Handle client certificate rotation for token binding #53916
+441
−61
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,6 +21,8 @@ public class MockTransport : HttpPipelineTransport | |
|
|
||
| public bool? ExpectSyncPipeline { get; set; } | ||
|
|
||
| public List<HttpPipelineTransportOptions> TransportUpdates { get; } = []; | ||
|
Member
Author
There was a problem hiding this comment. This is on the mock transport so that code that is testing this can observe the transport updates that have occurred. |
||
|
|
||
| public MockTransport() | ||
| { | ||
| RequestGate = new AsyncGate<MockRequest, MockResponse>(); | ||
|
|
@@ -38,7 +40,7 @@ public MockTransport(params MockResponse[] responses) | |
| }; | ||
| } | ||
|
|
||
| public MockTransport(Func<MockRequest, MockResponse> responseFactory) : this(req => responseFactory((MockRequest)req.Request)) | ||
| { | ||
| } | ||
|
|
||
|
|
@@ -72,6 +74,11 @@ public override async ValueTask ProcessAsync(HttpMessage message) | |
| await ProcessCore(message); | ||
| } | ||
|
|
||
| public override void Update(HttpPipelineTransportOptions options) | ||
| { | ||
| TransportUpdates.Add(options); | ||
| } | ||
|
|
||
| private async Task ProcessCore(HttpMessage message) | ||
| { | ||
| if (!(message.Request is MockRequest request)) | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -306,6 +306,8 @@ public partial struct AccessToken | |
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; } | ||
| public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } } | ||
| public System.DateTimeOffset ExpiresOn { get { throw null; } } | ||
| public System.DateTimeOffset? RefreshOn { get { throw null; } } | ||
| public string Token { get { throw null; } } | ||
|
|
@@ -1042,12 +1044,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans | |
| { | ||
| public static readonly Azure.Core.Pipeline.HttpClientTransport Shared; | ||
| public HttpClientTransport() { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { } | ||
| public HttpClientTransport(System.Net.Http.HttpClient client) { } | ||
| public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { } | ||
| public sealed override Azure.Core.Request CreateRequest() { throw null; } | ||
| public void Dispose() { } | ||
| public override void Process(Azure.Core.HttpMessage message) { } | ||
| public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; } | ||
| public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
|
Member
There was a problem hiding this comment. since the method is on transport type, should it be called simply Update?
Member
Author
There was a problem hiding this comment. Yes, I think that makes sense. |
||
| } | ||
| public partial class HttpPipeline | ||
| { | ||
|
|
@@ -1103,6 +1108,7 @@ protected HttpPipelineTransport() { } | |
| public abstract Azure.Core.Request CreateRequest(); | ||
| public abstract void Process(Azure.Core.HttpMessage message); | ||
| public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message); | ||
| public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipelineTransportOptions | ||
| { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -306,6 +306,8 @@ public partial struct AccessToken | |
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; } | ||
| public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } } | ||
| public System.DateTimeOffset ExpiresOn { get { throw null; } } | ||
| public System.DateTimeOffset? RefreshOn { get { throw null; } } | ||
| public string Token { get { throw null; } } | ||
|
|
@@ -1042,12 +1044,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans | |
| { | ||
| public static readonly Azure.Core.Pipeline.HttpClientTransport Shared; | ||
| public HttpClientTransport() { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { } | ||
| public HttpClientTransport(System.Net.Http.HttpClient client) { } | ||
| public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { } | ||
| public sealed override Azure.Core.Request CreateRequest() { throw null; } | ||
| public void Dispose() { } | ||
| public override void Process(Azure.Core.HttpMessage message) { } | ||
| public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; } | ||
| public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipeline | ||
| { | ||
|
|
@@ -1103,6 +1108,7 @@ protected HttpPipelineTransport() { } | |
| public abstract Azure.Core.Request CreateRequest(); | ||
| public abstract void Process(Azure.Core.HttpMessage message); | ||
| public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message); | ||
| public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipelineTransportOptions | ||
| { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -315,6 +315,8 @@ public partial struct AccessToken | |
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; } | ||
| public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } } | ||
| public System.DateTimeOffset ExpiresOn { get { throw null; } } | ||
| public System.DateTimeOffset? RefreshOn { get { throw null; } } | ||
| public string Token { get { throw null; } } | ||
|
|
@@ -1055,12 +1057,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans | |
| { | ||
| public static readonly Azure.Core.Pipeline.HttpClientTransport Shared; | ||
| public HttpClientTransport() { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { } | ||
| public HttpClientTransport(System.Net.Http.HttpClient client) { } | ||
