[Bug] Version conflict of Microsoft.IdentityModel.Abstraction with the MS Graph SDK (Microsoft.Graph)

[liebichw]

Library version used

4.59.0.0

.NET version

.NET 4.6.2

Scenario

PublicClient - desktop app

Is this a new or an existing app?

This is a new app or experiment

Issue description and reproduction steps

I am developing a plugin for a .NET program, i.e. a DLL which is dynamically loaded.
In this plugin, I want to use the MS Graph SDK (version 5.44.0), and for the authentification code I am using the Microsoft.Identity.Client DLL.

The problem I have now is that Microsoft.Graph 5.44.0 indirectly depends on Microsoft.IdentityModel.Abstractions Version 7.3.1.
Microsoft.Identity.Client Version 4.59.0, however, depends on Microsoft.IdentityModel.Abstractions Version 6.22.0.

So I have a version conflict. Were I developing a standalone application, I could use the binding redirects provided by Visual Studio.
But I am only delivering a DLL, and I have no control over the application's config file - a DLL cannot have config file for "private" binding redirects.

A version of Microsoft.Identity.Client using also the newer Microsoft.IdentityModel.Abstractions Version 7.3.1 would solve this issue.
Is there any other solution? Again, using the application config file with binding redirects is not easily possible for us, because we are only delivering a plugin.

Additionally, I also tried to look at older releases of both Microsoft.Identity.Client and of MS Graph. With Microsoft.Graph 4.54.0 I had a similar problem, only worse, because this MS Graph SDK version directly depends on Microsoft.Identity.Client version 4.49.1.0, which forced me to use this release. And also here I got a version conflict as MS Graph required Microsoft.IdentityModel.Abstractions version 6.26.1.0.
This means that a downgrade to an older release is also not an option. In fact, I did not find any release of MS Graph and Microsoft.Identity.Client having compatible dependencies.

Relevant code snippets

No response

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

Provide a version of Microsoft.Identity.Client depending on Microsoft.IdentityModel.Abstractions Version 7.3.1 would solve the issue.

[bgavrilMS]

We will not upgrade to 7.3.1 - MSAL works fine with 6.26.1 (but we'll upgrade to latest 6.*).

See https://learn.microsoft.com/en-us/nuget/concepts/dependency-resolution#cousin-dependencies for dependency resolution.

[jmprieur]

I think we should depend on 7.x except for net462, netstandard2.0 and net472.
This is what IdWeb does, @bgavrilMS

[bgavrilMS]

@jmprieur - out of curiosity, why not on net462 / netstandard ?

[liebichw]

The problem I have with the existing state is that in order to run the program, I have to modify the program's .config file with binding redircects. It is not a problem for me to build our library, but to run the program using it *without having to modify the configuration.
And the program is running with .NET 4.6.2, so not doing it for net462 is exactly our problem.

[bgavrilMS]

@liebichw - pls help me understand the setup.

Program -> your lib -> MSAL -> abstractions 6.26.1
Program -> your lib -> Microsoft.Graph -> abstractions 7.x'

Note that I tried to create a console app which targets net462 and references:

And this works fine, it builds without errors / warnings.

Maybe your program uses the old packages.config?

[liebichw]

The setup description is correct - I want to use MS Graph 5.44.0, which depends on abstractions 7.31, and MSAL 4.59.0, which depends on MSAL 6.22.0

I am still using the old packages.config, yes, I will try to switch, and see if it helps.
The problem I have is not with building everything - that works fine.

But when I try to use the library together with the program which uses it as a plugin, then I get exceptions during runtime, unless I specify dependency overrides - and in poroduction this will be a problem.