[Bug] MSAL exceptions should not have PII

[AMaini503]

Which version of MSAL.NET are you using?
Assembly Microsoft.Identity.Client, Version=4.47.1.0,

Platform
WPF

What authentication flow has the issue?

• Desktop
  • Interactive
  • Integrated Windows Authentication
  • Username Password
  • Device code flow (browserless)

Not sure. The app tries to acquire the token silently and AcquireTokenSilent throws an MsalUiRequiredException.

Other?
The issue is that the exception message accessed through System.Exception.Message.ToStirng() contains PII: the email ID of the user.
e.g. (Message: (Could not find a WAM account for the selected user [[email protected]]. Status: AccountNotFound Context: Account with id '(pii)' not found Tag: some-hex-number)).

Some information is scrubbed '(pii)' but not the email id of the user.

Is this a new or existing app?
b. The app is in production, I haven't upgraded MSAL, but started seeing this issue.

Repro

var builder = PublicClientApplicationBuilder.Create(s_clientId)
                    .WithBrokerPreview(true)
                    .WithAuthority(authority)
                    .WithDefaultRedirectUri()
                    .WithLogging(OnMsalLoggingInvoked, LogLevel.Warning, enablePiiLogging: false, enableDefaultPlatformLogging: false);

public class ExceptionLogging
{
        public static string GetExceptionMessage(Exception _ex)
        {
            return $"(Message: ({_ex.Message.ToString()}))";
        }
}


try
{
    AuthenticationResult result = await s_clientApp.AcquireTokenSilent(scope, account)
                        .WithCorrelationId(correlationId)
                        .ExecuteAsync();
    ....
}
catch (MsalUiRequiredException ex)
{
    Log(ExceptionLogging.GetExceptionMessage(ex));
}

Expected behavior
With enablePiiLogging set to false, email ID should be scrubbed in the exception message.

Actual behavior
Email ID is not scrubbed in the exception message.

[bgavrilMS]

Fix is to remove PII from that particular message and to review all other exceptions comming from RuntimeBroker.cs

[AMaini503]

@bgavrilMS Is your comment addressed to me or to the developers?

Are you saying the PII needs to be filtered by me manually or will this be addressed in MSAL.NET?

[bgavrilMS]

@AMaini503 - comment is addressed to MSAL developers, not to you. We will fix this.