Add IConfidentialClientApplicationProvider and CachePartitionKey support

[iNinja]

Summary

Two additions to Microsoft.Identity.Web.TokenAcquisition:

IConfidentialClientApplicationProvider

New public interface that exposes the managed IConfidentialClientApplication for a given authentication scheme. Enables extensions to call MSAL directly (e.g. for custom token acquisition flows) while reusing the same CCA instance, credentials, and token cache that IdWeb manages.

TokenAcquisition implements the interface. Registered in DI alongside ITokenAcquisition with the same lifetime (scoped or singleton depending on configuration).

TokenAcquisitionOptions.CachePartitionKey

New optional IDictionary<string, string> property. When set, TokenAcquisition threads it to MSAL's AcquireTokenSilent via WithCachePartitionKey() (MSAL 4.84.1). Enables partition-aware silent token lookup for scenarios where cached tokens need isolation (e.g. parallel sessions for the same user with different lifetimes).

The property is cloned in TokenAcquisitionOptions.Clone() to prevent shared state.

Dependencies

• MSAL 4.84.1 (WithCachePartitionKey API, merged and released)
• Directory.Build.props bumps MicrosoftIdentityClientVersion from 4.84.0 to 4.84.1

Changes

File	Change
IConfidentialClientApplicationProvider.cs	New public interface
TokenAcquisition.cs	Implements interface + threads CachePartitionKey to MSAL
TokenAcquisitionOptions.cs	CachePartitionKey property + Clone support
ServiceCollectionExtensions.cs	DI registration for the new interface
PublicAPI/NetCore/PublicAPI.Unshipped.txt	API declarations
PublicAPI/NetFramework/PublicAPI.Unshipped.txt	API declarations
Directory.Build.props	MSAL version bump

Testing

• 4 unit tests: DI registration, resolution to TokenAcquisition, CachePartitionKey defaults and setter
• All existing tests pass

[Copilot]

Pull request overview

Adds extensibility and cache-partitioning capabilities to Microsoft.Identity.Web.TokenAcquisition by exposing the managed MSAL confidential client and allowing callers to provide MSAL cache partition key components for silent token acquisition.

Changes:

• Introduces IConfidentialClientApplicationProvider and registers it in DI, implemented by TokenAcquisition.
• Adds TokenAcquisitionOptions.CachePartitionKey and threads it into MSAL AcquireTokenSilent via WithCachePartitionKey.
• Updates public API baselines and bumps MSAL dependency to 4.84.1; adds unit tests for DI registration and options defaults.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/Microsoft.Identity.Web.Test/TokenAcquisitionTests.cs	Adds unit tests for CachePartitionKey default/setter behavior.
tests/Microsoft.Identity.Web.Test/ServiceCollectionExtensionsTests.cs	Extends DI registration tests to cover the new provider and updated service counts.
src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisitionOptions.cs	Adds CachePartitionKey option and clones it in Clone().
src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs	Implements the new provider interface and applies cache partition keys to silent acquisition builder.
src/Microsoft.Identity.Web.TokenAcquisition/ServiceCollectionExtensions.cs	Registers IConfidentialClientApplicationProvider in DI (scoped/singleton).
src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/NetFramework/PublicAPI.Unshipped.txt	Declares new public API surface for NetFramework builds.
src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/NetCore/PublicAPI.Unshipped.txt	Declares new public API surface for NetCore builds.
src/Microsoft.Identity.Web.TokenAcquisition/IConfidentialClientApplicationProvider.cs	Adds the new public interface exposing the managed MSAL CCA.
Directory.Build.props	Bumps MSAL version from 4.84.0 to 4.84.1.

Comments suppressed due to low confidence (1)

src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisitionOptions.cs:60

• CachePartitionKey is cloned in TokenAcquisitionOptions.Clone(), but there isn't a unit test asserting the clone is a deep copy (i.e., cloned.CachePartitionKey is not the same instance and is unaffected by subsequent mutations to the original). Adding a test would help prevent regressions since avoiding shared mutable state is part of the new behavior.

                CachePartitionKey = CachePartitionKey != null
                    ? new Dictionary<string, string>(CachePartitionKey)
                    : null

[bgavrilMS]

Approved with comments