Microsoft.IdentityModel.Clients.ActiveDirectory

This class manages tracing in ADAL.

Sets/gets trace level. If set to None, it disables the logging.

Trace level for logging.

None

Critical

Error

Warning

Informational

Verbose

LogAlways

The main class representing the authority issuing tokens for resources.

The AuthenticationContext class retrieves authentication tokens from Azure Active Directory and ADFS services.

The main class representing the authority issuing tokens for resources.

Acquires security token without asking for user credential.

Identifier of the target resource that is the recipient of the requested token. Identifier of the client requesting the token. It contains Access Token, Refresh Token and the Access Token's expiration time. If acquiring token without user credential is not possible, the method throws AdalException.

Acquires security token without asking for user credential.

Identifier of the target resource that is the recipient of the requested token. Identifier of the client requesting the token. Identifier of the user token is requested for. This parameter can be .Any. It contains Access Token, Refresh Token and the Access Token's expiration time. If acquiring token without user credential is not possible, the method throws AdalException.

Acquires a security token from the authority using a Refresh Token previously received.

Refresh Token to use in the refresh flow. Name or ID of the client requesting the token. It contains Access Token, Refresh Token and the Access Token's expiration time.

Acquires a security token from the authority using a Refresh Token previously received.

Refresh Token to use in the refresh flow. Name or ID of the client requesting the token. Identifier of the target resource that is the recipient of the requested token. If null, token is requested for the same resource refresh token was originally issued for. If passed, resource should match the original resource used to acquire refresh token unless token service supports refresh token for multiple resources. It contains Access Token, Refresh Token and the Access Token's expiration time.

Constructor to create the context with the address of the authority. Using this constructor will turn ON validation of the authority URL by default if validation is supported for the authority address.

Address of the authority to issue token.

Constructor to create the context with the address of the authority and flag to turn address validation off. Using this constructor, address validation can be turned off. Make sure you are aware of the security implication of not validating the address.

Address of the authority to issue token. Flag to turn address validation ON or OFF.

Address of the authority to issue token. Flag to turn address validation ON or OFF. Token cache used to lookup cached tokens on calls to AcquireToken

Gets address of the authority to issue token.

Gets a value indicating whether address validation is ON or OFF.

Property to provide ADAL's token cache. By default, TokenCache is a persistent cache based on application's local settings. Library will automatically save tokens in default TokenCache whenever you obtain them. Cached tokens will be available only to the application that saved them. Cached tokens in default token cache will outlive the application's execution, and will be available in subsequent runs. To turn OFF token caching, set TokenCache to null.

Gets or sets correlation Id which would be sent to the service with the next request. Correlation Id is to be used for diagnostics purposes.

Factory method to create the context with the address of the authority. Using this constructor will turn ON validation of the authority URL by default if validation is supported for the authority address.

Address of the authority to issue token. IAsyncOperation representing the instance of the class.

Factory method to create the context with the address of the authority and flag to turn address validation off. Using this constructor, address validation can be turned off. Make sure you are aware of the security implication of not validating the address.

Address of the authority to issue token. Flag to turn address validation ON or OFF. IAsyncOperation representing the instance of the class.

Address of the authority to issue token. Flag to turn address validation ON or OFF. Token cache used to lookup cached tokens on calls to AcquireToken IAsyncOperation representing the instance of the class.

Address of the authority to issue token. Flag to turn address validation ON or OFF. Token cache used to lookup cached tokens on calls to AcquireToken Correlation Id which would be sent to the service with the next request IAsyncOperation representing the instance of the class.

Starts security token acquisition from the authority.

Identifier of the target resource that is the recipient of the requested token. Identifier of the client requesting the token. Address to return to upon receiving a response from the authority. Pass null or application's callback URI for SSO mode. Optional delegate that can be passed by the developer to process authentication result. It contains Access Token, Refresh Token and the Access Token's expiration time.

Starts security token acquisition from the authority.

Identifier of the target resource that is the recipient of the requested token. Identifier of the client requesting the token. Address to return to upon receiving a response from the authority. Pass null or application's callback URI for SSO mode. Identifier of the user token is requested for. If created from DisplayableId, this parameter will be used to pre-populate the username field in the authentication form. Please note that the end user can still edit the username field and authenticate as a different user. If you want to be notified of such change with an exception, create UserIdentifier with type RequiredDisplayableId. This parameter can be .Any. Optional delegate that can be passed by the developer to process authentication result. It contains Access Token, Refresh Token and the Access Token's expiration time.

