Microsoft-authentication-library-for-dotnet: Microsoft.Identity.Client forces assembly redirect for System.Runtime.WindowsRuntime

[AroglDarthu]

We are referencing version Microsoft.Identity.Client 4.23.0
This causes the symptom described in the following issue: https://github.com/dotnet/runtime/issues/28603

Platform
.NET Full Framework 4.7.2

Ultimately this forces to use the version of System.Runtime.WindowsRuntime from GAC.
Doesn't seem correct, could you please apply the same fix as in https://github.com/dotnet/runtime/issues/28603?

Also, clicking the warning in VS removes it from the list, but does not apply the redirect in web.config (Visual Studio Professional 2019 version 16.8.2).

[bgavrilMS]

Interesting, ok I'll need to play with this as it is not clear what the actual fix is. We package MSAL using msbuild /t:pack

[bgavrilMS]

Please stay on MSAL 4.22 as it does not have this dependnecy until we get this fixed.

[bgavrilMS]

Hi @AroglDarthu - we will be moving this reference out of MSAL and into a new package called Microsoft.Identity.Client.Desktop in a few days, as part of the 4.25 release.

Still, I could not repro this issue. What is your project type, target framework and references?

[AroglDarthu]

Hi @bgavrilMS,

I've prepared a repro for you:
2267-clean.zip

If you build it you get this:

1>------ Rebuild All started: Project: Repro.Web, Configuration: Debug Any CPU ------
========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ==========

After a little while the Error List flashes by and it will contain the following warning:

Severity    Code    Description Project File    Line    Suppression State
Warning     Found conflicts between different versions of the same dependent assembly. In Visual Studio, double-click this warning (or select it and press Enter) to fix the conflicts; otherwise, add the following binding redirects to the "runtime" node in the application configuration file: <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"><dependentAssembly><assemblyIdentity name="System.Runtime.WindowsRuntime" culture="neutral" publicKeyToken="b77a5c561934e089" /><bindingRedirect oldVersion="0.0.0.0-4.0.14.0" newVersion="4.0.14.0" /></dependentAssembly></assemblyBinding> Repro.Web           

Clicking the warning, removes it, but otherwise does nothing. It pops back up after rebuilding. This time however, the build also shows the problem:

1>------ Rebuild All started: Project: Repro.Web, Configuration: Debug Any CPU ------
1>  No way to resolve conflict between "System.Runtime.WindowsRuntime, Version=4.0.14.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" and "System.Runtime.WindowsRuntime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089". Choosing "System.Runtime.WindowsRuntime, Version=4.0.14.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" arbitrarily.
1>  Consider app.config remapping of assembly "System.Runtime.WindowsRuntime, Culture=neutral, PublicKeyToken=b77a5c561934e089" from Version "4.0.0.0" [C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.WindowsRuntime\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.WindowsRuntime.dll] to Version "4.0.14.0" [] to solve conflict and get rid of warning.
1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\MSBuild\Current\Bin\Microsoft.Common.CurrentVersion.targets(2123,5): warning MSB3247: Found conflicts between different versions of the same dependent assembly. In Visual Studio, double-click this warning (or select it and press Enter) to fix the conflicts; otherwise, add the following binding redirects to the "runtime" node in the application configuration file: <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"><dependentAssembly><assemblyIdentity name="System.Runtime.WindowsRuntime" culture="neutral" publicKeyToken="b77a5c561934e089" /><bindingRedirect oldVersion="0.0.0.0-4.0.14.0" newVersion="4.0.14.0" /></dependentAssembly></assemblyBinding>
1>  Repro.Web -> C:\Sandbox\2267\Repro.Web\bin\Repro.Web.dll
========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ==========

[bgavrilMS]

Hi @AroglDarthu - it looks like System.Runtime.WindowsRuntime is brought into the dependency graph from 2 places, once with version 4.0.0 (by some other dependency) and once with version 4.0.14 (by MSAL)

There are a few ways to deal with this:

• upgrade to MSAL 4.25.0 (we will release it in a few days), as we dropped the dependency (it's causing other problemns as well) OR
• do nothing, .NET runtime (actually it's nuget) will choose System.Runtime.WindowsRuntime 4.0.14 OR
• add a binding redirect to 4.0.14 to get rid of the warning

I suggest the first variant.

[AroglDarthu]

Hi @bgavrilMS ,

I have stripped the repro solution a bit more. It now only references System, System.Web and the package Microsoft.Identity.Client:
2267-stripped.zip

As for the provided options:

• We will definitely upgrade to 4.25.0.
• We chose to remain on 4.22.0 instead of using 4.23.0 and doing nothing, just to be on the safe side.
• The binding redirect needs to be added manually, as double clicking the warning doesn't do anything (besides removing the warning until the next build).

[bgavrilMS]

Sounds good.

Just for reference, on adding binding redirects https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/redirect-assembly-versions

[pmaytak]

This is included in MSAL 4.25.0 release.

cc: @AroglDarthu