Skip to content

Adds support for implicit mTLS (Mutual TLS) transport for client assertion delegates#5670

Merged
gladjohn merged 5 commits intomainfrom
gladjohn/sni_bearer
Feb 3, 2026
Merged

Adds support for implicit mTLS (Mutual TLS) transport for client assertion delegates#5670
gladjohn merged 5 commits intomainfrom
gladjohn/sni_bearer

Conversation

@gladjohn
Copy link
Contributor

@gladjohn gladjohn commented Jan 23, 2026

Fixes #5633 #5680

Changes proposed in this request
This pull request refactors and improves the handling of mTLS (mutual TLS) and PoP (Proof of Possession) authentication flows in the confidential client codebase. The main changes include extracting and centralizing the mTLS/PoP parameter initialization logic, updating client assertion delegate handling to distinguish between string and certificate-based credentials, and improving diagnostics and result handling for mTLS scenarios. These changes make the codebase more maintainable, testable, and robust regarding mTLS/PoP authentication.

Refactoring and centralization of mTLS/PoP initialization:

  • Extracted the mTLS/PoP initialization logic from AcquireTokenCommonParameters into a new helper class MtlsPopParametersInitializer, making the logic more modular and testable. The new method TryInitMtlsPopParametersAsync replaces the old InitMtlsPopParametersAsync and delegates to this helper. [1] [2] [3]

Client assertion delegate and credential handling improvements:

  • Updated ConfidentialClientApplicationBuilder to properly distinguish between string-based and certificate-based client assertion delegates, using a new ClientAssertionStringDelegateCredential for string assertions. This ensures correct handling and initialization based on the credential type. [1] [2] [3] [4] [5]

mTLS detection and diagnostics:

  • Changed mTLS detection throughout the codebase to use IsMtlsRequested instead of checking for a non-null certificate directly, improving clarity and correctness in mTLS scenarios. [1] [2] [3]

Improved handling in certificate client credentials:

  • Refactored CertificateAndClaimsClientCredential to return a result object (ClientCredentialApplicationResult) indicating whether mTLS is being used and to improve logging and diagnostics for both JWT and mTLS flows. [1] [2] [3]

Code cleanup:

  • Removed unnecessary using statements from ClientAssertionDelegateCredential.cs for improved code clarity.

Testing
unit, integration

Performance impact
none

Documentation

  • All relevant documentation is updated.

@gladjohn gladjohn requested a review from a team as a code owner January 23, 2026 00:52
@gladjohn gladjohn force-pushed the gladjohn/sni_bearer branch from e8c624e to 2b9f559 Compare January 26, 2026 17:29
@gladjohn gladjohn force-pushed the gladjohn/sni_bearer branch 2 times, most recently from b199d2e to 039adf2 Compare January 27, 2026 19:34
@gladjohn gladjohn requested a review from bgavrilMS January 29, 2026 00:23
@gladjohn gladjohn force-pushed the gladjohn/sni_bearer branch 2 times, most recently from a5602c7 to 6b3214e Compare January 29, 2026 00:43
@gladjohn gladjohn force-pushed the gladjohn/sni_bearer branch from 6b3214e to f2aabce Compare February 3, 2026 18:59
@gladjohn gladjohn requested a review from trwalke February 3, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature Request] Add Bearer support for Bound FIC

3 participants