MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support by tlupes · Pull Request #3815 · AzureAD/microsoft-identity-web

tlupes · 2026-05-13T16:24:40Z

MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support

Continuation of the PR #3747 , this adds the same level of support to MicrosoftIdentityMessageHandler.

Description

Moved shared constants from DownstreamAPI to Microsoft.Identity.Web.TokenAcquisition/Constants.cs
Moved UnauthorizedHttpRequestException to Microsoft.Identity.Web.TokenAcquisition (Internal class)
Add InternalsVisibleTo between Microsoft.Identity.Web.TokenAcquisition and Microsoft.Identity.Web.DownstreamApi so that the above changes are accessible.
Minor changes to MicrosoftIdentityHttpClientBuilderExtensions:
- Previously this would always pass a null logger to the MicrosoftIdentityMessageHandler. Now, it will pass one if configured.
- Previously it would always make a new IMsalMtlsHttpFactory even if one were configured. Now, it will use a configured one if available.
- Support to pass a ICredentialsProvider to the handler.
Support within MicrosoftIdentityMessageHandler for mTLS without tokens

neha-bhargava

Left some comments

neha-bhargava · 2026-05-14T20:55:53Z

-  <ItemGroup Condition="'$(TargetFramework)' == 'net462' or '$(TargetFramework)' == 'net472' or '$(TargetFramework)' == 'netstandard2.0'">
-    <Compile Include="..\Shared\CodeAnalysisAttributes.cs" Link="Polyfills\CodeAnalysisAttributes.cs" />
-  </ItemGroup>
  <ItemGroup>


Why is this removed?

With the added InternalsVisibleTo it's no longer needed (and in fact results in errors).

Co-authored-by: Neha Bhargava <[email protected]>

…essageHandler.cs Co-authored-by: Neha Bhargava <[email protected]>

Co-authored-by: Neha Bhargava <[email protected]>

…com/AzureAD/microsoft-identity-web into MicrosoftIdentityMessageHandlerMtls

bgavrilMS · 2026-05-19T18:59:51Z

+            var httpClientFactory = services.GetService<IHttpClientFactory>();
+            if (httpClientFactory is not null)
+            {
+                return new MsalMtlsHttpClientFactory(httpClientFactory);


I don't know how this helps. All mTLS traffic will bypass the factory. I guess it's fine, I don't have an alternative for this. Maybe log a warning?

It's trying to handle scenarios where not all services are available, but some are. In this, if IMsalMtlsHttpClientFactory is available, then it will use that. Failing that, then it will check if IHttpClientFactory is available and use that. Failing that, it returns null.

bgavrilMS · 2026-05-19T19:01:23Z

+                {
+                    if (_credentialsProvider is null)
+                    {
+                        throw new InvalidOperationException("mTLS authentication requires a Credentials Provider object to be registered, but no such service was found.");


Consider adding an aka.ms/idweb/mtls page where you describe the sceanrios in more detail. As an app developer, I wouldn't know how to action this exception.

Added a link, I will make the link work in the near future. Once this is in I'll write up a help page for it.

bgavrilMS · 2026-05-19T19:03:15Z

            {
+                if (_mtlsHttpClientFactory is null)
+                {
+                    throw new InvalidOperationException("Authentication using mTLS requires a MtlsHttpClientFactory object to be registered, but no such service was found.");


A help page would be good.

BUt at the same time, can the app developer get into this state? I thought we provide an HTTP pipeline in all cases.

HTTP pipeline will not be present if the consumer did not register an http factory (e.g. services.AddHttp();)

… dispatch - Add missing 'using Microsoft.Identity.Web.Diagnostics' to DownstreamApi.cs so UnauthorizedHttpRequestException resolves. - Fix Invoke()/invoke() casing in CertificatesObserverTests (3 sites). - Rename SendAsync_WithMtlsPop_NullMtlsFactory_UsesBaseSendAsync to *_Throws and assert InvalidOperationException, matching the deliberate behavior change introduced when the mTLS dispatch was tightened to require an IMsalMtlsHttpClientFactory whenever a binding certificate is present. - Wire SendAsync_CertificateFailureRetry_ClonesRequest through a real mTLS factory so the retry-clone path it covers is reachable. Co-authored-by: Copilot <[email protected]>