Acquires security token from the authority.

Identifier of the target resource that is the recipient of the requested token. Identifier of the client requesting the token. Address to return to upon receiving a response from the authority. Pass null or application's callback URI for SSO mode. Identifier of the user token is requested for. If created from DisplayableId, this parameter will be used to pre-populate the username field in the authentication form. Please note that the end user can still edit the username field and authenticate as a different user. If you want to be notified of such change with an exception, create UserIdentifier with type RequiredDisplayableId. This parameter can be .Any. This parameter will be appended as is to the query string in the HTTP authentication request to the authority. The parameter can be null. Optional delegate that can be passed by the developer to process authentication result. It contains Access Token, Refresh Token and the Access Token's expiration time.

Continues security token acquisition from the authority.

Information to an app that was launched after being suspended for a web authentication broker operation. It contains Access Token, Refresh Token and the Access Token's expiration time.

Contains authentication parameters based on unauthorized response from resource server.

Creates authentication parameters from address of the resource. This method expects the resource server to return unauthorized response with WWW-Authenticate header containing authentication parameters.

Address of the resource AuthenticationParameters object containing authentication parameters

Gets or sets the address of the authority to issue token.

Gets or sets the identifier of the target resource that is the recipient of the requested token.

Creates authentication parameters from the WWW-Authenticate header in response received from resource. This method expects the header to contain authentication parameters.

Content of header WWW-Authenticate header AuthenticationParameters object containing authentication parameters

Represents the outcome of one authentication operation.

Authentication Success.

Authentication failed due to error on client side.

Authentication failed due to error returned by service.

Contains the results of one token acquisition operation. It can either contain the requested token (and supporting data) or information about why the token acquisition failed.

Contains the results of one token acquisition operation.

Gets the outcome of the token acquisition operation.

Gets provides error type in case of error.

Gets detailed information in case of error.

Gets the status code returned from http layer if any error happens. This status code is either the HttpStatusCode in the inner WebException response or NavigateError Event Status Code in browser based flow (See http://msdn.microsoft.com/en-us/library/bb268233(v=vs.85).aspx). You can use this code for purposes such as implementing retry logic or error investigation.

The Windows Runtime string type is a value type and has no null value. The .NET projection prohibits passing a null .NET string across the Windows Runtime ABI boundary for this reason.

Creates result returned from AcquireToken. Except in advanced scenarios related to token caching, you do not need to create any instance of AuthenticationResult.

Type of the Access Token returned The Access Token requested The Refresh Token associated with the requested Access Token The point in time in which the Access Token returned in the AccessToken property ceases to be valid

Gets the type of the Access Token returned.

Gets the Access Token requested.

Gets the Refresh Token associated with the requested Access Token. Note: not all operations will return a Refresh Token.

Gets the point in time in which the Access Token returned in the AccessToken property ceases to be valid. This value is calculated based on current UTC time measured locally and the value expiresIn received from the service.

Gets an identifier for the tenant the token was acquired from. This property will be null if tenant information is not returned by the service.

Gets user information including user Id. Some elements in UserInfo might be null if not returned by the service.

Gets the entire Id Token if returned by the service or null if no Id Token is returned.

Gets a value indicating whether the refresh token can be used for requesting access token for other resources.

Serializes the object to a JSON string

Deserialized authentication result

Creates authorization header from authentication result.

Created authorization header

Serializes the object to a JSON string

Serialized authentication result

Unauthorized user information access

Cannot access user information

Need to set callback uri as local setting

Unknown error.

Invalid argument.

Authentication failed.

Authentication canceled.

Unauthorized response expected from resource server.

'authority' is not in the list of valid addresses.

Authority validation failed.

Loading required assembly failed.

MultipleTokensMatched were matched.

Invalid authority type.

Invalid credential type.

Invalid service URL.

failed_to_acquire_token_silently.

Certificate key size too small.

Identity protocol login URL Null.

Identity protocol mismatch.

Email address suffix mismatch.

Identity provider request failed.

STS token request failed.

