Version 1.23.0 ============= - Reduced dependency footprint by removing third-party libraries (#909): - Replaced org.projectlombok with direct implementations of previously generated code (#946) - Replaced com.nimbusds OAuth/OIDC functionality with our own implementation (#926, #927, #928, #941, #945) - Replaced com.fasterxml.jackson with com.azure.json for JSON parsing/serialization (#947, #948) - Internal behavior and public APIs remain unchanged, except for those noted below - Minor breaking changes: - Removed protected APIs that returned or used com.nimbusds.ClientAuthentication - These APIs were not used by any other public MSAL API, and are unlikely to have been used by other libraries - Improved JSON error handling to return more informative MsalClientException/MsalServiceException rather than generic JSON exceptions Version 1.22.0 ============= - Validate issuer from OIDC endpoint when using the oidcAuthority() API (#970) - Bump oauth2-oidc-sdk dependency to avoid CVE-2025-53864 (#975) Version 1.21.0 ============= - Add support for claims, client capabilities, and token revocation in Service Fabric scenarios (#929, #943) - Improve retry logic for HTTP requests, and add API to disable retries (#960, #963, #964) - Support multiple date formats in Managed identity scenarios (#956) - Fix query parameter issue in IMDS scenarios (#954) - Update dependencies used in tests to avoid CVE warnings (#962) 1.20.1 ============= - Fix Base64URL decoding bug (#938) Version 1.20.0 ============= - Replace some usage of jackson-databind with azure-json (#918) - Remove Lombok code generation from most classes (#919, #925) - Remove some usage of nimbusds-oauth2-oidc-sdk (#927, #928) - Fix refresh metadata not being set in MI flows (#931) - Add distinct exception type for JSON parsing errors (#933) Version 1.19.1 ============= - Update dependencies to avoid CVE-2023-1370 (#914) Version 1.19.0 ============= - Fix potential regression caused by certificate hashing changes (#898) - Add token refresh reasons AuthenticationResultMetadata (#901) - Update build plugins for better compatibility with Java 17+ (#900) - Downgrade json-smart dependency to avoid CVE (#905) Version 1.18.0 ============= - Fix WWW-Authenticate formatting in MI scenarios (#885) - Fix tenant override not being used in OBO and credential flows (#886) - Bump jackson-databind dependency (#887) Version 1.17.3 ============= - Correctly set buffer for expired tokens (#875) - Bump commons-io dependency from 2.7 to 2.14.0 (#871) Version 1.17.2 ============= - Make ManagedIdentityApplication.getManagedIdentitySource static (#864) Version 1.17.1 ============= - Fix 'refresh on' value calculation in Managed Identity flows (#858) - Bump nimbusds-oauth2-oidc-sdk version (#859) Version 1.17.0 ============= - Add object ID option for Managed Identity (#854) - Add support for custom authorities (#851) - Fix bug where claims did not cause cache to be skipped (#811) Version 1.16.2 ============= - Use SHA256 thumbprints in non-ADFS cert flows (#840) - Reduce logging level of cache miss messages (#844) - Make ManagedIdentitySourceType enum public (#845) Version 1.16.1 ============= - Add missing refreshOn metadata (#838) Version 1.16.0 ============= - Fix breaking API changes introduced in v1.15.0 (#828) - Expose refreshOn parameter in AuthenticationResultMetadata (#829) Version 1.15.1 ============= - Fix to correctly use custom SSLSocketFactory (#821) - Add public API to determine the Managed Identity environment (#823) Version 1.15.0 ============= - GA support for Azure managed identity scenarios - Support managed identities in Azure Functions, App Service, IMDS (#661) - Support MI in Cloud Shell (#713) - Support MI in Service Fabric (#729) - Support MI in Azure Arc (#730) - Adjust loopback address binding in interactive flow (#797) Version 1.14.3 ============= - Hotfix to update oauth2-oidc-sdk dependency (#781) Version 1.14.2 ============= - Correct IMDS endpoint used for region discovery (#762) - Improve performance of instance/region discovery (#763) Version 1.14.1 ============= - Remove key size requirements for certificates (#749) - Improve timeout behavior for futures (#756) - Reduce verbosity of certain info logs (#756) Version 1.14.4-beta ============= - Beta support for MSI in Azure Arc (#730) - Beta