[cherry-pick] promote exception to property, add test (#3471) - #3486
Conversation
There was a problem hiding this comment.
Pull request overview
Cherry-picks the fix from #3471 to address a blocking-path bug in ConfigurationManager<T> where metadata fetch failures could lose the original exception during the backoff window, preventing callers from classifying client (4xx) vs server (5xx) errors.
Changes:
- Promote the blocking-path fetch failure exception from a local variable to an instance field so it persists across calls within
_syncAfterbackoff. - Clear the persisted failure on successful retrieval/update to avoid stale errors.
- Add a regression test ensuring the inner exception (and
HttpDocumentRetriever.StatusCodeinException.Data) is preserved during the backoff window.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| test/Microsoft.IdentityModel.Protocols.OpenIdConnect.Tests/ConfigurationManagerTests.cs | Adds a regression test verifying the blocking backoff path preserves the original inner exception/status code. |
| src/Microsoft.IdentityModel.Protocols/Configuration/ConfigurationManager.cs | Introduces an instance field to persist the most recent blocking-path fetch failure across calls. |
| src/Microsoft.IdentityModel.Protocols/Configuration/ConfigurationManager_Blocking.cs | Uses the persisted failure field (set on failure, cleared on success) when throwing during the backoff window. |
Mallika Chennupaty (mdchennu)
left a comment
There was a problem hiding this comment.
looks good to me, the comments added in the test were really helpful.
debchoudhury-id4s
left a comment
There was a problem hiding this comment.
was there a blocker preventing backporting #3471 earlier? Or was this timing intentional? Asking to learn about any possible release improvement.
The only blocker was lack of reviews |
…nIdConnect (#3696) Updated [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) from 4.12.2 to 4.14.2. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.14.2 ### Dependencies updates - Bump the `Microsoft.IdentityModel.*` (Wilson) version to 8.22.0. See [#3986](AzureAD/microsoft-identity-web#3986). - Fix the net8.0 crypto floor to use the patched `System.Security.Cryptography.Xml` 8.0.4 (and its `System.Security.Cryptography.Pkcs` 8.0.1 dependency) instead of over-bumping to the 9.0.18 servicing line (CVE-2026-47302, -47304, -50525, -50648). net9.0 (9.0.18) and net10.0 (10.0.10) are unchanged. See [#3989](AzureAD/microsoft-identity-web#3989). ## 4.14.0 ## New features - Add `MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience` to partition the app token cache by resource/audience. See #3979. - Expose MSAL's background token-refresh callback through Id.Web via `TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted`. See #3973. - Add `MicrosoftIdentityOptions.UseFastUnboundedCache`; stop short-circuiting the in-memory token cache serialization provider. See #3970. - OIDC FIC (`Microsoft.Identity.Web.OidcFIC`) now supports mTLS token binding. See #3851. ## Bug fixes - Token binding: the CCA cache key now distinguishes a bound credential (`UseBoundCredential = true`) from its unbound equivalent; the certificate-error retry path invalidates the cache entry for the actual request mode (bearer vs mTLS PoP). - Forward the OpenTelemetry tags enricher onto the inner FIC client-assertion leg. See #3968. ## Dependencies updates - `Microsoft.Identity.Client` → 4.87.0 (#3975) - `Microsoft.Identity.Abstractions` → 12.6.0 (#3976) - `System.Security.Cryptography.Xml` / `System.Security.Cryptography.Pkcs` → patched (CVE-2026-47302, -47304, -50525, -50648) (#3964) - notsecurity group: 1 update (#3965) **Full changelog**: AzureAD/microsoft-identity-web@4.13.2...4.14.0 ## 4.13.2 ## What's Changed * Apply reserved-header handling on the request-clone path and cover all X-MS-TOKEN- headers by @iNinja in AzureAD/microsoft-identity-web#3915 * Restore independent PR pipeline + pool-aware MI identity + net462/472 unit tests by @iarekk in AzureAD/microsoft-identity-web#3935 * Post-release 4.13.0: changelog and public API shipped move by @neha-bhargava in AzureAD/microsoft-identity-web#3937 * Remove redundant 'Run unit tests' GitHub Action by @iarekk in AzureAD/microsoft-identity-web#3939 * Apply consistent