Tags: AzureAD/microsoft-identity-web
Tags
Fix net8.0 crypto floor: use patched Xml 8.0.4 (not 9.0.18) (#3989) The net8.0 block over-bumped System.Security.Cryptography.Xml/Pkcs to 9.0.18 on the assumption that no patched 8.0.x existed. Per the advisory (CVE-2026-47302, -47304, -50525, -50648), the patched System.Security.Cryptography.Xml for net8.0 is 8.0.4 (affected <=8.0.3); 8.0.29 is the .NET *runtime* patch, not this OOB package. Xml 8.0.4 depends on Pkcs 8.0.1, so pin Pkcs 8.0.1 (no NU1605). net9.0 (9.0.18) and net10.0 (10.0.10) are unchanged - those are correct for their lines. Validated: dotnet restore Microsoft.Identity.Web.sln => exit 0, net8.0 resolves Xml 8.0.4 / Pkcs 8.0.1. Co-authored-by: Gladwin Johnson <gljohns@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ba7e127a-a204-4fdc-8512-73fba660adcd
Add PartitionAppTokenCacheByAudience to partition the app token cache… … by resource (#3979) Apps that acquire app tokens (client credentials) for many resources using the same client and tenant accumulate all tokens in a single {clientId}_{tenantId} cache partition, making AcquireTokenForClient cache lookups O(n) in the number of resources. Add a MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience opt-in (config bindable, flows into MergedOptions like UseFastUnboundedCache). When enabled, TokenAcquisition derives the resource from the requested <resource>/.default scope and calls MSAL's WithCachePartitionKey("resource", resource), which partitions both MSAL's internal cache and the serialized in-memory cache blob per resource, keeping reads O(1). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2d02b5ca-22b5-4b48-840a-de79786b3f9d
Bump the notsecurity group with 3 updates (#3954) Bumps Microsoft.Identity.Client from 4.86.0 to 4.86.1 Bumps Microsoft.Identity.Client.KeyAttestation from 4.86.0 to 4.86.1 Bumps Microsoft.IdentityModel.JsonWebTokens from 8.19.1 to 8.19.2 --- updated-dependencies: - dependency-name: Microsoft.Identity.Client dependency-version: 4.86.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: notsecurity - dependency-name: Microsoft.Identity.Client.KeyAttestation dependency-version: 4.86.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: notsecurity - dependency-name: Microsoft.IdentityModel.JsonWebTokens dependency-version: 8.19.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: notsecurity ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Revert PRs #3933 and #3934: restore single-job PR pipeline (#3936) * Initial plan * Revert PRs #3933 and #3934: restore single-job pipeline, aggregated test template, original MI client ID; delete 5 added template files --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Fix #3894: make Microsoft.Identity.Client.KeyAttestation a conditiona… …l (modern .NET only) dependency (#3922) Microsoft.Identity.Web.Certificateless targeted only netstandard2.0 with an unconditional reference to Microsoft.Identity.Client.KeyAttestation, which transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package. That package ships no .NET Framework/netstandard-compatible managed assets, so classic packages.config .NET Framework projects fail to install Microsoft.Identity.Web 4.11.0+. Multi-target Certificateless (netstandard2.0;net8.0 - net9/net10 consumers resolve the net8 asset) and restrict the KeyAttestation dependency to .NETCoreApp targets, guarding the using and .WithAttestationSupport() calls with #if NETCOREAPP. .NET Framework consumers now use the clean netstandard2.0 asset; modern .NET keeps full mTLS PoP + attestation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Flow finalized DownstreamApi request before authorization header crea… …tion (#3902) * Flow finalized request to authorization provider * Add negative test for reserved ExtraHeaderParameters in flowed request Verifies that reserved header names supplied via ExtraHeaderParameters remain skipped both on the request flowed to the authorization header provider and on the final outgoing request, ensuring the request-ordering change did not alter the reserved/duplicate-skip semantics.
Skip AcquireTokenWithMtlsPop test: AAD westus3 test slice returns Bea… …rer (#3892) The E2E test AcquireTokenWithMtlsPop_WithBindingCertificate_ReturnsMtlsPopToken fails consistently in the PR pipeline with: MsalClientException: You asked for token type mtls_pop, but receive Bearer. Root cause is server-side: the AAD westus3 test-slice mtlsauth endpoint is downgrading token_type=mtls_pop responses to Bearer. MSAL is correctly routing to westus3.mtlsauth.microsoft.com, sending token_type=mtls_pop, and presenting the SNI cert. The matching MSAL.NET test against the global mtlsauth.microsoft.com endpoint continues to pass, isolating the issue to the test slice — not a Microsoft.Identity.Web or MSAL regression. Skip the test via [Fact(Skip = "...")] (the repo's established pattern for known-broken external-dependency tests) until the AAD test slice honors token_type=mtls_pop again. Tracking: #3891 Related: AzureAD/microsoft-authentication-library-for-dotnet#6084 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PreviousNext