSOAccessor];
1492+
1493+
NSArray *accessTokens = [self getAllAccessTokens];
1494+
XCTAssertEqual([accessTokens count], 2);
1495+
1496+
NSArray *refreshTokens = [self getAllRefreshTokens];
1497+
XCTAssertEqual([refreshTokens count], 2);
1498+
1499+
NSArray *idTokens = [self getAllIDTokens];
1500+
XCTAssertEqual([idTokens count], 2);
1501+
1502+
MSIDIdToken *firstToken = idTokens[0];
1503+
MSIDIdToken *secondToken = idTokens[1];
1504+
1505+
NSError *error = nil;
1506+
BOOL result = [_defaultAccessor removeToken:secondToken context:nil error:&error];
1507+
XCTAssertTrue(result);
1508+
XCTAssertNil(error);
1509+
1510+
NSArray *remainingIDTokens = [self getAllIDTokens];
1511+
XCTAssertEqual([remainingIDTokens count], 1);
1512+
XCTAssertEqualObjects(remainingIDTokens[0], firstToken);
1513+
1514+
NSArray *remaininRefreshTokens = [self getAllRefreshTokens];
1515+
XCTAssertEqual([remaininRefreshTokens count], 2);
1516+
}
1517+
14651518
- (void)testRemoveAccessToken_whenNilTokenProvided_shouldReturnError
14661519
{
14671520
NSError *error = nil;
1468-
BOOL result = [_defaultAccessor removeAccessToken:nil context:nil error:&error];
1521+
BOOL result = [_defaultAccessor removeToken:nil context:nil error:&error];
14691522
XCTAssertFalse(result);
14701523
XCTAssertNotNil(error);
14711524
XCTAssertEqual(error.code, MSIDErrorInternal);
@@ -1670,42 +1723,53 @@ - (void)testRemoveAccount_whenAccountNotNil_shouldRemoveAccount
16701723
XCTAssertNil(error);
16711724

16721725
accounts = [_defaultAccessor allAccountsForEnvironment:@"login.windows.net" clientId:@"test_client_id" familyId:nil context:nil error:&error];
1673-
XCTAssertNil(accounts);
16741726
XCTAssertNil(error);
16751727
XCTAssertEqual([accounts count], 0);
16761728
}
16771729

1678-
#pragma mark - RemoveAllTokensForAccount
1730+
#pragma mark - clearCacheForAccount
16791731

1680-
- (void)testRemoveAllTokensForAccount_whenNilAccount_shouldReturnError
1732+
- (void)testClearCacheForAccount_whenNilAccount_shouldReturnError
16811733
{
16821734
NSError *error = nil;
1683-
BOOL result = [_defaultAccessor removeAllTokensForAccount:nil environment:@"login.microsoftonline.com" clientId:@"test_client_id" context:nil error:&error];
1735+
BOOL result = [_defaultAccessor clearCacheForAccount:nil environment:@"login.microsoftonline.com" clientId:@"test_client_id" context:nil error:&error];
16841736
XCTAssertFalse(result);
16851737
XCTAssertNotNil(error);
16861738
XCTAssertEqual(error.code, MSIDErrorInternal);
16871739
}
16881740

1689-
- (void)testRemoveAllTokensForAccount_whenNilClientId_shouldReturnError
1741+
- (void)testClearCacheForAccount_whenNilClientId_shouldReturnError
16901742
{
16911743
NSError *error = nil;
1692-
BOOL result = [_defaultAccessor removeAllTokensForAccount:[MSIDAccountIdentifier new] environment:@"login.microsoftonline.com" clientId:nil context:nil error:&error];
1744+
BOOL result = [_defaultAccessor clearCacheForAccount:[MSIDAccountIdentifier new] environment:@"login.microsoftonline.com" clientId:nil context:nil error:&error];
16931745
XCTAssertFalse(result);
16941746
XCTAssertNotNil(error);
16951747
XCTAssertEqual(error.code, MSIDErrorInternal);
16961748
}
16971749

1698-
- (void)testRemoveAllTokensForAccount_whenNilEnvironment_shouldReturnError
1750+
- (void)testClearCacheForAccount_whenNilEnvironment_shouldReturnError
16991751
{
17001752
NSError *error = nil;
1701-
BOOL result = [_defaultAccessor removeAllTokensForAccount:[MSIDAccountIdentifier new] environment:nil clientId:@"test" context:nil error:&error];
1753+
BOOL result = [_defaultAccessor clearCacheForAccount:[MSIDAccountIdentifier new] environment:nil clientId:@"test" context:nil error:&error];
17021754
XCTAssertFalse(result);
17031755
XCTAssertNotNil(error);
17041756
XCTAssertEqual(error.code, MSIDErrorInternal);
17051757
}
17061758

