}

    // Test backward compatibility: aad -> entraid mapping
    @Test
    public void test_getAuthenticator_aadMapsToEntraid() {
        // Register an authenticator with the new "entraid" name
        ComponentUtil.register(testAuthenticator, "entraidAuthenticator");

        // Use legacy "aad" SSO type
        currentSsoType = "aad";
        ssoManager = new SsoManager() {
            @Override

     */
    protected SsoAuthenticator getAuthenticator() {
        String ssoType = getSsoType();
        // Backward compatibility: map legacy "aad" (Azure AD) to "entraid" (Entra ID)
        if ("aad".equals(ssoType)) {
            ssoType = "entraid";
        }
        final String name = ssoType + "Authenticator";
        if (ComponentUtil.hasComponent(name)) {

import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import com.microsoft.aad.msal4j.AuthorizationCodeParameters;
import com.microsoft.aad.msal4j.ConfidentialClientApplication;
import com.microsoft.aad.msal4j.IAuthenticationResult;
import com.microsoft.aad.msal4j.RefreshTokenParameters;
import com.microsoft.aad.msal4j.SilentParameters;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.JWTParser;

            public String getSystemProperty(final String key) {
                return systemPropMap.get(key);
            }
        };

        // Test fallback to legacy aad.permission.fields key
        systemPropMap.put("aad.permission.fields", "mail,displayName");
        String[] fields = fessConfig.getEntraIdPermissionFields();
        assertEquals(2, fields.length);
        assertEquals("mail", fields[0]);

import org.codelibs.fess.sso.entraid.EntraIdAuthenticator;
import org.codelibs.fess.util.ComponentUtil;
import org.lastaflute.web.login.credential.LoginCredential;

import com.microsoft.aad.msal4j.IAccount;
import com.microsoft.aad.msal4j.IAuthenticationResult;

/**
 * Microsoft Entra ID credential implementation for Fess authentication.
 * Provides login credential functionality using Entra ID authentication results.
 */

     * Uses new entraid.permission.fields key with fallback to legacy aad.permission.fields.
     * @return Array of permission field names.
     */
    default String[] getEntraIdPermissionFields() {
        String value = getSystemProperty("entraid.permission.fields", null);
        if (StringUtil.isBlank(value)) {
            value = getSystemProperty("aad.permission.fields", "mail");
        }

len(s)) } } // auth calculates GHASH(ciphertext, additionalData), masks the result with // tagMask and writes the result to out. func auth(out, ciphertext, aad []byte, tagMask *[gcmTagSize]byte, productTable *[256]byte) { var hash [16]byte paddedGHASH(&hash, aad, productTable) paddedGHASH(&hash, ciphertext, productTable) lens := gcmLengths(uint64(len(aad))*8, uint64(len(ciphertext))*8) paddedGHASH(&hash, lens[:], productTable) copy(out, hash[:]) for i := range out { out[i] ^= tagMask[i] } } func seal(out...