Fixes #3470 (#3471)

* Fixes #3470
Tested manually with a client secret.

* Fixing typo

* Update Directory.Build.props

* Update changelog for version 3.14.1

Author: jmprieur

Directory.Build.props

@@ -2,7 +2,7 @@
   <PropertyGroup>
     <!--This should be passed from the VSTS build-->
     <!-- This needs to be greater than or equal to the validation baseline version -->
-    <MicrosoftIdentityWebVersion Condition="'$(MicrosoftIdentityWebVersion)' == ''">3.13.2</MicrosoftIdentityWebVersion>
+    <MicrosoftIdentityWebVersion Condition="'$(MicrosoftIdentityWebVersion)' == ''">3.14.1</MicrosoftIdentityWebVersion>
     <!--This will generate AssemblyVersion, AssemblyFileVersion and AssemblyInformationVersion-->
     <Version>$(MicrosoftIdentityWebVersion)</Version>
 

changelog.md

@@ -1,3 +1,8 @@
+3.14.1
+=======
+##  Bug fix
+- Support client secrets with agent user identities. See [#3470](https://github.com/AzureAD/microsoft-identity-web/issues/3470) for details.
+
 3.14.0
 =======
 ## New features

src/Microsoft.Identity.Web.AgentIdentities/AgentUserIdentityMsalAddIn.cs

@@ -70,8 +70,7 @@ internal static Task OnBeforeUserFicForAgentUserIdentityAsync(
                         request.BodyParameters["grant_type"] = "user_fic";
                         request.BodyParameters.Remove("password");
 
-                        if (request.BodyParameters.TryGetValue("client_secret", out var secret)
-                                && secret.Equals("default", StringComparison.OrdinalIgnoreCase))
+                        if (request.BodyParameters.TryGetValue("client_secret", out var secret))
                         {
                             request.BodyParameters.Remove("client_secret");
                         }

src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

@@ -869,7 +869,12 @@ public async Task RemoveAccountAsync(
         private bool IsInvalidClientCertificateOrSignedAssertionError(MsalServiceException exMsal)
         {
             return !_retryClientCertificate &&
-                string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase);
+                string.Equals(exMsal.ErrorCode, Constants.InvalidClient, StringComparison.OrdinalIgnoreCase) &&
+                !exMsal.ResponseBody.Contains("AADSTS7000215" // No retry when wrong client secret.
+#if NET6_0_OR_GREATER
+                , StringComparison.OrdinalIgnoreCase
+#endif
+                );
         }