1707-
- (void)testRemoveAllTokenForAccount_whenAccountProvided_shouldRemoveTokens
1759+
- (void)testClearCacheForAccount_whenAccountProvided_shouldRemoveTokens
17081760
{
1761+
[self saveResponseWithUPN:@"[email protected]"
1762+
clientId:@"test_client_id"
1763+
authority:@"https://login.windows.net/common"
1764+
responseScopes:@"user.sing"
1765+
inputScopes:@"user.sing"
1766+
uid:@"uid2"
1767+
utid:@"utid2"
1768+
accessToken:@"access token 2"
1769+
refreshToken:@"refresh token"
1770+
familyId:nil
1771+
accessor:_nonSSOAccessor];
1772+
17091773
[self saveResponseWithUPN:@"[email protected]"
17101774
clientId:@"test_client_id"
17111775
authority:@"https://login.windows.net/common"
@@ -1735,35 +1799,64 @@ - (void)testRemoveAllTokenForAccount_whenAccountProvided_shouldRemoveTokens
17351799

17361800
XCTAssertNotNil(accounts);
17371801
XCTAssertNil(error);
1738-
XCTAssertEqual([accounts count], 1);
1802+
XCTAssertEqual([accounts count], 2);
17391803

17401804
NSArray *allATs = [self getAllAccessTokens];
1741-
XCTAssertEqual([allATs count], 2);
1805+
XCTAssertEqual([allATs count], 3);
17421806

17431807
NSArray *allRTs = [self getAllRefreshTokens];
1744-
XCTAssertEqual([allRTs count], 1);
1808+
XCTAssertEqual([allRTs count], 2);
17451809

17461810
NSArray *allIDs = [self getAllIDTokens];
1747-
XCTAssertEqual([allIDs count], 1);
1811+
XCTAssertEqual([allIDs count], 2);
17481812

1749-
MSIDAccount *account = accounts[0];
1813+
MSIDAccount *account = nil;
1814+
1815+
for (MSIDAccount *accountInCache in accounts)
1816+
{
1817+
if ([accountInCache.homeAccountId isEqualToString:@"uid.utid"])
1818+
{
1819+
account = accountInCache;
1820+
break;
1821+
}
1822+
}
1823+
1824+
XCTAssertNotNil(account);
17501825

17511826
MSIDAccountIdentifier *identifier = [MSIDAccountIdentifier new];
17521827
identifier.homeAccountId = account.homeAccountId;
17531828
identifier.legacyAccountId = account.username;
17541829

1755-
BOOL result = [_defaultAccessor removeAllTokensForAccount:identifier environment:@"login.windows.net" clientId:@"test_client_id" context:nil error:&error];
1830+
BOOL result = [_defaultAccessor clearCacheForAccount:identifier environment:@"login.windows.net" clientId:@"test_client_id" context:nil error:&error];
17561831
XCTAssertTrue(result);
17571832
XCTAssertNil(error);
17581833

17591834
allATs = [self getAllAccessTokens];
1760-
XCTAssertEqual([allATs count], 0);
1835+
XCTAssertEqual([allATs count], 1);
1836+
1837+
MSIDAccessToken *accessToken = allATs[0];
1838+
XCTAssertEqualObjects(accessToken.homeAccountId, @"uid2.utid2");
17611839

17621840
allRTs = [self getAllRefreshTokens];
1763-
XCTAssertEqual([allRTs count], 0);
1841+
XCTAssertEqual([allRTs count], 1);
1842+
1843+
MSIDRefreshToken *refreshToken = allRTs[0];
1844+
XCTAssertEqualObjects(refreshToken.homeAccountId, @"uid2.utid2");
17641845

17651846
allIDs = [self getAllIDTokens];
1766-
XCTAssertEqual([allIDs count], 0);
1847+
XCTAssertEqual([allIDs count], 1);
1848+
MSIDIdToken *idToken = allIDs[0];
1849+
XCTAssertEqualObjects(idToken.homeAccountId, @"uid2.utid2");
1850+
1851+
accounts = [_defaultAccessor allAccountsForEnvironment:@"login.windows.net"
1852+
clientId:@"test_client_id"
1853+
familyId:nil
1854+
context:nil
1855+
error:&error];
1856+
XCTAssertEqual([accounts count], 1);
1857+
1858+
MSIDAccount *remainingAccount = accounts[0];
1859+
XCTAssertEqualObjects(remainingAccount.homeAccountId, @"uid2.utid2");
17671860
}
17681861

17691862
#pragma mark - Helpers

0 commit comments

Comments
 (0)