[draft] sni + mtls #4965

gladjohn · 2024-10-22T00:32:27Z

initial draft to see if e2e integ can make it through, it does and fail with an expected error.

to-do ; unit tests, finalize public api names, verify token caching, add integ tests

src/client/Microsoft.Identity.Client/ApiConfig/AcquireTokenForClientParameterBuilder.cs

bgavrilMS · 2024-10-22T10:52:48Z

src/client/Microsoft.Identity.Client/ApiConfig/Executors/ConfidentialClientExecutor.cs

+                commonParameters.MtlsCertificate = _confidentialClientApplication.Certificate;
+                commonParameters.AuthenticationOperation = new MtlsPopAuthenticationOperation(_confidentialClientApplication.Certificate);
+                ServiceBundle.Config.ClientCredential = null;
+                ServiceBundle.Config.UseMtlsPop = true;


Avoid having this as the request level and at the app level.

...oft.Identity.Client/ApiConfig/Parameters/AbstractAcquireTokenConfidentialClientParameters.cs

bgavrilMS · 2024-10-22T10:53:58Z

src/client/Microsoft.Identity.Client/AppConfig/ApplicationConfiguration.cs

@@ -123,8 +123,9 @@ public string ClientVersion
        public bool IsPublicClient => !IsConfidentialClient && !IsManagedIdentity;

        public Func<AppTokenProviderParameters, Task<AppTokenProviderResult>> AppTokenProvider;
+        public bool UseMtlsPop { get; internal set; } = false;


Should not be needed.

bgavrilMS · 2024-10-22T10:54:37Z

src/client/Microsoft.Identity.Client/AuthScheme/PoP/MtlsPopAuthenticationOperation.cs

+            KeyId = mtlsCert.Thumbprint;
+        }
+
+        public int TelemetryTokenType => (int)TokenType.Pop;


Pls use a different value here. This one is reserved fro SHR POP

@gladjohn @bgavrilMS is the mapping maintained in the enum?

bgavrilMS · 2024-10-22T10:55:21Z

src/client/Microsoft.Identity.Client/AuthScheme/PoP/MtlsPopAuthenticationOperation.cs

+
+        public void FormatResult(AuthenticationResult authenticationResult)
+        {
+            var header = new JObject();


What is this for?

src/client/Microsoft.Identity.Client/AuthScheme/PoP/MtlsPopAuthenticationOperation.cs

bgavrilMS · 2024-10-22T10:57:09Z

src/client/Microsoft.Identity.Client/Instance/Discovery/RegionDiscoveryProvider.cs

@@ -14,6 +14,7 @@ internal class RegionDiscoveryProvider : IRegionDiscoveryProvider
    {
        private readonly IRegionManager _regionManager;
        public const string PublicEnvForRegional = "login.microsoft.com";
+        public const string PublicEnvForMtls = "mtlsauth.microsoft.com";


I recommend you rename this to RegionAndMtlsProvider

@bgavrilMS but the region is not included in the const?

bgavrilMS · 2024-10-22T10:57:49Z

src/client/Microsoft.Identity.Client/Instance/Discovery/RegionDiscoveryProvider.cs

+            if (requestContext.ServiceBundle.Config.UseMtlsPop)
+            {
+                requestContext.Logger.Info(() => $"[Region discovery] Using MTLS public endpoint: {PublicEnvForMtls}");
+                return $"{region}.{PublicEnvForMtls}";


This is wrong for non public cloud.

bgavrilMS · 2024-10-22T10:58:15Z

src/client/Microsoft.Identity.Client/Instance/Discovery/RegionDiscoveryProvider.cs

            string host = authority.Host;

+            if (requestContext.ServiceBundle.Config.UseMtlsPop)


What about the case of non-regional + mtls POP config? Do we want to support this or just error out?

bgavrilMS · 2024-10-22T10:59:28Z

src/client/Microsoft.Identity.Client/Internal/Requests/ClientCredentialRequest.cs

        {
            var dict = new Dictionary<string, string>
            {
                [OAuth2Parameter.GrantType] = OAuth2GrantType.ClientCredentials,
                [OAuth2Parameter.Scope] = AuthenticationRequestParameters.Scope.AsSingleString()
            };
+
+            // Only add TokenType if useMtlsPop is true
+            if (useMtlsPop)


It's better to do this in MtlsPopAuthenticationOperation.cs

bgavrilMS · 2024-10-22T10:59:57Z

src/client/Microsoft.Identity.Client/OAuth2/OAuthConstants.cs

+    internal static class RequestTokenType
+    {
+        public const string Bearer = "bearer";
+        public const string MTLSPop = "mtls_pop";


Pls consolidate with SHR POP.

...s/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/ClientCredentialsTests.NetFwk.cs

gladjohn · 2024-10-26T15:38:43Z

/azp run

azure-pipelines · 2024-10-26T15:38:53Z

Azure Pipelines successfully started running 1 pipeline(s).

very very draft

97c5d95