From c09228679405693f99f1b018db6d27431f0e3e69 Mon Sep 17 00:00:00 2001
From: Andy Zheng <anzhen@microsoft.com>
Date: Thu, 23 Oct 2025 09:59:03 -0400
Subject: [PATCH 1/2] Add domainHint support to authorization request

---
 .../parameters/TokenCommandParameters.java        |  2 ++
 .../common/java/controllers/BaseController.java   |  1 +
 .../microsoft/MicrosoftAuthorizationRequest.java  | 15 +++++++++++++++
 .../MicrosoftAuthorizationRequestTest.java        |  7 +++++++
 4 files changed, 25 insertions(+)

diff --git a/common4j/src/main/com/microsoft/identity/common/java/commands/parameters/TokenCommandParameters.java b/common4j/src/main/com/microsoft/identity/common/java/commands/parameters/TokenCommandParameters.java
index 357d75cecf..46d3c61f24 100644
--- a/common4j/src/main/com/microsoft/identity/common/java/commands/parameters/TokenCommandParameters.java
+++ b/common4j/src/main/com/microsoft/identity/common/java/commands/parameters/TokenCommandParameters.java
@@ -69,6 +69,8 @@ public class TokenCommandParameters extends CommandParameters {
 
     private final String loginHint;
 
+    private final String domainHint;
+
     private final List<Map.Entry<String, String>> extraOptions;
 
     public Set<String> getScopes() {
diff --git a/common4j/src/main/com/microsoft/identity/common/java/controllers/BaseController.java b/common4j/src/main/com/microsoft/identity/common/java/controllers/BaseController.java
index 1acc0adc52..514ed80812 100644
--- a/common4j/src/main/com/microsoft/identity/common/java/controllers/BaseController.java
+++ b/common4j/src/main/com/microsoft/identity/common/java/controllers/BaseController.java
@@ -366,6 +366,7 @@ private void setBuilderProperties(@SuppressWarnings(WarningType.rawtype_warning)
             final MicrosoftStsAuthorizationRequest.Builder msBuilder = (MicrosoftStsAuthorizationRequest.Builder) builder;
             msBuilder
                     .setLoginHint(interactiveTokenCommandParameters.getLoginHint())
+                    .setDomainHint(interactiveTokenCommandParameters.getDomainHint())
                     .setPrompt(interactiveTokenCommandParameters.getPrompt().toString())
                     .setPreferredAuthMethod(interactiveTokenCommandParameters.getPreferredAuthMethod());
             final String installedCompanyPortalVersion =
diff --git a/common4j/src/main/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequest.java b/common4j/src/main/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequest.java
index f86dda1b55..846c339c81 100644
--- a/common4j/src/main/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequest.java
+++ b/common4j/src/main/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequest.java
@@ -75,6 +75,14 @@ public abstract class MicrosoftAuthorizationRequest<T extends MicrosoftAuthoriza
     @SerializedName("login_hint")
     private final String mLoginHint;
 
+    /**
+     * Provides a hint about the tenant or domain that the user should use to sign in.
+     */
+    @Getter
+    @Accessors(prefix = "m")
+    @SerializedName("domain_hint")
+    private final String mDomainHint;
+
     /**
      * Correlation ID.
      */
@@ -168,6 +176,7 @@ protected MicrosoftAuthorizationRequest(@SuppressWarnings(WarningType.rawtype_wa
         super(builder);
         mAuthority = builder.mAuthority;
         mLoginHint = builder.mLoginHint;
+        mDomainHint = builder.mDomainHint;
         mCorrelationId = builder.mCorrelationId;
 
         final PkceChallenge challenge = builder.mPkceChallenge == null ?
@@ -217,6 +226,7 @@ public abstract static class Builder<B extends MicrosoftAuthorizationRequest.Bui
         private Boolean mMultipleCloudAware;
         private UUID mCorrelationId;
         private String mLoginHint;
+        private String mDomainHint;
         private PkceChallenge mPkceChallenge;
         private PreferredAuthMethod mPreferredAuthMethod;
 
@@ -254,6 +264,11 @@ public B setLoginHint(String loginHint) {
             return self();
         }
 
+        public B setDomainHint(String domainHint) {
+            mDomainHint = domainHint;
+            return self();
+        }
+
         public B setPreferredAuthMethod(@Nullable final PreferredAuthMethod preferredAuthMethod) {
             mPreferredAuthMethod = preferredAuthMethod;
             return self();
diff --git a/common4j/src/test/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequestTest.java b/common4j/src/test/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequestTest.java
index a8b9e8d342..bd8a28ea84 100644
--- a/common4j/src/test/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequestTest.java
+++ b/common4j/src/test/com/microsoft/identity/common/java/providers/microsoft/MicrosoftAuthorizationRequestTest.java
@@ -60,6 +60,7 @@ public void tearDown() {
     public static final boolean MOCK_MULTIPLE_CLOUD_AWARE = true;
     public static final UUID MOCK_CORRELATION_ID = UUID.randomUUID();
     public static final String MOCK_LOGIN_HINT = "MOCK_LOGIN_HINT";
+    public static final String MOCK_DOMAIN_HINT = "MOCK_DOMAIN_HINT";
 
