Skip to content

Handle client certificate rotation for token binding #53916

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 18 commits into from
Nov 19, 2025
Merged

Handle client certificate rotation for token binding #53916

Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
6d28cf0
wip
christothes Jul 21, 2025
e6e0db9
tweaks to Pipeline and TransportPolicy
christothes Jul 23, 2025
523ed95
wip
christothes Jul 24, 2025
77964b3
wip
christothes Jul 28, 2025
fc99dd6
wip
christothes Jul 29, 2025
1793f3f
policy based update
christothes Jul 29, 2025
1c0d769
wip
christothes Aug 4, 2025
60070f6
wip with working tests
christothes Aug 7, 2025
0b99d3c
export
christothes Aug 8, 2025
d3b2c7b
API fb
christothes Aug 14, 2025
e9bf39d
export
christothes Aug 14, 2025
29450fd
wip
christothes Oct 31, 2025
c21a9c6
cleanup
christothes Nov 13, 2025
b786f3c
cleanup
christothes Nov 13, 2025
1a938c0
fb
christothes Nov 13, 2025
f3b4199
fb
christothes Nov 17, 2025
2817031
export
christothes Nov 17, 2025
ce20be9
fix test
christothes Nov 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion sdk/core/Azure.Core.TestFramework/src/Azure.Core.TestFramework.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@
<IncludeOperationsSharedSource>true</IncludeOperationsSharedSource>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Azure.Core" />
<!-- <PackageReference Include="Azure.Core" /> -->
<ProjectReference Include="..\..\..\..\sdk\core\Azure.Core\src\Azure.Core.csproj" />
<PackageReference Include="Azure.Identity" />
<PackageReference Include="Newtonsoft.Json" />
<PackageReference Include="NUnit" />
Expand Down
9 changes: 8 additions & 1 deletion sdk/core/Azure.Core.TestFramework/src/MockTransport.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ public class MockTransport : HttpPipelineTransport

public bool? ExpectSyncPipeline { get; set; }

public List<HttpPipelineTransportOptions> TransportUpdates { get; } = [];

public MockTransport()
{
RequestGate = new AsyncGate<MockRequest, MockResponse>();
Expand All @@ -38,7 +40,7 @@ public MockTransport(params MockResponse[] responses)
};
}

public MockTransport(Func<MockRequest, MockResponse> responseFactory): this(req => responseFactory((MockRequest)req.Request))
public MockTransport(Func<MockRequest, MockResponse> responseFactory) : this(req => responseFactory((MockRequest)req.Request))
{
}

Expand Down Expand Up @@ -72,6 +74,11 @@ public override async ValueTask ProcessAsync(HttpMessage message)
await ProcessCore(message);
}

public override void Update(HttpPipelineTransportOptions options)
{
TransportUpdates.Add(options);
}

private async Task ProcessCore(HttpMessage message)
{
if (!(message.Request is MockRequest request))
Expand Down
6 changes: 6 additions & 0 deletions sdk/core/Azure.Core/api/Azure.Core.net462.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,8 @@ public partial struct AccessToken
public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; }
public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } }
public System.DateTimeOffset ExpiresOn { get { throw null; } }
public System.DateTimeOffset? RefreshOn { get { throw null; } }
public string Token { get { throw null; } }
Expand Down Expand Up @@ -1042,12 +1044,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans
{
public static readonly Azure.Core.Pipeline.HttpClientTransport Shared;
public HttpClientTransport() { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { }
public HttpClientTransport(System.Net.Http.HttpClient client) { }
public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { }
public sealed override Azure.Core.Request CreateRequest() { throw null; }
public void Dispose() { }
public override void Process(Azure.Core.HttpMessage message) { }
public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; }
public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipeline
{
Expand Down Expand Up @@ -1103,6 +1108,7 @@ protected HttpPipelineTransport() { }
public abstract Azure.Core.Request CreateRequest();
public abstract void Process(Azure.Core.HttpMessage message);
public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message);
public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipelineTransportOptions
{
Expand Down
6 changes: 6 additions & 0 deletions sdk/core/Azure.Core/api/Azure.Core.net472.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,8 @@ public partial struct AccessToken
public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; }
public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } }
public System.DateTimeOffset ExpiresOn { get { throw null; } }
public System.DateTimeOffset? RefreshOn { get { throw null; } }
public string Token { get { throw null; } }
Expand Down Expand Up @@ -1042,12 +1044,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans
{
public static readonly Azure.Core.Pipeline.HttpClientTransport Shared;
public HttpClientTransport() { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { }
public HttpClientTransport(System.Net.Http.HttpClient client) { }
public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { }
public sealed override Azure.Core.Request CreateRequest() { throw null; }
public void Dispose() { }
public override void Process(Azure.Core.HttpMessage message) { }
public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; }
public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipeline
{
Expand Down Expand Up @@ -1103,6 +1108,7 @@ protected HttpPipelineTransport() { }
public abstract Azure.Core.Request CreateRequest();
public abstract void Process(Azure.Core.HttpMessage message);
public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message);
public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipelineTransportOptions
{
Expand Down
6 changes: 6 additions & 0 deletions sdk/core/Azure.Core/api/Azure.Core.net8.0.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,6 +315,8 @@ public partial struct AccessToken
public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; }
public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } }
public System.DateTimeOffset ExpiresOn { get { throw null; } }
public System.DateTimeOffset? RefreshOn { get { throw null; } }
public string Token { get { throw null; } }
Expand Down Expand Up @@ -1055,12 +1057,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans
{
public static readonly Azure.Core.Pipeline.HttpClientTransport Shared;
public HttpClientTransport() { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { }
public HttpClientTransport(System.Net.Http.HttpClient client) { }
public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { }
public sealed override Azure.Core.Request CreateRequest() { throw null; }
public void Dispose() { }
public override void Process(Azure.Core.HttpMessage message) { }
public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; }
public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipeline
{
Expand Down Expand Up @@ -1117,6 +1122,7 @@ protected HttpPipelineTransport() { }
public abstract Azure.Core.Request CreateRequest();
public abstract void Process(Azure.Core.HttpMessage message);
public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message);
public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipelineTransportOptions
{
Expand Down
6 changes: 6 additions & 0 deletions sdk/core/Azure.Core/api/Azure.Core.netstandard2.0.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,8 @@ public partial struct AccessToken
public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; }
public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; }
public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } }
public System.DateTimeOffset ExpiresOn { get { throw null; } }
public System.DateTimeOffset? RefreshOn { get { throw null; } }
public string Token { get { throw null; } }
Expand Down Expand Up @@ -1042,12 +1044,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans
{
public static readonly Azure.Core.Pipeline.HttpClientTransport Shared;
public HttpClientTransport() { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { }
public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { }
public HttpClientTransport(System.Net.Http.HttpClient client) { }
public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { }
public sealed override Azure.Core.Request CreateRequest() { throw null; }
public void Dispose() { }
public override void Process(Azure.Core.HttpMessage message) { }
public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; }
public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipeline
{
Expand Down Expand Up @@ -1103,6 +1108,7 @@ protected HttpPipelineTransport() { }
public abstract Azure.Core.Request CreateRequest();
public abstract void Process(Azure.Core.HttpMessage message);
public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message);
public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }
}
public partial class HttpPipelineTransportOptions
{
Expand Down
24 changes: 24 additions & 0 deletions sdk/core/Azure.Core/src/AccessToken.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

using System;
using System.ClientModel.Primitives;
using System.Security.Cryptography.X509Certificates;

namespace Azure.Core
{
Expand Down Expand Up @@ -52,6 +53,23 @@ public AccessToken(string accessToken, DateTimeOffset expiresOn, DateTimeOffset?
TokenType = tokenType;
}

/// <summary>
/// Creates a new instance of <see cref="AccessToken"/> using the provided <paramref name="accessToken"/> and <paramref name="expiresOn"/>.
/// </summary>
/// <param name="accessToken">The access token value.</param>
/// <param name="expiresOn">The access token expiry date.</param>
/// <param name="refreshOn">Specifies the time when the cached token should be proactively refreshed.</param>
/// <param name="tokenType">The access token type.</param>
/// <param name="bindingCertificate">The binding certificate for the access token.</param>
public AccessToken(string accessToken, DateTimeOffset expiresOn, DateTimeOffset? refreshOn, string tokenType, X509Certificate2 bindingCertificate)
{
Token = accessToken;
ExpiresOn = expiresOn;
RefreshOn = refreshOn;
TokenType = tokenType;
BindingCertificate = bindingCertificate;
}

/// <summary>
/// Get the access token value.
/// </summary>
Expand All @@ -72,6 +90,12 @@ public AccessToken(string accessToken, DateTimeOffset expiresOn, DateTimeOffset?
/// </summary>
public string TokenType { get; }

/// <summary>
/// Gets or sets the binding certificate for the access token.
/// This is used when authenticating via Proof of Possession (PoP).
/// </summary>
public X509Certificate2? BindingCertificate { get; set; }

/// <inheritdoc />
public override bool Equals(object? obj)
{
Expand Down
Loading
Loading