Update the ROPC flow CCA to pass the send x5c to MSAL by neha-bhargava · Pull Request #3671 · AzureAD/microsoft-identity-web

neha-bhargava · 2026-01-13T22:05:57Z

Send X5C to MSAL for ROPC flow

You've read the Contributor Guide and Code of Conduct.
You've included unit or integration tests for your change, where applicable.
You've included inline docs for your change, where applicable.
There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Updated the code to send x5c for ROPC CCA

This fixes a bug when sendX5C is passed through merged options but not sent to MSAL and hence is missed.

Fixes #{bug number} (in this specific format)

tests/Microsoft.Identity.Web.Test/TokenAcquisitionTests.cs

JoshLozensky · 2026-01-14T18:54:51Z

tests/Microsoft.Identity.Web.Test/TokenAcquisitionTests.cs

+                Assert.DoesNotContain("\"x5c\"", jwtHeader, StringComparison.Ordinal);
+            }
+        }
+


Are any of these helpers generic enough to add to the Tests.Common project as TestHelpers?

These are very specific to validating that the x5c is propagated to MSAL and included in the request to ests.

[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Updated [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) from 4.3.0 to 4.4.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.4.0 ### New features - Add AOT-compatible web API authentication for .NET 10+. See [#3705](AzureAD/microsoft-identity-web#3705) and [#3664](AzureAD/microsoft-identity-web#3664). - Propagate long-running web API session key back to callers in user token acquisition. See [#3728](AzureAD/microsoft-identity-web#3728). - Add OBO event initialization for OBO APIs. See [#3724](AzureAD/microsoft-identity-web#3724). - Add support for calling `WithClientClaims` flow for token acquisition. See [#3623](AzureAD/microsoft-identity-web#3623). - Add `OnBeforeTokenAcquisitionForOnBehalfOf` event. See [#3680](AzureAD/microsoft-identity-web#3680). ### Bug fixes - Throw `InvalidOperationException` with actionable message when a custom credential is not registered. See [#3626](AzureAD/microsoft-identity-web#3626). - Fix event firing for `InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync`. See [#3717](AzureAD/microsoft-identity-web#3717). - Update `OnBeforeTokenAcquisitionForOnBehalfOf` to construct `ClaimsPrincipal` from token. See [#3714](AzureAD/microsoft-identity-web#3714). - Add a retry counter for acquire token and updated tests with a fake secret. See [#3682](AzureAD/microsoft-identity-web#3682). - Fix OBO user error handling. See [#3712](AzureAD/microsoft-identity-web#3712). - Fix override merging for app token (and others). See [#3644](AzureAD/microsoft-identity-web#3644). - Fix certificate reload logic to only trigger on certificate-specific errors. See [#3653](AzureAD/microsoft-identity-web#3653). - Update ROPC flow CCA to pass `SendX5C` to MSAL. See [#3671](AzureAD/microsoft-identity-web#3671). ### Dependencies updates - Bump `qs` in `/tests/DevApps/SidecarAdapter/typescript`. See [#3725](AzureAD/microsoft-identity-web#3725). - Downgrade Microsoft.Extensions.Configuration.Binder to 2.1.0 on .NET Framework. See [#3730](AzureAD/microsoft-identity-web#3730). - Update .NET SDK to 10.0.103 to address DOTNET-Security-10.0 vulnerability. See [#3726](AzureAD/microsoft-identity-web#3726). - Upgrade to Microsoft.Identity.Abstractions 11 for AoT compatibility. See [#3699](AzureAD/microsoft-identity-web#3699). - Update to MSAL 4.81.0. See [#3665](AzureAD/microsoft-identity-web#3665). ### Documentation - Add documentation for auto-generated session key for long-running OBO session. See [#3729](AzureAD/microsoft-identity-web#3729). - Improve the Aspire doc article and skills. See [#3695](AzureAD/microsoft-identity-web#3695). - Add an article and agent skill to add Entra ID to an Aspire app. See [#3689](AzureAD/microsoft-identity-web#3689). - Fix misleading comment in `CertificatelessOptions.ManagedIdentityClientId`. See [#3667](AzureAD/microsoft-identity-web#3667). - Add Copilot explore tool functionality. See [#3694](AzureAD/microsoft-identity-web#3694). ### Fundamentals - Remove unnecessary warning suppression. See [#3715](AzureAD/microsoft-identity-web#3715). - Migrate labs to Lab.API 2.x (first pass). See [#3710](AzureAD/microsoft-identity-web#3710). - Update Sidecar E2E test constants. See [#3693](AzureAD/microsoft-identity-web#3693). - Fix intermittent failures in `CertificatesObserverTests`. See [#3687](AzureAD/microsoft-identity-web#3687). - Add validation baseline exclusions. See [#3684](AzureAD/microsoft-identity-web#3684). - Add dSTS integration tests. See [#3677](AzureAD/microsoft-identity-web#3677). - Fix FIC test. See [#3663](AzureAD/microsoft-identity-web#3663). - Update IdentityWeb version, build logic, and validation. See [#3659](AzureAD/microsoft-identity-web#3659). ### New Contributors * @XiaoxinMS2 made their first contribution in AzureAD/microsoft-identity-web#3677 * @RyAuld made their first contribution in AzureAD/microsoft-identity-web#3687 * @agocke made their first contribution in AzureAD/microsoft-identity-web#3664 * @MZOLN made their first contribution in AzureAD/microsoft-identity-web#3700 * @christian-posta made their first contribution in AzureAD/microsoft-identity-web#3644 * @4gust made their first contribution in AzureAD/microsoft-identity-web#3682 * @rayluo made their first contribution in AzureAD/microsoft-identity-web#3714 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.3.0...4.4.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web&package-manager=nuget&previous-version=4.3.0&new-version=4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Update the ROPC flow CCA to pass the send x5c to MSAL

7e07789

neha-bhargava requested a review from a team as a code owner January 13, 2026 22:05

trwalke approved these changes Jan 14, 2026

View reviewed changes

saurabhsathe-ms approved these changes Jan 14, 2026

View reviewed changes

bgavrilMS approved these changes Jan 14, 2026

View reviewed changes

JoshLozensky reviewed Jan 14, 2026

View reviewed changes

tests/Microsoft.Identity.Web.Test/TokenAcquisitionTests.cs Show resolved Hide resolved

neha-bhargava merged commit df55152 into master Jan 14, 2026
5 checks passed

neha-bhargava deleted the nebharg/sendX5CForROPCCCA branch January 14, 2026 18:53

JoshLozensky reviewed Jan 14, 2026

View reviewed changes

JoshLozensky approved these changes Jan 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update the ROPC flow CCA to pass the send x5c to MSAL#3671

Update the ROPC flow CCA to pass the send x5c to MSAL#3671
neha-bhargava merged 1 commit intomasterfrom
nebharg/sendX5CForROPCCCA

neha-bhargava commented Jan 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

JoshLozensky Jan 14, 2026 •

edited

Loading

Uh oh!

neha-bhargava Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

neha-bhargava commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Send X5C to MSAL for ROPC flow

Updated the code to send x5c for ROPC CCA

Uh oh!

Uh oh!

Uh oh!

JoshLozensky Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neha-bhargava Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

neha-bhargava commented Jan 13, 2026 •

edited

Loading

JoshLozensky Jan 14, 2026 •

edited

Loading