Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade - #6084
Merged
Neha Bhargava (neha-bhargava) merged 2 commits intoJun 22, 2026
Conversation
… downgrade The Sni_Gets_Pop_Token_Successfully_TestAsync test runs against the AAD westus3 test-slice mtlsauth endpoint, which is currently returning token_type=Bearer instead of mtls_pop. This is a server-side issue on the test slice, not a MSAL regression: the global mtlsauth endpoint (covered by Sni_Gets_Pop_Token_WithGlobalEndpoint_TestAsync) continues to honor mtls_pop and that test still passes. Catch MsalClientException with ErrorCode=TokenTypeMismatch and fail the test with Assert.Inconclusive so the pipeline is not blocked while the test slice is investigated. Same pattern used in PR #6033. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Neha Bhargava (neha-bhargava)
June 22, 2026 20:49
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Adjusts the regional SNI mTLS PoP integration test to treat an upstream AAD westus3 test-slice “Bearer downgrade” as an infrastructure problem (inconclusive) rather than a product regression, while keeping the global-endpoint E2E coverage intact.
Changes:
- Wraps the regional
AcquireTokenForClient(...).WithMtlsProofOfPossession()call in atry/catchand marks the test Inconclusive whenMsalError.TokenTypeMismatchis observed. - Adds a targeted TODO and an explicit inconclusive message to aid future re-enablement once the westus3 slice is fixed.
Five tests in ClientCredentialsMtlsPopTests were failing in the PR
pipeline with the same MsalError.TokenTypeMismatch (AAD westus3
test-slice mtlsauth endpoint downgrades token_type=mtls_pop to Bearer).
Refactor the previous inline catch into a reusable
ExecuteOrInconclusiveOnTokenTypeMismatchAsync helper and apply it to the
first PoP-acquisition call in each affected test:
- Sni_Gets_Pop_Token_Successfully_TestAsync
- Sni_AssertionFlow_Uses_JwtPop_And_Succeeds_TestAsync
- Sni_AssertionFlow_Uses_JwtPop_And_Acquires_Bearer_Token_TestAsync
- Sni_Gets_Pop_Token_WithCertificateOptionsAsync (covers both
WithSendCertificateOverMtls_True / _False)
- Sni_AssertionFlow_GlobalEndpoint_Uses_JwtPop_And_Succeeds_TestAsync
(first leg uses westus3 + PoP)
Each catch converts MsalClientException with ErrorCode=TokenTypeMismatch
into Assert.Inconclusive, so the tests will auto-recover (PASS) once the
AAD test slice honors token_type=mtls_pop again. The global-endpoint PoP
test and the Bearer-over-mTLS test are unchanged and continue to pass.
Local verification:
Total tests: 8
Passed: 2 (Sni_Gets_Pop_Token_WithGlobalEndpoint_TestAsync,
Sni_Over_Mtls_Gets_Bearer_Token_Successfully_TestAsync)
Skipped: 6 (the 5 affected + the one already wrapped)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ryan Auld (RyAuld)
approved these changes
Jun 22, 2026
Robbie-Microsoft
approved these changes
Jun 22, 2026
Neha Bhargava (neha-bhargava)
deleted the
nebharg/skip-mtls-pop-regional-test-slice-issue
branch
June 22, 2026 22:26
This was referenced Jun 23, 2026
Closed
This was referenced Jun 23, 2026
Neha Bhargava (neha-bhargava)
added a commit
to AzureAD/microsoft-identity-web
that referenced
this pull request
Jun 23, 2026
…rer (#3892) The E2E test AcquireTokenWithMtlsPop_WithBindingCertificate_ReturnsMtlsPopToken fails consistently in the PR pipeline with: MsalClientException: You asked for token type mtls_pop, but receive Bearer. Root cause is server-side: the AAD westus3 test-slice mtlsauth endpoint is downgrading token_type=mtls_pop responses to Bearer. MSAL is correctly routing to westus3.mtlsauth.microsoft.com, sending token_type=mtls_pop, and presenting the SNI cert. The matching MSAL.NET test against the global mtlsauth.microsoft.com endpoint continues to pass, isolating the issue to the test slice — not a Microsoft.Identity.Web or MSAL regression. Skip the test via [Fact(Skip = "...")] (the repo's established pattern for known-broken external-dependency tests) until the AAD test slice honors token_type=mtls_pop again. Tracking: #3891 Related: AzureAD/microsoft-authentication-library-for-dotnet#6084 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jun 24, 2026
fix: Bump Microsoft.Identity.Client from 4.85.0 to 4.85.1
Halceyon/open-telemetry-trace-listener#201
Closed
Merged
Closed
Closed
This was referenced Aug 16, 2026
Open
This was referenced Aug 24, 2026
This was referenced Aug 31, 2026
This was referenced Sep 9, 2026
This was referenced Sep 17, 2026
Bump Microsoft.Identity.Client and Microsoft.Identity.Client.Extensions.Msal
teglsbo/DataverseDuck#5
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Sni_Gets_Pop_Token_Successfully_TestAsyncis failing on the pipeline with:Investigation
Reproduced locally. The test targets the AAD westus3 test slice (
westus3.mtlsauth.microsoft.com). MSAL is correctly:token_type=mtls_popin the body,AAD is responding with
token_type=Bearer. The companion testSni_Gets_Pop_Token_WithGlobalEndpoint_TestAsync(globalmtlsauth.microsoft.com) still passes, isolating the issue to the westus3 test slice, not MSAL.Sni_Gets_Pop_Token_Successfully_TestAsyncwestus3.mtlsauth.microsoft.comSni_Gets_Pop_Token_WithGlobalEndpoint_TestAsyncmtlsauth.microsoft.comFix
Catch
MsalClientExceptionwithErrorCode == TokenTypeMismatchin the regional test only and callAssert.Inconclusivewith a clear message. The global-endpoint test is unchanged and continues to exercise the MSAL mTLS PoP path end-to-end. Same pattern used in #6033 for transient infrastructure issues.A
TODOis left in the catch block so the workaround is removed once the AAD test slice is fixed.Validation (local)
Follow-up
Escalate
westus3.mtlsauth.microsoft.comreturning Bearer fortoken_type=mtls_popwith AAD test-slice owners and revert once fixed.