[Robbie-Microsoft]

Summary

Follow-up to #938. Adds the developer-orchestrated two-leg Federated Identity Credential (FIC) exchange over mTLS:

1. Leg 1 acquires a certificate-bound mtls_pop token for the token-exchange audience.
2. Leg 2 receives that assertion together with the same certificate, sends it as a jwt-pop client assertion over mTLS, and acquires either a final mtls_pop token or an ordinary Bearer token.

Targets rginsburg/sni-mtls-pop (#938). Review and merge #938 first.

Developer experience

cert = {
    "private_key_pfx_path": "sni.pfx",
    "public_certificate": True,
}

leg1_app = msal.ConfidentialClientApplication(
    leg1_client_id,
    authority=leg1_authority,
    client_credential=cert,
)


def get_federated_assertion():
    result = leg1_app.acquire_token_for_client(
        ["api://AzureADTokenExchange/.default"],
        mtls_proof_of_possession=True,
    )
    return result["access_token"]


leg2_app = msal.ConfidentialClientApplication(
    leg2_client_id,
    authority=leg2_authority,
    client_credential={
        "client_assertion": get_federated_assertion,
        "mtls_binding_certificate": cert,
    },
)

# Final certificate-bound resource token
result = leg2_app.acquire_token_for_client(
    ["https://graph.microsoft.com/.default"],
    mtls_proof_of_possession=True,
)

The callable keeps assertion renewal behind the leg-1 cache instead of pinning an expiring assertion string.

Output matrix

Leg-2 request	Assertion and transport	Final token	Result binding context	Resource usage
mtls_proof_of_possession=True	jwt-pop over mTLS with the leg-1 certificate	mtls_pop	Present and matches the leg-1 certificate	Present the returned context to the Graph mTLS endpoint
No final PoP request	jwt-pop over mTLS with the leg-1 certificate	Bearer	Absent	Use as an ordinary Bearer token; no Graph-over-mTLS call

The certificate remains essential to authenticate the bound assertion in both rows. It is exposed as binding_certificate only when the final access token is itself certificate-bound.

Implementation

• Adds the jwt-pop client-assertion type.
• Adds the mtls_binding_certificate credential sub-key for the leg-2 assertion flow.
• Routes every supported leg-2 request through the mTLS token endpoint and keeps the assertion/certificate pairing intact.
• Requests and cache-partitions the final token by certificate only when mtls_proof_of_possession=True.
• Rejects unsupported non-client-credential flows, missing/invalid binding certificates, custom HTTP transports, and per-request transport overrides.
• Keeps final Bearer tokens on the ordinary cache contract and does not expose a downstream binding context.

Validation

• Unit coverage for jwt-pop wire parameters, mTLS endpoint selection, final PoP and Bearer result contracts, assertion renewal, cache behavior, invalid credentials, and unsupported flows.
• Live E2E coverage for both final outputs:
  • Final mtls_pop: validates binding-certificate continuity and calls the Microsoft Graph mTLS endpoint.
  • Final Bearer: requests the Storage audience and verifies that the result is unbound and has no binding_certificate.
• Focused local validation: 119 tests passed, including 43 subtests.

[Copilot]

Pull request overview

Adds support for the optional two-leg Federated Identity Credential (FIC) token exchange over mTLS Proof-of-Possession, where a leg-1 mtls_pop token is presented as a jwt-pop client assertion over an mTLS connection bound to the same certificate to obtain the final token.

Changes:

• Introduces the jwt-pop client assertion type constant and uses it for FIC leg-2 requests.
• Extends ConfidentialClientApplication to detect client_credential["mtls_binding_certificate"] (FIC leg 2) and route leg-2 traffic over the mTLS token endpoint (including implicit Bearer-over-mTLS).
• Adds unit/E2E coverage, docs, and a gated sample for the two-leg flow.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
msal/oauth2cli/oauth2.py	Adds jwt-pop client assertion type constant for OAuth2 client assertions.
msal/application.py	Implements FIC leg-2 detection and mTLS routing; sets client_assertion_type to jwt-pop for leg-2.
tests/test_application.py	Adds unit tests validating jwt-pop assertion type and Bearer-over-mTLS behavior for FIC leg-2.
tests/test_e2e.py	Adds an E2E test for the two-leg FIC exchange over mTLS PoP (self-skipping when not configured).
docs/index.rst	Documents the FIC leg-2 mtls_binding_certificate configuration and jwt-pop behavior.
sample/confidential_client_mtls_pop_sample.py	Adds a gated sample function demonstrating the two-leg FIC flow over mTLS PoP.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

msal/application.py:892

• The new FIC leg-2 configuration requires passing a leg-1 access token as a string client_assertion, but the constructor currently emits a DeprecationWarning for any static string/bytes client_assertion. This makes the documented/expected FIC usage noisy (and can fail callers running with warnings-as-errors). Consider suppressing this warning when mtls_binding_certificate is present (FIC leg 2).

        # Warn if using a static string/bytes client_assertion (discouraged for long-running apps)
        if isinstance(client_credential, dict) and isinstance(
                client_credential.get("client_assertion"), (str, bytes)):
            warnings.warn(
                "Passing a static string/bytes 'client_assertion' is "

[Bogdan Gavril (bgavrilMS)]

Pls mark PRs that should not be looked at as draft or close them.

[Copilot]

🔵 Needs a closer look

The certificate-bound, cross-application exchange needs human security review and live validation of both final-token modes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-sensitive assertion and certificate-binding changes require final human validation alongside prerequisite #938.

1 open issue

• Guard mTLS resource call when binding certificate is absent · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-sensitive assertion, transport, and cache integration needs final human review after prerequisite #938 is merged.

No open issues 🎉

1 resolved since last review

• Guard mTLS resource call when binding certificate is absent

_{Review effort: Balanced}