FOCI is hiding the true cause of refresh token failures

[bgavrilMS]

Which Version of MSAL are you using ?
MSAL 3.0.4-preview

Platform
net45

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive

Other? - please describe;

Repro

1. Acquire a token interactively from a family member
2. Acquire a token silent from another family member, from a user that has an MFA policy

Expected behavior
The MFA specific exception should be thrown. Apps need this exception for their own logic.

Actual behavior
We send an exception like "UIRequireException" - no token was found in the cache.

Possible Solution
Root cause is here: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/dev3x/src/Microsoft.Identity.Client/Internal/Requests/SilentRequest.cs#L181

We catch all exceptions and consider that the FRT is not valid, i.e. a non-family member tried to redeem the FRT. We need to strengthen this condition - there is supposed to be a "client_mismatch" error code we can use, however are currently still seeing "invalid_grant".