Add support for custom claims and password change required error #7948
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This pull request adds comprehensive support for custom claims in authentication flows within the msal-browser library and enhances error handling for password reset requirements. The implementation ensures claims are properly validated as JSON objects and propagated through various authentication processes.
Key Changes:
- Added
claimsfield support across multiple input types and authentication flows (sign-in, access token retrieval, continuation token flows) - Implemented
ensureArgumentIsJSONStringutility function to validate claims as properly formatted JSON objects - Enhanced error handling to detect password reset required scenarios (error code 50142)
Reviewed Changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| ArgumentValidator.ts | Added new ensureArgumentIsJSONString function for JSON validation |
| ArgumentValidator.spec.ts | Comprehensive unit tests for the new JSON validation function |
| CustomAuthActionInputs.ts | Added optional claims field to input type definitions |
| SignInParams.ts | Added claims field to SignIn parameter interfaces |
| SignInClient.ts | Updated token request methods to include claims parameter |
| SignInStateParameters.ts | Added claims field to state parameter interfaces |
| SignInPasswordRequiredState.ts | Propagated claims through password submission flow |
| SignInContinuationState.ts | Added claims validation and propagation for continuation token flow |
| SignInCodeRequiredState.ts | Propagated claims through code submission flow |
| SignInError.ts | Added isPasswordResetRequired method for error detection |
| CustomAuthAccountData.ts | Enhanced access token retrieval to support claims parameter |
| AuthFlowErrorBase.ts | Added password reset error detection logic |
| CustomAuthStandardController.ts | Updated sign-in flow to validate and propagate claims |
| ApiRequestTypes.ts | Added claims field to API request type definitions |
| SignInApiClient.ts | Updated API client methods to include claims in requests |
| Multiple test files | Added test coverage for claims functionality and cache cleanup |
lib/msal-browser/test/custom_auth/get_account/auth_flow/CustomAuthAccountData.spec.ts
Show resolved
Hide resolved
lib/msal-browser/test/custom_auth/core/utils/ArgumentValidator.spec.ts
Outdated
Show resolved
Hide resolved
lib/msal-browser/src/custom_auth/core/utils/ArgumentValidator.ts
Outdated
Show resolved
Hide resolved
konstantin-msft
previously approved these changes
Jul 28, 2025
sameerag
reviewed
Jul 28, 2025
change/@azure-msal-browser-5d0005f5-6c0f-4282-92d2-975f3bad562a.json
Outdated
Show resolved
Hide resolved
sameerag
reviewed
Jul 28, 2025
lib/msal-browser/src/custom_auth/controller/CustomAuthStandardController.ts
Show resolved
Hide resolved
konstantin-msft
approved these changes
Jul 28, 2025
sameerag
approved these changes
Jul 29, 2025
yongdiw
added a commit
that referenced
this pull request
Jul 30, 2025
This pull request introduces support for custom claims in various authentication flows within the `msal-browser` library. The most significant changes include adding a `claims` field to multiple input types, ensuring claims are valid JSON strings, and propagating the `claims` field through the authentication process. ### Support for custom claims: * Added a `claims` field to several input types (`SignInInputs`, `ResetPasswordInputs`, `AccessTokenRetrievalInputs`, and others) to allow custom claims during authentication. ### Validation enhancements: * Introduced a new utility function, `ensureArgumentIsJSONString`, to validate that the `claims` field is a properly formatted JSON string. This function is used in multiple places to ensure input integrity. ### Integration into authentication flows: * Updated the `CustomAuthStandardController` and related classes to handle the `claims` field during sign-in and token retrieval processes. * Modified API request types and parameters to include the `claims` field, ensuring it is passed to the backend during token requests. ### Error handling improvements: * Added methods to detect specific errors, such as password reset requirements, during authentication flows. ### Unit testing: * Enhanced the `ArgumentValidator` unit tests to cover the new `ensureArgumentIsJSONString` function.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces support for custom claims in various authentication flows within the
msal-browserlibrary. The most significant changes include adding aclaimsfield to multiple input types, ensuring claims are valid JSON strings, and propagating theclaimsfield through the authentication process.Support for custom claims:
claimsfield to several input types (SignInInputs,ResetPasswordInputs,AccessTokenRetrievalInputs, and others) to allow custom claims during authentication.Validation enhancements:
ensureArgumentIsJSONString, to validate that theclaimsfield is a properly formatted JSON string. This function is used in multiple places to ensure input integrity.Integration into authentication flows:
CustomAuthStandardControllerand related classes to handle theclaimsfield during sign-in and token retrieval processes.claimsfield, ensuring it is passed to the backend during token requests.Error handling improvements:
Unit testing:
ArgumentValidatorunit tests to cover the newensureArgumentIsJSONStringfunction.