Encoded token too long.

Service unavailable.

Service returned error.

Federated service returned error.

STS metadata request failed.

No data from STS.

User Mismatch.

Unknown User Type.

Unknown User.

User Realm Discovery Failed.

Accessing WS Metadata Exchange Failed.

Parsing WS Metadata Exchange Failed.

WS-Trust Endpoint Not Found in Metadata Document.

Parsing WS-Trust Response Failed.

The request could not be preformed because the network is down.

The request could not be preformed because of an unknown failure in the UI flow.

One of two conditions was encountered. 1. The PromptBehavior.Never flag was passed and but the constraint could not be honored because user interaction was required. 2. An error occurred during a silent web authentication that prevented the authentication flow from completing in a short enough time frame.

Password is required for managed user.

Failed to get user name.

Federation Metadata Url is missing for federated user.

Failed to refresh token.

Integrated authentication failed. You may try an alternative authentication method.

Duplicate query parameter in extraQueryParameters

The active directory authentication error message.

The encoding helper.

Code used from http://code.msdn.microsoft.com/Logging-Sample-for-Windows-0b9dffd7 This is an advanced usage, where you want to intercept the logging messages and divert them somewhere besides ETW.

Storage file to be used to write logs

Name of the current event listener

The format to be used by logging.

Token cache class used by to store access and refresh tokens.

Default constructor.

Constructor receiving state of the cache

Static token cache shared by all instances of AuthenticationContext which do not explicitly pass a cache instance during construction.

Notification method called before any library method accesses the cache.

Notification method called before any library method writes to the cache. This notification can be used to reload the cache state from a row in database and lock that row. That database row can then be unlocked in notification.

Notification method called after any library method accesses the cache.

Gets or sets the flag indicating whether cache state has changed. ADAL methods set this flag after any change. Caller application should reset the flag after serializing and persisting the state of the cache.

Gets the nunmber of items in the cache.

Serializes current state of the cache as a blob. Caller application can persist the blob and update the state of the cache later by passing that blob back in constructor or by calling method Deserialize.

Current state of the cache as a blob

Deserializes state of the cache. The state should be the blob received earlier by calling the method Serialize.

State of the cache as a blob

Reads a copy of the list of all items in the cache.

The items in the cache

Deletes an item from the cache.

The item to delete from the cache

Clears the cache by deleting all the items. Note that if the cache is the default shared cache, clearing it would impact all the instances of which share that cache.

Queries all values in the cache that meet the passed in values, plus the authority value that this AuthorizationContext was created with. In every case passing null results in a wildcard evaluation.

Initializes a new instance of the exception class.

inner exception

Initializes a new instance of the exception class.

Initializes a new instance of the exception class with a specified error code.

The error code returned by the service or generated by client. This is the code you can rely on for exception handling.

Initializes a new instance of the exception class with a specified error code and error message.

The error code returned by the service or generated by client. This is the code you can rely on for exception handling. The error message that explains the reason for the exception.

Initializes a new instance of the exception class with a specified error code and a reference to the inner exception that is the cause of this exception.

The error code returned by the service or generated by client. This is the code you can rely on for exception handling. The exception that is the cause of the current exception, or a null reference if no inner exception is specified. It may especially contain the actual error message returned by the service.

Initializes a new instance of the exception class with a specified error code, error message and a reference to the inner exception that is the cause of this exception.

The error code returned by the service or generated by client. This is the code you can rely on for exception handling. The error message that explains the reason for the exception. The exception that is the cause of the current exception, or a null reference if no inner exception is specified. It may especially contain the actual error message returned by the service.

Gets the protocol error code returned by the service or generated by client. This is the code you can rely on for exception handling.

Creates and returns a string representation of the current exception.

A string representation of the current exception.

ADAL Flavor: .NET or WinRT

ADAL assembly version

CPU platform with x86, x64 or ARM as value

Version of the operating system. This will not be sent on WinRT

Device model. This will not be sent on .NET

This class adds additional query parameters or headers to the requests sent to STS. This can help us in collecting statistics and potentially on diagnostics.

Initializes a new instance of the exception class with a specified error code and error message.

The error code returned by the service or generated by client. This is the code you can rely on for exception handling. The error message that explains the reason for the exception.

