From 72d04e91a7d09d647de48c460a479d5353229be4 Mon Sep 17 00:00:00 2001 From: Alberto Spelta Date: Wed, 21 Oct 2026 16:53:48 +0200 Subject: [PATCH] fix: update MSAL to 4.83.3 so system-browser sign-in works The Entra app used by Bravo accepts only response_mode=form_post and rejects the query response mode (AADSTS70007). The loopback listener in MSAL 4.73.1 reads only query responses, so sign-in with the system browser failed. MSAL 4.83.3 uses form_post for the system browser and reads the POST body. This is the same version Power BI Desktop 2.159 ships. MSAL Desktop 4.83.3 requires WebView2 1.0.2903.40 or later. That package references its WPF control in every .NET project, and the WPF assembly built for net5.0 references WindowsBase 5.0, which conflicts with the framework's WindowsBase (MSB3277, WebView2Feedback#4959). Bravo hosts only the WinForms control, so a target in Directory.Build.targets removes the WPF reference before assembly resolution in every SDK-style project, including the test project that gets the package through Bravo. The WPF assembly is no longer copied to the output, so the installer transform stops packaging it. MSAL 4.83 makes the string overload of WithExtraQueryParameters obsolete. msafed=0 is now passed as a static read-only dictionary through the new overload and kept out of the token cache key, because it only filters the accounts offered at sign-in. --- Directory.Build.targets | 16 ++++++ installer/wix/src/Bravo/Bravo.xslt | 3 +- src/Bravo.csproj | 4 +- .../CloudAuthenticationClient.cs | 12 +++-- src/packages.lock.json | 50 +++++++++---------- 5 files changed, 53 insertions(+), 32 deletions(-) create mode 100644 Directory.Build.targets diff --git a/Directory.Build.targets b/Directory.Build.targets new file mode 100644 index 00000000..32683d8a --- /dev/null +++ b/Directory.Build.targets @@ -0,0 +1,16 @@ + + + + + + + + + + diff --git a/installer/wix/src/Bravo/Bravo.xslt b/installer/wix/src/Bravo/Bravo.xslt index d6d8b200..c0569429 100644 --- a/installer/wix/src/Bravo/Bravo.xslt +++ b/installer/wix/src/Bravo/Bravo.xslt @@ -31,7 +31,7 @@ - + @@ -60,7 +60,6 @@ - diff --git a/src/Bravo.csproj b/src/Bravo.csproj index 9942425c..91993c0b 100644 --- a/src/Bravo.csproj +++ b/src/Bravo.csproj @@ -54,8 +54,8 @@ - - + + diff --git a/src/Infrastructure/PowerBI/Cloud/Authentication/CloudAuthenticationClient.cs b/src/Infrastructure/PowerBI/Cloud/Authentication/CloudAuthenticationClient.cs index d0ffd560..df42bd3b 100644 --- a/src/Infrastructure/PowerBI/Cloud/Authentication/CloudAuthenticationClient.cs +++ b/src/Infrastructure/PowerBI/Cloud/Authentication/CloudAuthenticationClient.cs @@ -1,4 +1,6 @@ using System; +using System.Collections.Generic; +using System.Collections.ObjectModel; using System.Linq; using System.Threading; using