title: MSAL AcquireTokenSilent prevent obtaining another User's token?
body: <p>I am investigating using <code>ClientApplicationBase.AcquireTokenSilent</code> method as documented here:
  <a href="https://docs.microsoft.com/en-us/dotnet/api/microsoft.identity.client.clientapplicationbase.acquiretokensilent?view=azure-dotnet" rel="nofollow noreferrer">ClientApplicationBase.AcquireTokenSilent Method</a></p>
  <p>How can I ensure the user being passed to this method is actually the user who initiated the request?</p>
  <p><strong>Context</strong></p>
  <p>My application is a Blazor WebAssembly Hosted Model using ASP.NET Core and is being used as an Office Web Add-in.</p>
  <p>Since it is used as an Office Web Add-in, the client-side needs to use <a href="https://docs.microsoft.com/en-us/office/dev/add-ins/develop/auth-with-office-dialog-api" rel="nofollow noreferrer">Office dialog for authentication</a>, which I have already implemented.</p>
  <p>The Blazor client-side application now receives access token from server-side after user sign-in.</p>
  <p>Authentication is achieved server-side using <code>ConfidentialClientApplication</code> and the access token is sent back to the client-side, after being cached in Sql Server.</p>
  <p>Client-side now wants to consult token cache or acquire refresh token before the original access token expires.</p>
  <p>I therefore plan on wrapping a call to <code>AcquireTokenSilent</code> in a server-side Web API endpoint that exposes this method to client-side.</p>
  <p>This endpoint would be called by the client-side to obtain tokens from cache for a specific user by passing in a username/UPN as a parameter to the endpoint. Upon receiving an exception <code>MsalUiRequiredException</code>, client-side would force user to sign-in again.</p>
  <p>Perhaps there is a way to get user token from <code>AcquireTokenSilent</code> using the original access token?</p>