Allow public applications to acquire token via authorization code

[cormacpayne]

Is your feature request related to a problem? Please describe.

Currently, only the ConfidentialClientApplication supports acquiring tokens via authorization code, but this functionality should be able to extend to the PublicClientApplication (as demonstrated by the Python ADAL/MSAL libraries). This prevents our public application with no secret/certificate credential from authenticating using this method.

Describe the solution you'd like

Add the AcquireTokenByAuthorizationCodeAsync method to the IClientApplicationBase and implement a version of this authentication similar to the one found in ConfidentialClientApplication that doesn't use the ClientCredential parameter.

Describe alternatives you've considered

Other forms of acquiring a token using the PublicClientApplication currently work, but we are looking for "interactive ways" for users to authenticate in Azure PowerShell. Ideally we would share the same default login behavior as Azure CLI: using authorization code flow, open a window with the appropriate URL, have the user pick their account, authenticate, and move along. Talked to @henrik-me about having the code in device code flow added to the URL (e.g., https;//microsoft.com/devicelogin?code=ABCDEFGH) for a similar experience, which would work for us as well, but no timeline yet for this.

Additional context

N/A

[bgavrilMS]

Hi @cormacpayne - we are looking into this we have to approaches:

1. The strategy that you have described. The difficulty there is to provide a layer of security against man in the middle attacks. The OAuth spec provides a mechanism called (PKCE)[https://oauth.net/2/pkce/] - it's pretty simple. Looking into this...

2. A second approach is to reuse the infrastructure of MSAL and "bring your own browser". MSAL uses PKCE already. @MarkZuber has an implementation exposing this already which we may refine a bit, but the jist of it is that you will need to implement a single method:

Uri GetAuthrorizationCodeUri(Uri interactiveAuthUri, Uri redirectUri)

So we give you an Uri that will initiate the login process, show the user the login window, collect the password etc. Then AAD will use the redirectUri to respond with a Uri that contains an authorization code. MSAL will exchange this code for a token.

[cormacpayne]

@bgavrilMS awesome, thanks for the update, Bogdan

[jennyf19]

Fixed in MSAL 3.0.0-preview release