System.Threading.Tasks; @@ -25,7 +27,11 @@ public interface ICloudAuthenticationClient internal sealed class CloudAuthenticationClient(IPolicyService policyService) : ICloudAuthenticationClient { private const string SystemBrowserRedirectUri = "http://localhost"; - private const string OrganizationalAccountsOnlyQueryParameter = "msafed=0"; // no Microsoft accounts (MSA) allowed + + // msafed=0 allows organizational accounts only (no Microsoft accounts). It filters the accounts offered at + // sign-in and does not change the token, so it stays out of the cache key. + private static readonly ReadOnlyDictionary ExtraQueryParameters = new( + new Dictionary { ["msafed"] = ("0", false) }); private readonly IPolicyService _policyService = policyService; @@ -65,7 +71,7 @@ public async Task ClearTokenCacheAsync(CloudEnvironment environment) private static async Task AcquireTokenSilentAsync( IPublicClientApplication client, string[] scopes, string email, CancellationToken cancellationToken) { - var extraQueryParameters = OrganizationalAccountsOnlyQueryParameter; + var extraQueryParameters = ExtraQueryParameters; var loginHint = email; var builder = client.AcquireTokenSilent(scopes, loginHint) @@ -79,7 +85,7 @@ public async Task ClearTokenCacheAsync(CloudEnvironment environment) { var useSystemBrowser = _policyService.Current.UseSystemBrowserForAuthentication ?? UserPreferences.Current.UseSystemBrowserForAuthentication; var useEmbeddedBrowser = !useSystemBrowser; - var extraQueryParameters = OrganizationalAccountsOnlyQueryParameter; + var extraQueryParameters = ExtraQueryParameters; var prompt = Prompt.SelectAccount; var loginHint = email; diff --git a/src/packages.lock.json b/src/packages.lock.json index 5d132fa8..3da03ef9 100644 --- a/src/packages.lock.json +++ b/src/packages.lock.json @@ -97,20 +97,20 @@ }, "Microsoft.Identity.Client.Desktop": { "type": "Direct", - "requested": "[4.73.1, )", - "resolved": "4.73.1", - "contentHash": "9icFisK5u6eb+MYwPFTyilue+5gU/kiyTLj8M5tpUokGAmxK7ByYh9v6z//k0JKg3dZ+l7IQaHKdGFNwCgk18A==", + "requested": "[4.83.3, )", + "resolved": "4.83.3", + "contentHash": "FaGsOLZm6KR0pgj3rkKLUMXni4LSpAiCaUK66PU7XnbU1rgH+1IouWj2vGfRPpSKpV7DDdUSfKEYhZFS+FpBfw==", "dependencies": { - "Microsoft.Identity.Client": "4.73.1", - "Microsoft.Identity.Client.Broker": "4.73.1", - "Microsoft.Web.WebView2": "1.0.864.35" + "Microsoft.Identity.Client": "4.83.3", + "Microsoft.Identity.Client.Broker": "4.83.3", + "Microsoft.Web.WebView2": "1.0.2903.40" } }, "Microsoft.Web.WebView2": { "type": "Direct", - "requested": "[1.0.2739.15, )", - "resolved": "1.0.2739.15", - "contentHash": "hZg7vHWBg4RIiK3rhkNqX3hcBqqoVXVrrO2BVrVOiSmEgfLa7lY64G1tWh2VY84MfHIFLCAQNwn3Rwvu+ICHyw==" + "requested": "[1.0.2903.40, )", + "resolved": "1.0.2903.40", + "contentHash": "THrzYAnJgE3+cNH+9Epr44XjoZoRELdVpXlWGPs6K9C9G6TqyDfVCeVAR/Er8ljLitIUX5gaSkPsy9wRhD1sgQ==" }, "Microsoft.Windows.CsWin32": { "type": "Direct", @@ -202,30 +202,30 @@ }, "Microsoft.Identity.Client": { "type": "Transitive", - "resolved": "4.73.1", - "contentHash": "NnDLS8QwYqO5ZZecL2oioi1LUqjh5Ewk4bMLzbgiXJbQmZhDLtKwLxL3DpGMlQAJ2G4KgEnvGPKa+OOgffeJbw==", + "resolved": "4.83.3", + "contentHash": "XNJJn5uctuGvl3u6qzAof2TNysAZ/PPVKzkAglxvTO5XHgff/Ibs1+yi2G26Xrf6X/f780kS4fMKKdHcGb96hQ==", "dependencies": { - "Microsoft.IdentityModel.Abstractions": "6.35.0" + "Microsoft.IdentityModel.Abstractions": "8.14.0" } }, "Microsoft.Identity.Client.Broker": { "type": "Transitive", - "resolved": "4.73.1", - "contentHash": "gCtm9dYAwKohMXcVXFRv8/7IIJQTkCNu6S9mSmxvJ8geNGRhQ3F/PDOMlloCulEgpkIhKwclOLV+aUlIWrEWxA==", + "resolved": "4.83.3", + "contentHash": "1yn682hgnCimnYR27Ne/SRMWxCWUZtCKjYwPzWbjrfhqBF1GS7bDlPZkF4yvJxl90Y+xzDdZFh4u9pcGIFSEvw==", "dependencies": { - "Microsoft.Identity.Client": "4.73.1", - "Microsoft.Identity.Client.NativeInterop": "0.19.2" + "Microsoft.Identity.Client": "4.83.3", + "Microsoft.Identity.Client.NativeInterop": "0.20.4" } }, "Microsoft.Identity.Client.NativeInterop": { "type": "Transitive", - "resolved": "0.19.2", - "contentHash": "qXNtYJxZ15yKV5pnI+V0sRzIH++vNzmMOU3K8kyNGsMD8/q7+ZejQjm7gJI9MMEGDPQkGg3QaiMvrIgbH2ym2g==" + "resolved": "0.20.4", + "contentHash": "JHlfJ8oolxj20sNlwdIh8H8MZtzVQ55MyOjrIrQCtD/KJL5x8EOjQxafYu8AEYZOCSW+09DQnRogGk+J37BURA==" }, "Microsoft.IdentityModel.Abstractions": { "type": "Transitive", - "resolved": "6.35.0", - "contentHash": "xuR8E4Rd96M41CnUSCiOJ2DBh+z+zQSmyrYHdYhD6K4fXBcQGVnRCFQ0efROUYpP+p0zC1BLKr0JRpVuujTZSg==" + "resolved": "8.14.0", + "contentHash": "iwbCpSjD3ehfTwBhtSNEtKPK0ICun6ov7Ibx6ISNA9bfwIyzI2Siwyi9eJFCJBwxowK9xcA1mj+jBWiigeqgcQ==" }, "Microsoft.OpenApi": { "type": "Transitive", @@ -285,9 +285,9 @@ "net10.0-windows7.0/win-x64": { "Microsoft.Web.WebView2": { "type": "Direct", - "requested": "[1.0.2739.15, )", - "resolved": "1.0.2739.15", - "contentHash": "hZg7vHWBg4RIiK3rhkNqX3hcBqqoVXVrrO2BVrVOiSmEgfLa7lY64G1tWh2VY84MfHIFLCAQNwn3Rwvu+ICHyw==" + "requested": "[1.0.2903.40, )", + "resolved": "1.0.2903.40", + "contentHash": "THrzYAnJgE3+cNH+9Epr44XjoZoRELdVpXlWGPs6K9C9G6TqyDfVCeVAR/Er8ljLitIUX5gaSkPsy9wRhD1sgQ==" }, "Microsoft.AnalysisServices.AdomdClient": { "type": "Transitive", @@ -300,8 +300,8 @@ }, "Microsoft.Identity.Client.NativeInterop": { "type": "Transitive", - "resolved": "0.19.2", - "contentHash": "qXNtYJxZ15yKV5pnI+V0sRzIH++vNzmMOU3K8kyNGsMD8/q7+ZejQjm7gJI9MMEGDPQkGg3QaiMvrIgbH2ym2g==" + "resolved": "0.20.4", + "contentHash": "JHlfJ8oolxj20sNlwdIh8H8MZtzVQ55MyOjrIrQCtD/KJL5x8EOjQxafYu8AEYZOCSW+09DQnRogGk+J37BURA==" }, "System.IO.FileSystem.AccessControl": { "type": "Transitive",