[Bug] AcquireTokenFromClient acquires token from cache after AbsoluteExpirationRelativeToNow

[calvinkwtang]

Microsoft.Identity.Web Library

Microsoft.Identity.Web.TokenCache

Microsoft.Identity.Web version

2.13.3

Web app

Sign-in users

Web API

Protected web APIs (validating tokens)

Token cache serialization

In-memory caches

Description

I was testing to find a way to expire a token at a specific timeframe after its generation using AbsoluteExpirationRelativeToNow.
I tested on a 5 minute expiration for the sake of fast results but intend to use a longer timeframe (20 or 22 hours) when actually implementing it

Reproduction steps

https://github.com/calvinkwtang/CacheTest

Error message

No response

Id Web logs

No response

Relevant code snippets

app.AddInMemoryTokenCache(services =>
{
    services.Configure<MemoryCacheOptions>(options =>
    {
        options.SizeLimit = 500 * 1024;
    });
    services.Configure<MsalMemoryTokenCacheOptions>(options =>
    {
        options.AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5);
    });
});

Regression

No response

Expected behavior

Calls of AcquireTokenFromClient before 5 minutes (based on the code snippet and sample) should return the same token and after 5 minutes should return a new token

[jennyf19]

@bgavrilMS & @pmaytak can you please take a look at this one? Thanks.

[pmaytak]

From my past investigation, it may be a bug here:

microsoft-identity-web/src/Microsoft.Identity.Web.TokenCache/InMemory/MsalMemoryTokenCacheProvider.cs

Line 107 in e5efeaa

if (cacheSerializerHints != null && cacheSerializerHints.SuggestedCacheExpiry != null)

For app tokens, MSAL always provides a suggested cache expiry which is token's expiry, and it always takes precedence, and the custom AbsoluteExpiration never overwrites this.

I can provide a PR fix for this.