Add unit tests with HTTP mocking for vanilla dSTS + fix Authority par…

[XiaoxinMS2]

…sing

Adds 6 HTTP-mocked unit tests for the vanilla dSTS (Dedicated Security Token Service) token-acquisition path in Microsoft.Identity.Web, and fixes MergedOptions.ParseAuthorityIfNecessary so that the natural / documented dSTS configuration form works end-to-end:

options.Authority = "https://{host}/dstsv2/{tenantGuid}";

Without the fix, the AAD-style parser took the literal "dstsv2" as the tenant and dropped the actual tenant GUID, producing an authority MSAL rejected with "The DSTS authority URI should have at least 2 segments...".

Tests cover: token endpoint URI; client_credentials grant body; second-call cache hit; OAuth2 error -> MsalServiceException mapping; SendX5C=true includes x5c JWT header; SendX5C=false omits it. All tests use the existing MockHttpClientFactory infrastructure (no real network / Key Vault / cert) and run in any CI environment.

No public API changes.

Add unit tests with HTTP mocking for vanilla dSTS scenarios + fix Authority-only configuration

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

Adds 6 HTTP-mocked unit tests covering the vanilla dSTS (Dedicated Security Token Service) token-acquisition path in Microsoft.Identity.Web, and fixes a parser bug in MergedOptions.ParseAuthorityIfNecessary that prevented the natural / documented dSTS configuration form (options.Authority = "https://{host}/dstsv2/{tenantGuid}") from working.

Both changes ship together because the new tests use the natural configuration form, which is the form the parser fix unblocks.

Vanilla dSTS support in Id.Web previously had zero unit-test coverage — the only assertion lived in integration tests that required a real dSTS deployment + Key Vault certificate, so they couldn't run in CI. Anyone refactoring MergedOptions / TokenAcquirerFactory could silently break dSTS token acquisition without any signal.

Fixes #{bug number} (in this specific format)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• login.microsoftonline.com
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Release/net8.0/Microsoft.Identity.Web.Test.runtimeconfig.json --depsfile /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Release/net8.0/Microsoft.Identity.Web.Test.deps.json /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Release/net8.0/testhost.dll --port 40265 --endpoint 127.0.0.1:040265 --role client --parentprocessid 5124 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[XiaoxinMS2]

@microsoft-github-policy-service agree company="Microsoft"