support for MSI in Service Fabric (#729) - Fix Cloud Shell parsing issue (#750) Version 1.14.0 ============= - GA release of MSAL Java Brokers package - Add support for acquiring bearer and proof-of-possession tokens using WAM as the broker (#590) - Default throttling time for password grant requests lowered to 5 seconds (#721) - Fix internal docs generation issue (#705) Version 1.14.2-beta ============= - Add support for Managed Identity (#712) Version 1.14.1-beta ============= - Add proof-of-possession token support - Add MSALRuntime logging support Version 1.14.0-beta ============= - Add IBroker interface - Add app-level parameter for enabling the use of auth brokers Version 1.13.10 ============= - Remove default HTTP timeout (#664) - Add equals/hash logic to Account class based on homeAccountID (#681) - Fix issue with command to open default browser on Linux (#683) - Handle null pointer exception in certain ADFS scenarios (#669) Version 1.13.9 ============= - Update automated tests to use JUnit 5/Mockito instead of TestNG/Powermock - Fix issue with interactive flow on macOS/Linux/Unix systems Version 1.13.8 ============= - Added support for CIAM authority - Added refresh_in logic for managed identity flow - Better exception handling in interactive flow - Updated vulnerable dependency versions Version 1.13.7 ============= - Update json-smart library version to a secured one. Version 1.13.6 ============= - Added ExtraQueryParameters API. - added tests for a CIAM user. - updated condition to throw exception only for an invalid authority while performing instance discovery. Version 1.13.5 ============= - fixed url for admin consent. - added 2s timeout to IMDS endpoint call. - fixed url for regional endpoint calls. - added support for current and legacy B2c authority formats. Version 1.13.4 ============= - regional endpoint updates - fixed manifest - Expose instance discovery flag to perform instance discovery. Version 1.13.3 ============= - Update jackson-databind version to be in compatible with Azure-SDKs Version 1.13.2 ============= - Add IBroker interface - Update AppTokenProvider callback logging to be consistent with Azure SDK logging - Restructure library and add broker module - Update version of vulnerable libraries - Update README for broken links Version 1.13.1 ============= - Bug fixes and improvements for region API - Allow configuration of timeouts for interactive requests - Additional and more informative logging for regional scenarios and token requests in general Version 1.13.0 ============= - Provide token caching functionality for managed identity tokens - Updates for obo-for-service-principal scenarios - version updates for nimbusds-oauth2 library Version 1.12.0 ============= - Updates several dependencies to avoid security vulnerabilities - Improves serialization of ID tokens and authentication results - Various bug fixes related to authority paths, regional endpoints, and unclear logs Version 1.11.3 ============= - Allow client assertions as callbacks and as per-request parameters - Adjust scope for azure-security-keyvault-secrets dependency Version 1.11.2 ============= - Updated oauth2-oidc-sdk version to address security vulnerability - Fixed a bug where acquire token using client assertion failed Version 1.11.1 ============= - Updated Azure Key Vault dependencies to fix error in transitive dependency - Fixed issue where client assertion validation fails due to mismatched subject and issuer Version 1.11.0 ============= - Adds ability to override authority in AcquireToken calls - Fixes issue where authority port was being dropped from URLs Version 1.10.1 ============= - Improved behavior when using regional authorities - Fix scope override issue in OBO flow - Update server-side telemetry - Adjusted logging levels to reduce noise - Improved HTTP error handling and messaging - Upgrade oauth2-oidc-sdk dependency 9.4 -> 9.7 - Upgrade httpclient dependency 4.5.9 -> 4.5.13 Version 1.10.0 ============= - Instance aware support for interactive requests - Default cache lookup for on-behalf-of and client credential flows - Cross cloud accounts support - Using default security provider for client certificate creation - Upgrades the commons-io dependency 2.6 -> 2.7 - Upgrades the oauth2-oidc-sdk dependency 8.23.1 -> 9.4 - Upgrades the guava dependency 26.0 -> 29.0 Version 1.9.1 ============= - Update com.fasterxml.jackson.core.jackson-databind to 2.12.1 Version 1.9.0 ============= - Add support for Azure region discovery to keep token traffic regional when possible - New helper methods in ClaimsRequest class to convert Strings of claims to ClaimsRequest objects - Upgrade nimbusds.oauth2-oidc-sdk dependency to better support newer Spring Framework versions Version 1.8.1 ============= - New ClaimsRequest class to allow ID token claims to be requested as part of any token request - Remove use of nimbusds.oauth2.sdk CommonContentTypes Version 1.8.0 ============= - ITenantProfile added to IAuthenticationResult for easier access to ID token claims - IAccount is now serializable - Support for refresh_in field in token response - New utility class, AzureCloudEndpoint, for national cloud endpoint URLs Version 1.7.1 ============= - sendX5c API added to IConfidentialClientApplication to specify if the x5c claim (public key of the certificate) should be sent to the STS. Default value is true. Version 1.7.0 ============= - Tenant profiles added to IAccount - Support of certificate chain - Api to set connect and read timeouts for default http client Version 1.6.2 ============= - Fix for "NullPointerException during accessing B2C authority aliases" - Adding extraScopesToConsent parameter to AuthorizationRequestUrlParameters builder. Can be used to request the end user to consent upfront, in addition to scopes which the application is requesting access to. Version 1.6.1 ============= - Compatibility with json-smart [1.3.1 - 2.3] Version 1.6.0 ============= - Client capabilities support - Enable device code flow for ADFS2019 - Fix dependency issues with jackson 2.6.7 and json-smart 1.3.1 Version 1.5.0 ============= - Support of server side throttling instructions - Rebuild client assertion when expired - Update nimbus SDK version from 6.5 to 7.4 - Validation of Authority path segments Version 1.4.0 ============= - Added acquire token interactive API, using system default browser - Added authorization code url builder - Added OSGi support via bnd-maven-plugin - Added server-side telemetry support Version 1.3.0 ============= - Added option to pass in AAD instance discovery data - Removed runtime dependency on commons-codec.commons-codec, org.apache.commons.commons-text, org.apache.httpcomponents.httpclient, com.google.code.gson - Added runtime dependency on com.fasterxml.jackson.databind Version 1.2.0 ============= - Added support for ADFS 2019 - Added option to add application name and version for telemetry - Bug fix: support for ClientCredential on Windows for JDK12+ #128 Version 1.1.0 ============= - Added support for configuring HTTP client Version 1.0.0 ============= - API surface is now stable and production ready. No breaking changes will be introduced without incrementing MAJOR version - No changes from 0.7.0-preview Version 0.7.0-preview ============= - Added support for ClientAssertions in ClientCredentialFactory - Renamed AsymmetricKeyCredential to ClientCertificate - Made Account, IClientApplicationBase, TelemetryConsumer ClientSecret, ClientCertificate, ClientAssertion package-private - Added IClientSecret, IClientCertificate, IClientAssertion Version 0.6.0-preview ============= - Updated TokenCache to be thread safe - Removed build warnings - Added web app, B2C, and OBO samples - Updated to use delomboked sources Version 0.5.0-preview ============= - Refactored AuthenticationException to MsalServiceException, MsalClientException, MsalInteractionRequiredException - Added cache lookup to acquireToken by client credentials grant - Updated Javadoc reference - Updated license headers Version 0.4.0-preview ============= - Exposed acquire token by refresh token api Version 0.3.0-preview ============= - Added support for FOCI - Updated public API to return interfaces - Updated cache to be compatible with MSAL Python and MSAL.NET caches Version 0.2.0-preview ============= - Added support for B2C Version 0.1.0-preview ============= Public preview of Microsoft Authentication Library for Java - Feature parity with ADAL Java - Updated public API to use builder pattern - Added telemetry callback - Added support for caching tokens - Added acquire token with silent parameters API