Microsoft-authentication-library-for-dotnet: [Bug] WithProofOfPosession produces a token of type POP, whereas the Wilson 6.0 expects PoP

[jmprieur]

Which Version of MSAL are you using ?
4.9

Platform
net45

What authentication flow has the issue?

• Desktop / Mobile
  
  
  
  • [x ] Interactive
  
  
  • [ ] Integrated Windows Auth
  
  
  • [ ] Username Password
  
  
  • [ ] Device code flow (browserless)
  
  
• Web App
  
  
  
  • [ ] Authorization code
  
  
  • [ ] OBO
  
  
• Web API
  
  
  
  • [ ] OBO
  
  

Expected behavior
Send PoP

Actual behavior
Sends POP

[bgavrilMS]

Hmm, the validating service that we use for integration testing does not seem to complain about this. I guess Wilson tightened the rules. @GeoK - are there plans to update the validation service to use Wilson 6? Or I could contribute to the project if pubic?

[jmprieur]

Actually Wilson does a case insensitive match, so this works (my bad @bgavrilMS )
but in the Middleware grooming meeting we've advised that MSAL.NET sends "PoP". Not super urgent.

[GeoK]

@bgavrilMS Both Wilson and SAL and lax on the validation side. Extra spaces and different casing are forgiven. The spec defines "PoP" as the authentication scheme.

[trwalke]

Resolved in 4.11.0