[Bug] Using Microsoft.Identity.Client's dependency on Microsoft.IdentityModel.Abstractions is old and causes warnings

[0scarius]

Logs and network traces Without logs or traces, it is unlikely that the team can investigate your issue. Capturing logs and network traces is described in Logging wiki.

Which version of MSAL.NET are you using? using v4.50.0

Platform .NET Framework 4.81

What authentication flow has the issue?

• Desktop / Mobile
  • [ ] Interactive
  • [ ] Integrated Windows Authentication
  • [ ] Username Password
  • [ ] Device code flow (browserless)
• Web app
  • [ ] Authorization code
  • [ ] On-Behalf-Of
• Daemon app
  • [ ] Service to Service calls

Other?

Is this a new or existing app? The app is in production, I haven't upgraded MSAL, but upgraded Microsoft.IdentityModel.Abstractions, then started seeing this issue.

Repro

var your = (code) => here;

Expected behavior A clear and concise description of what you expected to happen (or code).

Actual behavior Using Microsoft.Identity.Client v4.50, which automatically installs Microsoft.IdentityModel.Abstractions v6.22. A new stable release for Microsoft.IdentityModel.Abstractions came available (v6.27), which should be compatible with Microsoft.Identity.Client v4.50 (>=6.22):

However, upon installing that (v6.27), getting the error below, which is confirmed by the dependencies of v4.50:

InnerException: Message: Could not load file or assembly 'Microsoft.IdentityModel.Abstractions, Version=6.22.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040). Filename: Microsoft.IdentityModel.Abstractions, Version=6.22.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 FusionLog: WRN: Assembly binding logging is turned OFF.\r\nTo enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.\r\nNote: There is some performance penalty associated with assembly bind failure logging.\r\nTo turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].\r\ TargetSite: Void .ctor(Boolean) StackTrace: at Microsoft.Identity.Client.ApplicationConfiguration..ctor(Boolean isConfidentialClient)\r\n at Microsoft.Identity.Client.PublicClientApplicationBuilder.Create(String clientId)\r\n at .OCWRibbon.d__9.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at .OCWRibbon.<b__8_0>d.MoveNext() HelpLink: null Source: Microsoft.Identity.Client HResult: -2146234304 $type: FileLoadException

Possible solution The only solution seems to be to downgrade Microsoft.IdentityModel.Abstractions back down to v6.22.

Additional context / logs / screenshots / links to code

Add any other context about the problem here, such as logs and screenshots, and even links to code.

[bgavrilMS]

@0scarius - are you using PowerShell? Version 6.22 is compatible with version 6.27 of this assembly.

[0scarius]

Hi Bogdan,

No, not using PowerShell. I would think that compatibility is the case, however, I do get the error message as indicated in my bug report. The Microsoft.Identity.Client / Abstractions libraries are used in a VSTO Excel addin based on .NET Framework 4.81, perhaps that gives you additional context?

KR. Oscar

On Mon, Mar 13, 2023 at 12:44 PM Bogdan Gavril @.***> wrote:

@0scarius https://github.com/0scarius - are you using PowerShell? Version 6.22 is compatible with version 6.27 of this assembly.

— Reply to this email directly, view it on GitHub https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4001#issuecomment-1465992213, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABXFFSGUDUKGEVZI7PMIWRTW34CCVANCNFSM6AAAAAAVY6PUWY . You are receiving this because you were mentioned.Message ID: <AzureAD/microsoft-authentication-library-for-dotnet/issues/4001/1465992213 @github.com>

[bgavrilMS]

I am not able to reproduce this with a simple console app using:

console -> MSAL + Abstractions 6.22 console -> Abstractions 6.27.

I tried with net7 and net48 and both work fine. It might be some limitation of the addin system of Excel?

[bgavrilMS]

Let's just do this, now that we've dropped net45 support. - upgrade to Abstractions 7.x

This will prevent diamond dependencies which are difficult to solve in some cases (e.g. PowerShell)./

[bgavrilMS]

Blocking this while we discuss in the team. Current consensus is to align to .NET guidelines, i.e. depend on the lowest compatible version of the dependecy.

[bgavrilMS]

Won't fix.