…g with internal cert-failure retry For ProtocolScheme=MTLS there is no token to refresh with WWW-Authenticate claims, and SendWithCertRetryAsync already retried credential acquisition on the initial 401. Allowing the outer claims-challenge retry to also fire would issue a redundant third send and another GetCredentialAsync call, which may hit disk or Key Vault, for no semantic benefit. Add SendAsync_MtlsOnly_PersistentUnauthorizedWithClaims_DoesNotComposeRetries to pin the gating: exactly two sends and two GetCredentialAsync calls when the server keeps returning 401 + claims challenge in pure-mTLS mode. Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Extends the existing mTLS “without tokens” work (previously added for DownstreamApi) to MicrosoftIdentityMessageHandler, including DI wiring and shared-constant refactoring into Microsoft.Identity.Web.TokenAcquisition.

Changes:

Adds mTLS-only dispatch + bounded cert-failure retry behavior to MicrosoftIdentityMessageHandler, and updates tests accordingly.
Refactors shared protocol/status-code constants into Microsoft.Identity.Web.TokenAcquisition/Constants.cs and updates DownstreamApi/TokenAcquisition to consume them.
Updates HttpClient builder extensions to resolve configured IMsalMtlsHttpClientFactory, pass a logger, and optionally construct/use an ICredentialsProvider.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tests/Microsoft.Identity.Web.Test/MicrosoftIdentityMessageHandlerTokenBindingTests.cs	Updates/extends handler tests for mTLS-only retry and cloning behavior.
tests/Microsoft.Identity.Web.Test/MicrosoftIdentityHttpClientBuilderExtensionsTests.cs	Minor formatting change in tests.
tests/Microsoft.Identity.Web.Test/CertificatesObserverTests.cs	Expands observer test coverage to include handler-based mTLS path.
src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs	Updates reference to renamed certificate-related STS error-code constant.
src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/NetFramework/PublicAPI.Unshipped.txt	Records new public handler constructor overload for .NET Framework targets.
src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/NetCore/PublicAPI.Unshipped.txt	Records new public handler constructor overload for .NET (Core) targets.
src/Microsoft.Identity.Web.TokenAcquisition/Properties/InternalsVisibleTo.cs	Grants DownstreamApi access to TokenAcquisition internals used by the refactor.
src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs	Implements mTLS-only support + cert-failure retry orchestration in the handler.
src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityHttpClientBuilderExtensions.cs	Improves DI resolution for logger, mTLS factory, and credentials provider.
src/Microsoft.Identity.Web.TokenAcquisition/GlobalSuppressions.cs	Adds analyzer suppression for the new overload signature.
src/Microsoft.Identity.Web.TokenAcquisition/Constants.cs	Centralizes protocol names and auth-failure status code set.
src/Microsoft.Identity.Web.DownstreamApi/Microsoft.Identity.Web.DownstreamApi.csproj	Removes AOT attribute polyfill include (affects older TFMs).
src/Microsoft.Identity.Web.DownstreamApi/DownstreamApi.cs	Switches to shared constants and uses moved diagnostics exception.
src/Microsoft.Identity.Web.Diagnostics/UnauthorizedHttpRequestException.cs	Introduces moved exception type used for certificate-failure reporting.

Comments suppressed due to low confidence (1)

src/Microsoft.Identity.Web.DownstreamApi/Microsoft.Identity.Web.DownstreamApi.csproj:18

Microsoft.Identity.Web.DownstreamApi targets net462/net472/netstandard2.0 (see the PublicAPI conditional), but the csproj no longer links src/Shared/CodeAnalysisAttributes.cs. This file polyfills RequiresUnreferencedCodeAttribute / RequiresDynamicCodeAttribute for NETFRAMEWORK/NETSTANDARD2_0, and DownstreamApi uses these attributes unconditionally in DownstreamApi.cs. Without the polyfill, older TFMs will fail to compile. Re-add the conditional <Compile Include="..\Shared\CodeAnalysisAttributes.cs" ...> item group (as done in TokenAcquisition) or gate the attribute usages behind #if for TFMs that provide them.

