Handling a claims challenge with MSAL
October 17, 2022 ยท View on GitHub
A resource server may deem an access token it receives as having insufficient claims. If the client application that sends the access token has declared itself to be capable, the resource server may respond with a claims challenge, upon which the client can acquire a new token satisfying the claims challenge and try again.
MSAL's login* and acquireToken* APIs accept a claims parameter as part of the request object to acquire a new token with the specified claims.
See also: Client capability in MSAL
For more information, please refer to:
- Claims challenges, claims requests, and client capabilities
- How to use Continuous Access Evaluation enabled APIs in your applications