Bump the notsecurity group with 4 updates

Directory.Build.props

@@ -79,9 +79,9 @@
   </PropertyGroup>
 
   <PropertyGroup Label="Common dependency versions">
-    <MicrosoftIdentityModelVersion Condition="'$(MicrosoftIdentityModelVersion)' == ''">8.22.0</MicrosoftIdentityModelVersion>
-    <MicrosoftIdentityClientVersion Condition="'$(MicrosoftIdentityClientVersion)' == ''">4.90.0</MicrosoftIdentityClientVersion>
-    <MicrosoftIdentityClientKeyAttestationVersion Condition="'$(MicrosoftIdentityClientKeyAttestationVersion)' == ''">4.90.0</MicrosoftIdentityClientKeyAttestationVersion>
+    <MicrosoftIdentityModelVersion Condition="'$(MicrosoftIdentityModelVersion)' == ''">8.23.0</MicrosoftIdentityModelVersion>
+    <MicrosoftIdentityClientVersion Condition="'$(MicrosoftIdentityClientVersion)' == ''">4.90.1</MicrosoftIdentityClientVersion>
+    <MicrosoftIdentityClientKeyAttestationVersion Condition="'$(MicrosoftIdentityClientKeyAttestationVersion)' == ''">4.90.1</MicrosoftIdentityClientKeyAttestationVersion>
     <MicrosoftIdentityAbstractionsVersion Condition="'$(MicrosoftIdentityAbstractionsVersion)' == ''">12.7.0</MicrosoftIdentityAbstractionsVersion>
     <FxCopAnalyzersVersion>3.3.0</FxCopAnalyzersVersion>
     <SystemTextEncodingsWebVersion>4.7.2</SystemTextEncodingsWebVersion>

src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj

@@ -17,7 +17,7 @@
   </PropertyGroup>
 
   <PropertyGroup>
-    <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == ''">5.7.1</IdentityModelV5Version>
+    <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == ''">5.7.2</IdentityModelV5Version>
   </PropertyGroup>
 
   <ItemGroup>

tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj

@@ -107,7 +107,7 @@
   </ItemGroup>
 
   <PropertyGroup>
-    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == ''">5.7.1</SamlPackageVersion>
+    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == ''">5.7.2</SamlPackageVersion>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Antlr" Version="3.5.0.2" />

tests/Microsoft.Identity.Web.Test.Common/Mocks/MockHttpClientFactory.cs

@@ -23,18 +23,13 @@ public class MockHttpClientFactory : IMsalHttpClientFactory, IHttpClientFactory,
     {
         private LinkedList<MockHttpMessageHandler> _httpMessageHandlerQueue = new();
 
-        private volatile bool _addInstanceDiscovery = true;
-
         public MockHttpMessageHandler AddMockHandler(MockHttpMessageHandler handler)
         {
-            if (_httpMessageHandlerQueue.Count == 0 && _addInstanceDiscovery)
+            // Another cloud may need discovery after an earlier token request used cached metadata.
+            handler.ReplaceMockHttpMessageHandler = (h) =>
             {
-                _addInstanceDiscovery = false;
-                handler.ReplaceMockHttpMessageHandler = (h) =>
-                {
-                    return _httpMessageHandlerQueue.AddFirst(h).Value;                    
-                };
-            }
+                return _httpMessageHandlerQueue.AddFirst(h).Value;
+            };
 
             // add a message to the front of the queue
             _httpMessageHandlerQueue.AddLast(handler);

tests/Microsoft.Identity.Web.Test/MockHttpClientFactoryTests.cs

@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Net;
+using System.Net.Http;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.Identity.Web.Test.Common.Mocks;
+using Xunit;
+
+namespace Microsoft.Identity.Web.Test
+{
+    public class MockHttpClientFactoryTests
+    {
+        [Theory]
+        [InlineData(false, false)]
+        [InlineData(true, false)]
+        [InlineData(false, true)]
+        [InlineData(true, true)]
+        public async Task InstanceDiscovery_RequeuesCurrentHandlerAsync(
+            bool discoverBeforeFirstToken,
+            bool discoverBeforeSecondToken)
+        {
+            const string firstTokenEndpoint = "https://login.microsoftonline.com/tenant/oauth2/v2.0/token";
+            const string secondTokenEndpoint = "https://login.microsoftonline.us/tenant/oauth2/v2.0/token";
+            using var factory = new MockHttpClientFactory();
+            var firstTokenHandler = factory.AddMockHandler(
+                MockHttpCreator.CreateClientCredentialTokenHandler("first-token"));
+            firstTokenHandler.ExpectedUrl = firstTokenEndpoint;
+            var secondTokenHandler = factory.AddMockHandler(
+                MockHttpCreator.CreateClientCredentialTokenHandler("second-token"));
+            secondTokenHandler.ExpectedUrl = secondTokenEndpoint;
+
+            if (discoverBeforeFirstToken)
+            {
+                using var discoveryClient = factory.GetHttpClient();
+                using var discoveryResponse = await discoveryClient.GetAsync(
+                    "https://login.microsoftonline.com/common/discovery/instance");
+                Assert.Equal(HttpStatusCode.OK, discoveryResponse.StatusCode);
+            }
+
+            using var firstClient = factory.GetHttpClient();
+            using var firstResponse = await firstClient.PostAsync(
+                firstTokenEndpoint,
+                new StringContent(string.Empty));
+
+            if (discoverBeforeSecondToken)
+            {
+                using var discoveryClient = factory.GetHttpClient();
+                using var discoveryResponse = await discoveryClient.GetAsync(
+                    "https://login.microsoftonline.us/common/discovery/instance");
+                Assert.Equal(HttpStatusCode.OK, discoveryResponse.StatusCode);
+            }
+
+            using var secondClient = factory.GetHttpClient();
+            using var secondResponse = await secondClient.PostAsync(
+                secondTokenEndpoint,
+                new StringContent(string.Empty));
+
+            Assert.Equal(HttpStatusCode.OK, firstResponse.StatusCode);
+            Assert.Equal(HttpStatusCode.OK, secondResponse.StatusCode);
+            using var firstPayload = JsonDocument.Parse(await firstResponse.Content.ReadAsStringAsync());
+            using var secondPayload = JsonDocument.Parse(await secondResponse.Content.ReadAsStringAsync());
+            Assert.Equal("first-token", firstPayload.RootElement.GetProperty("access_token").GetString());
+            Assert.Equal("second-token", secondPayload.RootElement.GetProperty("access_token").GetString());
+            Assert.Throws<InvalidOperationException>(() => factory.GetHttpClient());
+        }
+    }
+}