<PropertyGroup Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))">
    <EnableConfigurationBindingGenerator>true</EnableConfigurationBindingGenerator>
  <IsAotCompatible>true</IsAotCompatible>
</PropertyGroup>
  <ItemGroup>
    <None Include="..\..\README.md">
      <Pack>True</Pack>
      <PackagePath>\</PackagePath>
    </None>
  </ItemGroup>

+        /// <summary>
+        /// Initializes a new instance of the <see cref="MicrosoftIdentityMessageHandler"/> class with mTLS PoP token binding support.
+        /// </summary>
+        /// <param name="headerProvider">
+        /// The <see cref="IAuthorizationHeaderProvider"/> used to acquire authorization headers for outgoing requests.
+        /// This is typically obtained from the dependency injection container.
+        /// </param>
+        /// <param name="defaultOptions">
+        /// Default authentication options that will be used for all requests unless overridden per-request.
+        /// If <see langword="null"/>, each request must specify its own authentication options or an exception will be thrown.
+        /// </param>
+        /// <param name="mtlsHttpClientFactory">
+        /// Optional factory for creating HTTP clients configured with mTLS client certificates for token binding
+        /// (mTLS PoP) scenarios. When provided and the <see cref="AuthorizationHeaderProviderOptions.ProtocolScheme"/>
+        /// is set to <c>"MTLS_POP"</c>, the handler will use this factory to create an HTTP client with the binding
+        /// certificate and send requests through it.
+        /// </param>
+        /// <param name="credentialsProvider">
+        /// Optional provider for certificates. This is required for mTLS-only authentication purposes.
+        /// </param>


Co-authored-by: Copilot Autofix powered by AI <[email protected]>

…com/AzureAD/microsoft-identity-web into MicrosoftIdentityMessageHandlerMtls

tlupes added 3 commits May 9, 2026 20:01

Add support for MTLS-only protocol to MicrosoftIdentityMessageHandler

6dfcb13

fix

72c15de

Use Constants

55dd9d6

tlupes requested a review from a team as a code owner May 13, 2026 16:24

Fix for resending sent request

5448ac6

neha-bhargava reviewed May 14, 2026

View reviewed changes

tlupes and others added 5 commits May 19, 2026 10:56

Update tests/Microsoft.Identity.Web.Test/CertificatesObserverTests.cs

7abfb27

Co-authored-by: Neha Bhargava <[email protected]>

Update src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityM…

3410127

…essageHandler.cs Co-authored-by: Neha Bhargava <[email protected]>

Update src/Microsoft.Identity.Web.TokenAcquisition/Constants.cs

e0a0cc9

Co-authored-by: Neha Bhargava <[email protected]>

First batch of PR review comments

d89038d

Merge branch 'MicrosoftIdentityMessageHandlerMtls' of https://github.…

5119874

…com/AzureAD/microsoft-identity-web into MicrosoftIdentityMessageHandlerMtls

bgavrilMS reviewed May 19, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/Constants.cs Outdated

bgavrilMS reviewed May 19, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs Outdated

bgavrilMS reviewed May 19, 2026

View reviewed changes

bgavrilMS approved these changes May 19, 2026

View reviewed changes

tlupes and others added 6 commits May 25, 2026 15:17

Justification for suppression

07135ee

Split auth calls into 3

3e8b65f

Various comment fixes

970f398

Merge branch 'master' into MicrosoftIdentityMessageHandlerMtls

ec96938

tlupes requested a review from Copilot May 26, 2026 01:00

Copilot started reviewing on behalf of tlupes May 26, 2026 01:00 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

tlupes and others added 3 commits May 25, 2026 21:10

Potential fix for pull request finding

2f9f9c9

Co-authored-by: Copilot Autofix powered by AI <[email protected]>

AI fixes

0fbed67

Merge branch 'MicrosoftIdentityMessageHandlerMtls' of https://github.…

9daab6d

…com/AzureAD/microsoft-identity-web into MicrosoftIdentityMessageHandlerMtls

Conversation

tlupes commented May 13, 2026

MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support

Description

Uh oh!

neha-bhargava left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants