Updating conditions for providing the IWA VPN message. (#407)

AzureAD · Sep 18, 2024 · 1508898 · 1508898
1 parent 5640a4f
commit 1508898
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/src/MSALWrapper.Test/AuthFlow/IntegratedWindowsAuthenticationTest.cs b/src/MSALWrapper.Test/AuthFlow/IntegratedWindowsAuthenticationTest.cs
@@ -83,6 +83,23 @@ public async Task GetTokenIWA_MsalUIRequired_2FA()
             authFlowResult.AuthFlowName.Should().Be("iwa");
         }
 
+        [Test]
+        public async Task GetTokenIWA_WSTrustEndpointError()
+        {
+            this.SetupIWAWSTrustException();
+
+            // Act
+            AuthFlow.IntegratedWindowsAuthentication iwa = this.Subject();
+            var authFlowResult = await iwa.GetTokenAsync();
+
+            // Assert
+            authFlowResult.TokenResult.Should().Be(null);
+            authFlowResult.Errors.Should().HaveCount(1);
+            authFlowResult.Errors[0].Should().BeOfType(typeof(MsalClientException));
+            authFlowResult.Errors[0].As<MsalClientException>().ErrorCode.Should().Be("parsing_wstrust_response_failed");
+            authFlowResult.AuthFlowName.Should().Be("iwa");
+        }
+
         [Test]
         public async Task GetTokenIWA_MsalServiceException()
         {
@@ -136,6 +153,13 @@ private void SetupIWAUIRequiredFor2FA()
                 .Throws(new MsalUiRequiredException("1", "AADSTS50076 MSAL UI Required Exception!"));
         }
 
+        private void SetupIWAWSTrustException()
+        {
+            this.mockPca
+                .Setup((pca) => pca.GetTokenIntegratedWindowsAuthenticationAsync(Scopes, It.IsAny<CancellationToken>()))
+                .Throws(new MsalClientException("parsing_wstrust_response_failed", "WS-Trust endpoint not found"));
+        }
+
         private void IWAServiceException()
         {
             this.mockPca

diff --git a/src/MSALWrapper/AuthFlow/IntegratedWindowsAuthentication.cs b/src/MSALWrapper/AuthFlow/IntegratedWindowsAuthentication.cs
@@ -69,7 +69,7 @@ protected override async Task<TokenResult> GetTokenInnerAsync()
                 this.logger.LogDebug("IWA failed, 2FA is required.");
                 throw;
             }
-            catch (MsalClientException ex) when (ex.Message.Contains("WS-Trust endpoint not found"))
+            catch (MsalClientException ex) when (ex.Message.Contains("WS-Trust endpoint not found") || ex.ErrorCode == "parsing_wstrust_response_failed")
             {
                 this.logger.LogDebug($"IWA only works on corporate AD backed network, AzureAuth is trying to use other auth flows if applicable.");
                 this.logger.LogDebug($"Turn on VPN for IWA mode to succeed.");