Add bound-credential support for Bearer tokens (cert + mTLS)#3835
Merged
Conversation
Honors CredentialDescription.UseBoundCredential on the Certificate branch by wiring the cert through MSAL's CertificateOptions.SendCertificateOverMtls = true. The resulting Bearer access token is bound to the certificate via mTLS to Entra's mTLSauth.microsoft.com endpoint. Depends on microsoft-identity-abstractions-for-dotnet#252. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bgavrilMS
approved these changes
Jun 9, 2026
bgavrilMS
left a comment
bgavrilMS
left a comment
Member
There was a problem hiding this comment.
This is fine for X509 cred. But pls make sure we have follow up for FIC via MSI and for FIC via OIDC
PR #3835 introduces use of CredentialDescription.UseBoundCredential, which was added in Microsoft.Identity.Abstractions 12.1.0. The pinned version (12.0.0) does not expose this property, causing CS1061 on every target framework in the 'Build and run unit tests' workflow. Bumping the default MicrosoftIdentityAbstractionsVersion to 12.1.0 restores compilation across net462, net472, netstandard2.0, net8.0, net9.0, and net10.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolved Directory.Build.props conflict by combining master's bumps (MicrosoftIdentityClientVersion 4.84.1 -> 4.84.2, new MicrosoftIdentityClientKeyAttestationVersion 4.84.2) with the abstractions 12.1.0 bump required by this PR's use of CredentialDescription.UseBoundCredential. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
MSI + FIC is merged - #3839 OIDC is tracked seperately |
4gust
approved these changes
Jun 12, 2026
iarekk
approved these changes
Jun 12, 2026
This was referenced Jun 24, 2026
Merged
Closed
Open
Open
This was referenced Jun 24, 2026
Merged
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR adds
Honors the new
CredentialDescription.UseBoundCredentialproperty (from microsoft-identity-abstractions-for-dotnet#252) on the Certificate credential branch.When
UseBoundCredential = trueand a certificate is configured, IdWeb now wires the cert via MSAL'sWithCertificate(cert, new CertificateOptions { SendCertificateOverMtls = true }). This causes MSAL to send the cert over mTLS to Entra's mTLS endpoint (mtlsauth.microsoft.com) and return a Bearer access token bound to that certificate.Changes
ConfidentialClientApplicationBuilderExtension.csWithClientCredentialsAsyncnow branches onUseBoundCredentialWithClientCredentialsTests.csUseBoundCredential = true/false)tests/DevApps/daemon-app/daemon-app-cert-bound/mtlsauth.microsoft.comWhat this PR does not add (deferred to follow-up PRs)
GetSignedClientAssertionAsyncvirtual onClientAssertionProviderBase, no override onManagedIdentityClientAssertion. TheSignedAssertionbranch in the dispatch is untouched..WithMtlsProofOfPossession()here.Microsoft.Identity.Client.KeyAttestation.WithAttestationSupport()is not added.These are intentionally split out so reviewers can land the smallest possible cert-path change first.
Dependencies
CredentialDescription.UseBoundCredentialfrom microsoft-identity-abstractions-for-dotnet#252.How it was validated
-p:UseLocalAbstractions=trueswapping in a local ProjectReference to the abstractions PR branch.daemon-app-cert-bound) successfully obtains an access token (AT length 517, 1h expiry) frommtlsauth.microsoft.com.Reviewer notes
Directory.Build.targets(abstractions ProjectReference swap, gated by-p:UseLocalAbstractions=true) is not included in this PR.