redirect-URI validation on AccountController.SignIn by @iNinja in AzureAD/microsoft-identity-web#3940 * Fix duplicate logging of MsalUiRequiredException (in-repo copy of #3910) by @iarekk in AzureAD/microsoft-identity-web#3941 * Use MSAL's recent UserFIC API for agentic flows by @Avery-Dunn in AzureAD/microsoft-identity-web#3842 * Restore CustomizeHttpRequestMessage to run after the authorization header by @neha-bhargava in AzureAD/microsoft-identity-web#3943 * Bump Microsoft.IdentityModel.Tokens.Saml from 5.7.0 to 8.19.1 by @dependabot[bot] in AzureAD/microsoft-identity-web#3909 * Revert #3909: keep OWIN Saml/WsFederation on 5.7.0 by @iarekk in AzureAD/microsoft-identity-web#3944 * Bump Microsoft.Identity.Abstractions from 12.4.0 to 12.5.0 by @neha-bhargava in AzureAD/microsoft-identity-web#3947 * Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to DownstreamApi by @neha-bhargava in AzureAD/microsoft-identity-web#3942 * Update IdentityModelV5Version and SamlPackageVersion to 5.7.1 in proj… by @trwalke in AzureAD/microsoft-identity-web#3950 * Rename retired MSALMSIV2 agent pool to MISEManagedIdentity by @gladjohn with @Copilot in AzureAD/microsoft-identity-web#3949 * Improve IDW10109 error handling for credential loading failures by @Avery-Dunn in AzureAD/microsoft-identity-web#3946 * Bump MSAL dependencies to 4.86.1 in central props by @gladjohn with @Copilot in AzureAD/microsoft-identity-web#3953 * Bump the notsecurity group with 3 updates by @dependabot[bot] in AzureAD/microsoft-identity-web#3954 **Full Changelog**: AzureAD/microsoft-identity-web@4.13.0...4.13.2 ## 4.13.0 ## What's Changed * Categorize managed-identity E2E tests and exclude them from the PR build by @iarekk in AzureAD/microsoft-identity-web#3923 * Add more tests for TokenAcquisitionMetadata.ExpiresOn from AuthenticationResult by @neha-bhargava in AzureAD/microsoft-identity-web#3904 * Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI by @RyAuld in AzureAD/microsoft-identity-web#3926 * docs: Credential architecture internals documentation by @gladjohn in AzureAD/microsoft-identity-web#3886 * Potential fix for code scanning alert no. 35: Missing cross-site request forgery token validation by @gladjohn in AzureAD/microsoft-identity-web#3929 * Register IAuthorizationHeaderProvider2 in DI by @neha-bhargava in AzureAD/microsoft-identity-web#3927 * Bump Microsoft.Identity.Client to 4.86.0 by @neha-bhargava in AzureAD/microsoft-identity-web#3931 * Split PR pipeline into independent net8 stages; add MI E2E stage on MSALMSIV2 by @iarekk in AzureAD/microsoft-identity-web#3933 * Run missing unit test projects in the ADO PR build by @iarekk in AzureAD/microsoft-identity-web#3934 * Revert PRs #3933 and #3934: restore single-job PR pipeline by @gladjohn with @Copilot in AzureAD/microsoft-identity-web#3936 **Full Changelog**: AzureAD/microsoft-identity-web@4.12.2...4.13.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.12.2...4.14.2). </details> Updated [Microsoft.IdentityModel.Protocols.OpenIdConnect](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet) from 8.19.2 to 8.22.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.IdentityModel.Protocols.OpenIdConnect's releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)._ ## 8.22.0 ## What's Changed * Promote exception to property, add test by @westin-m in AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3486 * Add IgnoreCaseWhenValidatingAudience flag to audience validation by @cpp11nullptr in AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3563 **Full Changelog**: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0 ## 8.21.0 ## Performance Improvements - Add JsonWebToken header-replacement path to avoid re-parsing payload. See [PR #3553](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3553). - Add claims dictionary preallocation. See [PR #3550](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3550). ## Bug Fixes - Fix CI build failures: remove unused log message and add missing DPoP API entries. See [PR #3551](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3551). Commits viewable in [compare view](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.2...8.22.0). </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Gunn <james@gunn.io>
cherry pick #3471 into dev/8x