| public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { } | ||
| public sealed override Azure.Core.Request CreateRequest() { throw null; } | ||
| public void Dispose() { } | ||
| public override void Process(Azure.Core.HttpMessage message) { } | ||
| public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; } | ||
| public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipeline | ||
| { | ||
|
|
@@ -1117,6 +1122,7 @@ protected HttpPipelineTransport() { } | |
| public abstract Azure.Core.Request CreateRequest(); | ||
| public abstract void Process(Azure.Core.HttpMessage message); | ||
| public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message); | ||
| public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipelineTransportOptions | ||
| { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -306,6 +306,8 @@ public partial struct AccessToken | |
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType) { throw null; } | ||
| public AccessToken(string accessToken, System.DateTimeOffset expiresOn, System.DateTimeOffset? refreshOn, string tokenType, System.Security.Cryptography.X509Certificates.X509Certificate2 bindingCertificate) { throw null; } | ||
| public System.Security.Cryptography.X509Certificates.X509Certificate2? BindingCertificate { get { throw null; } set { } } | ||
| public System.DateTimeOffset ExpiresOn { get { throw null; } } | ||
| public System.DateTimeOffset? RefreshOn { get { throw null; } } | ||
| public string Token { get { throw null; } } | ||
|
|
@@ -1042,12 +1044,15 @@ public partial class HttpClientTransport : Azure.Core.Pipeline.HttpPipelineTrans | |
| { | ||
| public static readonly Azure.Core.Pipeline.HttpClientTransport Shared; | ||
| public HttpClientTransport() { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpClient> clientFactory) { } | ||
| public HttpClientTransport(System.Func<Azure.Core.Pipeline.HttpPipelineTransportOptions, System.Net.Http.HttpMessageHandler> handlerFactory) { } | ||
| public HttpClientTransport(System.Net.Http.HttpClient client) { } | ||
| public HttpClientTransport(System.Net.Http.HttpMessageHandler messageHandler) { } | ||
| public sealed override Azure.Core.Request CreateRequest() { throw null; } | ||
| public void Dispose() { } | ||
| public override void Process(Azure.Core.HttpMessage message) { } | ||
| public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; } | ||
| public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipeline | ||
| { | ||
|
|
@@ -1103,6 +1108,7 @@ protected HttpPipelineTransport() { } | |
| public abstract Azure.Core.Request CreateRequest(); | ||
| public abstract void Process(Azure.Core.HttpMessage message); | ||
| public abstract System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message); | ||
| public virtual void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { } | ||
| } | ||
| public partial class HttpPipelineTransportOptions | ||
| { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,6 +3,7 @@ | |
|
|
||
| using System; | ||
| using System.ClientModel.Primitives; | ||
| using System.Security.Cryptography.X509Certificates; | ||
|
|
||
| namespace Azure.Core | ||
| { | ||
|
|
@@ -52,6 +53,23 @@ public AccessToken(string accessToken, DateTimeOffset expiresOn, DateTimeOffset? | |
| TokenType = tokenType; | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Creates a new instance of <see cref="AccessToken"/> using the provided <paramref name="accessToken"/> and <paramref name="expiresOn"/>. | ||
| /// </summary> | ||
| /// <param name="accessToken">The access token value.</param> | ||
| /// <param name="expiresOn">The access token expiry date.</param> | ||
| /// <param name="refreshOn">Specifies the time when the cached token should be proactively refreshed.</param> | ||
| /// <param name="tokenType">The access token type.</param> | ||
| /// <param name="bindingCertificate">The binding certificate for the access token.</param> | ||
| public AccessToken(string accessToken, DateTimeOffset expiresOn, DateTimeOffset? refreshOn, string tokenType, X509Certificate2 bindingCertificate) | ||
| { | ||
| Token = accessToken; | ||
| ExpiresOn = expiresOn; | ||
| RefreshOn = refreshOn; | ||
| TokenType = tokenType; | ||
| BindingCertificate = bindingCertificate; | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Get the access token value. | ||
| /// </summary> | ||
|
|
@@ -72,6 +90,12 @@ public AccessToken(string accessToken, DateTimeOffset expiresOn, DateTimeOffset? | |
| /// </summary> | ||
| public string TokenType { get; } | ||
|
|
||
| /// <summary> | ||
| /// Gets or sets the binding certificate for the access token. | ||
| /// This is used when authenticating via Proof of Possession (PoP). | ||
christothes marked this conversation as resolved.
Show resolved
Hide resolved
Member
There was a problem hiding this comment. May be a good idea to throw a |
||
| /// </summary> | ||
| public X509Certificate2? BindingCertificate { get; set; } | ||
|
|
||
| /// <inheritdoc /> | ||
| public override bool Equals(object? obj) | ||
| { | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The PackageReference to Azure.Core is commented out and replaced with a ProjectReference. This appears to be a temporary change for testing purposes. Ensure this is intentional and should be included in the PR, or if it should be reverted before merging.