     // Check that we're not sending anything unexpected to the server side
     // by comparing the resulted URL by-character.
@@ -74,6 +75,7 @@ public void testCreateUriFromAuthorizationRequest() throws MalformedURLException
                 .setMultipleCloudAware(MOCK_MULTIPLE_CLOUD_AWARE)
                 .setCorrelationId(MOCK_CORRELATION_ID)
                 .setLoginHint(MOCK_LOGIN_HINT)
+                .setDomainHint(MOCK_DOMAIN_HINT)
                 .setPkceChallenge(MOCK_PKCE_CHALLENGE)
                 .setState(MOCK_STATE)
                 .build();
@@ -81,6 +83,7 @@ public void testCreateUriFromAuthorizationRequest() throws MalformedURLException
         if (CommonFlightsManager.INSTANCE.getFlightsProvider().isFlightEnabled(CommonFlight.ENABLE_AM_API_WORKPROFILE_EXTRA_QUERY_PARAMETERS)) {
             Assert.assertEquals(MockAuthorizationRequest.MOCK_AUTH_ENDPOINT +
                             "?login_hint=" + MOCK_LOGIN_HINT +
+                            "&domain_hint=" + MOCK_DOMAIN_HINT +
                             "&client-request-id=" + MOCK_CORRELATION_ID +
                             "&code_challenge=" + MOCK_PKCE_CHALLENGE.getCodeChallenge() +
                             "&code_challenge_method=" + MOCK_PKCE_CHALLENGE.getCodeChallengeMethod() +
@@ -100,6 +103,7 @@ public void testCreateUriFromAuthorizationRequest() throws MalformedURLException
         } else {
             Assert.assertEquals(MockAuthorizationRequest.MOCK_AUTH_ENDPOINT +
                             "?login_hint=" + MOCK_LOGIN_HINT +
+                            "&domain_hint=" + MOCK_DOMAIN_HINT +
                             "&client-request-id=" + MOCK_CORRELATION_ID +
                             "&code_challenge=" + MOCK_PKCE_CHALLENGE.getCodeChallenge() +
                             "&code_challenge_method=" + MOCK_PKCE_CHALLENGE.getCodeChallengeMethod() +
@@ -129,6 +133,7 @@ public void testCreateUriFromAuthorizationRequestWithWPAvailable() throws Malfor
                 .setMultipleCloudAware(MOCK_MULTIPLE_CLOUD_AWARE)
                 .setCorrelationId(MOCK_CORRELATION_ID)
                 .setLoginHint(MOCK_LOGIN_HINT)
+                .setDomainHint(MOCK_DOMAIN_HINT)
                 .setPkceChallenge(MOCK_PKCE_CHALLENGE)
                 .setState(MOCK_STATE)
                 .build();
@@ -136,6 +141,7 @@ public void testCreateUriFromAuthorizationRequestWithWPAvailable() throws Malfor
         if (CommonFlightsManager.INSTANCE.getFlightsProvider().isFlightEnabled(CommonFlight.ENABLE_AM_API_WORKPROFILE_EXTRA_QUERY_PARAMETERS)) {
             Assert.assertEquals(MockAuthorizationRequest.MOCK_AUTH_ENDPOINT +
                             "?login_hint=" + MOCK_LOGIN_HINT +
+                            "&domain_hint=" + MOCK_DOMAIN_HINT +
                             "&client-request-id=" + MOCK_CORRELATION_ID +
                             "&code_challenge=" + MOCK_PKCE_CHALLENGE.getCodeChallenge() +
                             "&code_challenge_method=" + MOCK_PKCE_CHALLENGE.getCodeChallengeMethod() +
@@ -155,6 +161,7 @@ public void testCreateUriFromAuthorizationRequestWithWPAvailable() throws Malfor
         } else {
             Assert.assertEquals(MockAuthorizationRequest.MOCK_AUTH_ENDPOINT +
                             "?login_hint=" + MOCK_LOGIN_HINT +
+                            "&domain_hint=" + MOCK_DOMAIN_HINT +
                             "&client-request-id=" + MOCK_CORRELATION_ID +
                             "&code_challenge=" + MOCK_PKCE_CHALLENGE.getCodeChallenge() +
                             "&code_challenge_method=" + MOCK_PKCE_CHALLENGE.getCodeChallengeMethod() +

From e22ccfc4d1b3c0138eb5dd4a80e2845f6027d5d9 Mon Sep 17 00:00:00 2001
From: Andy Zheng <anzhen@microsoft.com>
Date: Mon, 27 Oct 2025 13:03:22 -0400
Subject: [PATCH 2/2] Update changelog

---
 changelog.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/changelog.txt b/changelog.txt
index b8ea0f8e43..e31c661dfe 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -5,6 +5,7 @@ vNext
 - [MINOR] Add OTel Benchmarker (#2786)
 - [MINOR] WebApps AccountId Registry (#2787)
 - [MINOR] Take flight value for whether to show webcp flow in weview or not in brokerless scenarios. (#2784)
+- [MINOR] Add domainHint support to authorization request (#2792)
 
 Version 23.0.2
 ----------