Skip to content

MTLS Without Tokens Support#3747

Merged
gladjohn merged 24 commits intoAzureAD:masterfrom
tlupes:mTLS
Apr 17, 2026
Merged

MTLS Without Tokens Support#3747
gladjohn merged 24 commits intoAzureAD:masterfrom
tlupes:mTLS

Conversation

@tlupes
Copy link
Copy Markdown
Contributor

@tlupes tlupes commented Mar 11, 2026 •
edited
Loading

Support for mTLS authentication only mode for DownstreamApi

Adds support for mTLS only mode for DownstreamApi. This allows you to configure a protocol of "MTLS" and the configured certificate will be attached to the request without and authentication header.

This is set up to work with all existing certificate infrastructure as Token Acquisition. This means that the Managed Certificate logic will fit right in.

Description

This essentially does the following:

  • Refactors all the certificate handling logic (including the observers) into a reusable "CredentialProvider"
  • Modifies TokenAquesition to use this CredentialProvider
  • Configures DownstreamApi to use this CredentialProvider as well.
    • If Protocol is MTLS, tokens are skipped
    • If Protocol is MTLS, it takes the first certificate credential and adds it as a certificate.
    • If Protocol is MTLS, the result of the call is checked right there to see if it's a certificate error. If so, it retries once.

@tlupes tlupes marked this pull request as ready for review March 17, 2026 20:54
@tlupes tlupes requested a review from a team as a code owner March 17, 2026 20:54
cpp11nullptr
cpp11nullptr approved these changes Mar 19, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@cpp11nullptr cpp11nullptr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we also add sample app (see tests/DevApps/MtlsPop as an example) which shows a developer experience?

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/ConfidentialClientApplicationBuilderExtension.cs Outdated
Comment thread src/Microsoft.Identity.Web.TokenAcquisition/CredentialsProvider.cs Outdated
neha-bhargava
neha-bhargava reviewed Mar 20, 2026
View reviewed changes
Comment thread src/Microsoft.Identity.Web.TokenAcquisition/CredentialsProvider.cs
neha-bhargava
neha-bhargava reviewed Mar 20, 2026
View reviewed changes
Comment thread src/Microsoft.Identity.Web.DownstreamApi/DownstreamApi.cs Outdated
neha-bhargava
neha-bhargava approved these changes Mar 23, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@neha-bhargava neha-bhargava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Thanks!

bgavrilMS
bgavrilMS reviewed Mar 23, 2026
View reviewed changes
Comment thread src/Microsoft.Identity.Web.DownstreamApi/DownstreamApi.cs Outdated
@bgavrilMS bgavrilMS requested a review from gladjohn March 26, 2026 12:53
gladjohn
gladjohn reviewed Mar 31, 2026
View reviewed changes
Comment thread src/Microsoft.Identity.Web.DownstreamApi/DownstreamApi.cs
@gladjohn gladjohn merged commit 80f5a1b into AzureAD:master Apr 17, 2026
4 checks passed
This was referenced Apr 17, 2026
Merged
Merged
This was referenced Apr 20, 2026
Closed
Open
Open
Open
Open
Merged
Closed
Merged
Merged
Merged
Merged
Merged
Merged
Open
Closed
Open
github-actions Bot pushed a commit to EelcoLos/nx-tinkering that referenced this pull request Apr 21, 2026
@dependabot
Bump Microsoft.Identity.Web from 4.7.0 to 4.8.0 (#1142)
5b6d7ef 
Pinned
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
at 4.8.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.8.0

## What's Changed
* Bump flatted from 3.3.3 to 3.4.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3753
* Update changelog.md for ID.Web 4.6.0 by @​bgavrilMS in
AzureAD/microsoft-identity-web#3756
* Add token binding to MicrosoftIdentityMessageHandler by @​cpp11nullptr
in AzureAD/microsoft-identity-web#3743
* Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by
@​dependabot[bot] in
AzureAD/microsoft-identity-web#3759
* Documentation: Clarify managed identity credential types for
containerized vs. VM/App Service deployments by @​Copilot in
AzureAD/microsoft-identity-web#3585
* Bump path-to-regexp from 8.3.0 to 8.4.0 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3762
* Upgrade Microsoft Application Insights packages by @​RojaEnnam in
AzureAD/microsoft-identity-web#3763
* Use Abstractions 12 by @​pmaytak in
AzureAD/microsoft-identity-web#3761
* Post-4.7.0 by @​pmaytak in
AzureAD/microsoft-identity-web#3768
* Fix Comp Gov DOTNET-Security-10.0 by @​reginayap8 in
AzureAD/microsoft-identity-web#3769
* Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by
@​reginayap8 in
AzureAD/microsoft-identity-web#3770
* fix warnings by @​gladjohn in
AzureAD/microsoft-identity-web#3771
* adding examples for using postgres as a distributed cache by
@​JaredMSFT in
AzureAD/microsoft-identity-web#3766
* Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility
test app by @​Copilot in
AzureAD/microsoft-identity-web#3774
* Bump vite from 7.1.11 to 7.3.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3772
* Skip legacy B2C local-account Todo UI test in WebAppUiTests by
@​Copilot in AzureAD/microsoft-identity-web#3778
* Fix initialization of ConfidentialClientApplicationOptions in
MergedOptions by @​cpp11nullptr in
AzureAD/microsoft-identity-web#3760
* Bump net8/net9/net10 runtime package baselines to patched crypto
servicing versions by @​Copilot in
AzureAD/microsoft-identity-web#3779
* Fix flaky certificate test failures on CI by @​gladjohn in
AzureAD/microsoft-identity-web#3780
* MTLS Without Tokens Support by @​tlupes in
AzureAD/microsoft-identity-web#3747
* Fix CredentialsProvider DI lifetime mismatch causing startup crash in
Development by @​Avery-Dunn in
AzureAD/microsoft-identity-web#3783
* Remove unused DataProtection configuration from Sidecar by @​Copilot
in AzureAD/microsoft-identity-web#3776

## New Contributors
* @​RojaEnnam made their first contribution in
AzureAD/microsoft-identity-web#3763
* @​reginayap8 made their first contribution in
AzureAD/microsoft-identity-web#3769
* @​JaredMSFT made their first contribution in
AzureAD/microsoft-identity-web#3766

**Full Changelog**:
AzureAD/microsoft-identity-web@4.6.0...4.8.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.7.0...4.8.0).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Apr 21, 2026
Merged
Merged
Merged
Merged
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bgavrilMS bgavrilMS bgavrilMS approved these changes

@cpp11nullptr cpp11nullptr cpp11nullptr approved these changes

@neha-bhargava neha-bhargava neha-bhargava approved these changes

@gladjohn gladjohn gladjohn approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@tlupes @bgavrilMS @cpp11nullptr @neha-bhargava @gladjohn