Propagate KeyGuard attestation failures and bridge native MAA logs to the MSAL logger

[Gladwin Johnson (gladjohn)]

Summary

Fixes two defects in the IMDSv2 mTLS PoP + Credential Guard / KeyGuard attestation flow.

1. Propagate KeyGuard attestation failures (instead of sending an empty token to IMDS)

Previously, a failed attestation was mapped to null, which caused an empty / non-attested certificate request to be sent to IMDS — silently dropping the real failure (e.g. an MAA 400 PolicyEvaluationError / x-ms-azurevm-dbxvalidated=false deny).

• WithAttestationSupport now throws MsalServiceException("attestation_failed") carrying Status / NativeErrorCode / reason instead of returning null. The failure originates from the MAA service, so it surfaces as a service exception.
• ImdsV2ManagedIdentitySource.GetAttestationJwtAsync treats a null/empty token from a configured provider as a hard failure for KeyGuard keys (no silent non-attested fallback) and avoids double-wrapping MsalServiceException.
• AttestationClient maps the native return code to a readable reason via AttestationErrors.Describe so the cause propagates.
• Client-side preconditions (mtls_pop_requires_keyguard, credential_guard_requires_cng) remain MsalClientException.

2. Bridge native MAA logs into the MSAL logger

Native AttestationClientLib (MAA) logs were written only to System.Diagnostics.Trace and never reached the MSAL ILoggerAdapter, so failures were invisible in MSAL verbose logs.

• AttestationLogger.CreateLoggerBridge forwards native log callbacks into the MSAL logger (Error/Warn/Info/Debug → Error/Warning/Info/Verbose), gated on IsLoggingEnabled, exception-safe, with a Trace fallback when no logger is supplied.
• AttestationClient takes an optional ILoggerAdapter (keeping a strong reference to the bridge delegate for the native callback lifetime); PopKeyAttestor forwards the logger.

Validation

• Verified end-to-end on a real Confidential VM: native MAA logs now flow through the MSAL logger, and the attested happy path works.
• Added/updated unit tests in ImdsV2Tests covering attestation_failed propagation (NativeError / Exception / TokenEmpty / NotInitialized / empty-JWT, and null / empty / throwing providers) and the log bridge (level mapping, routing, gating, exception safety, null logger) plus AttestationErrors.Describe.
• Microsoft.Identity.Test.Unit builds clean (net8.0 + netstandard2.0); ImdsV2Tests 99/99 pass.

Fixes #6079
Fixes #6080

[Copilot]

Pull request overview

This PR fixes two related defects in the IMDSv2 mTLS PoP + Credential Guard/KeyGuard attestation path by (1) ensuring attestation failures are surfaced to callers (instead of silently falling back to a non-attested IMDS request) and (2) forwarding native AttestationClientLib (MAA) logs into the MSAL ILoggerAdapter for diagnosability.

Changes:

• Convert KeyGuard attestation failure cases into MsalServiceException("attestation_failed") and treat null/empty attestation tokens as hard failures for KeyGuard keys.
• Add a native-to-MSAL logger bridge (AttestationLogger.CreateLoggerBridge) and plumb ILoggerAdapter through PopKeyAttestor → AttestationClient.
• Expand unit coverage for attestation failure propagation, native error reason mapping, and logger level mapping/routing.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ImdsV2Tests.cs	Updates/expands unit tests to validate attestation_failed propagation and native log bridging behavior.
src/client/Microsoft.Identity.Client/ManagedIdentity/V2/ImdsV2ManagedIdentitySource.cs	Enforces hard-fail behavior for empty attestation JWTs (KeyGuard) and avoids double-wrapping MsalServiceException.
src/client/Microsoft.Identity.Client.KeyAttestation/PopKeyAttestor.cs	Passes MSAL logger through to the native attestation client to enable bridged logging.
src/client/Microsoft.Identity.Client.KeyAttestation/ManagedIdentityAttestationExtensions.cs	Changes .WithAttestationSupport() to throw MsalServiceException("attestation_failed") on attestation failure instead of returning null.
src/client/Microsoft.Identity.Client.KeyAttestation/Attestation/AttestationLogger.cs	Implements logger bridging and level mapping from native AttestationClientLib logs into MSAL logs.
src/client/Microsoft.Identity.Client.KeyAttestation/Attestation/AttestationClient.cs	Adds optional logger support, keeps a strong reference to the native callback delegate, and maps native error codes to readable reasons.

[Sheshagiri Rao Mallipedhi (Sheshagiri)]

thanks a lot Gladwin Johnson (@gladjohn) for accomodating the changes. Would this also propage the logs from the underlying cpp code (AttestationClientLib) when we set AZURE_LOG_LEVEL=verbose?

[Gladwin Johnson (gladjohn)]

thanks a lot Gladwin Johnson (@gladjohn) for accomodating the changes. Would this also propage the logs from the underlying cpp code (AttestationClientLib) when we set AZURE_LOG_LEVEL=verbose?

yes, Sheshagiri Rao Mallipedhi (@Sheshagiri) it will

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.