Adds support for implicit mTLS (Mutual TLS) transport for client assertion delegates#5670
Merged
Adds support for implicit mTLS (Mutual TLS) transport for client assertion delegates#5670
Conversation
e8c624e to
2b9f559
Compare
bgavrilMS
reviewed
Jan 27, 2026
src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenCommonParameters.cs
Outdated
Show resolved
Hide resolved
bgavrilMS
reviewed
Jan 27, 2026
src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenCommonParameters.cs
Outdated
Show resolved
Hide resolved
bgavrilMS
reviewed
Jan 27, 2026
src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenCommonParameters.cs
Outdated
Show resolved
Hide resolved
b199d2e to
039adf2
Compare
a5602c7 to
6b3214e
Compare
trwalke
reviewed
Jan 29, 2026
src/client/Microsoft.Identity.Client/ApiConfig/Parameters/MtlsPopParametersInitializer.cs
Outdated
Show resolved
Hide resolved
trwalke
reviewed
Jan 29, 2026
src/client/Microsoft.Identity.Client/ApiConfig/Parameters/MtlsPopParametersInitializer.cs
Show resolved
Hide resolved
trwalke
reviewed
Jan 29, 2026
src/client/Microsoft.Identity.Client/ApiConfig/Parameters/MtlsPopParametersInitializer.cs
Show resolved
Hide resolved
trwalke
reviewed
Jan 29, 2026
src/client/Microsoft.Identity.Client/Internal/Requests/AuthenticationRequestParameters.cs
Outdated
Show resolved
Hide resolved
trwalke
reviewed
Jan 29, 2026
tests/Microsoft.Identity.Test.Integration.netcore/SeleniumTests/FociTests.cs
Show resolved
Hide resolved
bgavrilMS
approved these changes
Feb 3, 2026
6b3214e to
f2aabce
Compare
trwalke
approved these changes
Feb 3, 2026
1 task
This was referenced Feb 5, 2026
This was referenced Feb 6, 2026
1 task
This was referenced Feb 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #5633 #5680
Changes proposed in this request
This pull request refactors and improves the handling of mTLS (mutual TLS) and PoP (Proof of Possession) authentication flows in the confidential client codebase. The main changes include extracting and centralizing the mTLS/PoP parameter initialization logic, updating client assertion delegate handling to distinguish between string and certificate-based credentials, and improving diagnostics and result handling for mTLS scenarios. These changes make the codebase more maintainable, testable, and robust regarding mTLS/PoP authentication.
Refactoring and centralization of mTLS/PoP initialization:
AcquireTokenCommonParametersinto a new helper classMtlsPopParametersInitializer, making the logic more modular and testable. The new methodTryInitMtlsPopParametersAsyncreplaces the oldInitMtlsPopParametersAsyncand delegates to this helper. [1] [2] [3]Client assertion delegate and credential handling improvements:
ConfidentialClientApplicationBuilderto properly distinguish between string-based and certificate-based client assertion delegates, using a newClientAssertionStringDelegateCredentialfor string assertions. This ensures correct handling and initialization based on the credential type. [1] [2] [3] [4] [5]mTLS detection and diagnostics:
IsMtlsRequestedinstead of checking for a non-null certificate directly, improving clarity and correctness in mTLS scenarios. [1] [2] [3]Improved handling in certificate client credentials:
CertificateAndClaimsClientCredentialto return a result object (ClientCredentialApplicationResult) indicating whether mTLS is being used and to improve logging and diagnostics for both JWT and mTLS flows. [1] [2] [3]Code cleanup:
ClientAssertionDelegateCredential.csfor improved code clarity.Testing
unit, integration
Performance impact
none
Documentation