Initializes a new instance of the exception class with a specified error code and a reference to the inner exception that is the cause of this exception.

Initializes a new instance of the exception class with a specified error code, error message and a reference to the inner exception that is the cause of this exception.

The protocol error code returned by the service or generated by client. This is the code you can rely on for exception handling. The error message that explains the reason for the exception. The specific error codes that may be returned by the service. The exception that is the cause of the current exception, or a null reference if no inner exception is specified. It may especially contain the actual error message returned by the service.

Gets the status code returned from http layer. This status code is either the HttpStatusCode in the inner WebException response or NavigateError Event Status Code in browser based flow (See http://msdn.microsoft.com/en-us/library/bb268233(v=vs.85).aspx). You can use this code for purposes such as implementing retry logic or error investigation.

Gets the specific error codes that may be returned by the service.

Creates and returns a string representation of the current exception.

A string representation of the current exception.

Initializes a new instance of the exception class.

Gets the user requested from service.

Gets the user returned by service.

Creates and returns a string representation of the current exception.

A string representation of the current exception.

Indicates whether AcquireToken should automatically prompt only if necessary or whether it should prompt regardless of whether there is a cached token.

Acquire token will prompt the user for credentials only when necessary. If a token that meets the requirements is already cached then the user will not be prompted.

The user will be prompted for credentials even if there is a token that meets the requirements already in the cache.

The user will not be prompted for credentials. If prompting is necessary then the AcquireToken request will fail.

Re-authorizes (through displaying webview) the resource usage, making sure that the resulting access token contains updated claims. If user logon cookies are available, the user will not be asked for credentials again and the logon dialog will dismiss automatically.

Notification for certain token cache interactions during token acquisition.

Token cache item

Default constructor.

Gets the Authority.

Gets the ClientId.

Gets the Expiration.

Gets the FamilyName.

Gets the GivenName.

Gets the IdentityProviderName.

Gets a value indicating whether the RefreshToken applies to multiple resources.

Gets the Resource.

Gets the TenantId.

Gets the user's unique Id.

Gets the user's displayable Id.

Gets the Access Token requested.

Gets the Refresh Token associated with the requested Access Token. Note: not all operations will return a Refresh Token.

Gets the entire Id Token if returned by the service or null if no Id Token is returned.

Determines what type of subject the token was issued for.

User

Client

UserPlusClient: This is for confidential clients used in middle tier.

can be used with Linq to access items from the TokenCache dictionary.

Determines whether the specified object is equal to the current object.

true if the specified object is equal to the current object; otherwise, false. The object to compare with the current object. 2

Determines whether the specified TokenCacheKey is equal to the current object.

true if the specified TokenCacheKey is equal to the current object; otherwise, false. The TokenCacheKey to compare with the current object. 2

Returns the hash code for this TokenCacheKey.

A 32-bit signed integer hash code.

Contains parameters used by the ADAL call accessing the cache.

Gets the TokenCache

Gets the ClientId.

Gets the Resource.

Gets the user's unique Id.

Gets the user's displayable Id.

Indicates the type of

When a of this type is passed in a token acquisition operation, the operation is guaranteed to return a token issued for the user with corresponding or fail.

When a of this type is passed in a token acquisition operation, the operation restricts cache matches to the value provided and injects it as a hint in the authentication experience. However the end user could overwrite that value, resulting in a token issued to a different account than the one specified in the in input.

When a of this type is passed in a token acquisition operation, the operation is guaranteed to return a token issued for the user with corresponding (UPN or email) or fail

Contains identifier for a user.

Gets type of the .

Gets Id of the .

Gets an static instance of to represent any user.

Contains information of a single user. This information is used for token cache lookup. Also if created with userId, userId is sent to the service when login_hint is accepted.

Gets identifier of the user authenticated during token acquisition.

Gets a displayable value in UserPrincipalName (UPN) format. The value can be null.

Gets given name of the user if provided by the service. If not, the value is null.

Gets family name of the user if provided by the service. If not, the value is null.

Gets the time when the password expires. Default value is 0.

Gets the url where the user can change the expiring password. The value can be null.

Gets identity provider if returned by the service. If not, the value is null.

Optional delegate that can be defined by the developer to process the result of acquire token requests.

Authentication result instance received from acquire token call