[Feature Request] Add WithExtraCertificateClientAssertionClaims extensiblity API

[bgavrilMS]

MSAL client type

Confidential

Problem statement

WithExtraCertificateClientAssertionClaims (string) and validate JSON merging functionality with partners
It will bind the token to the extra claims
Deprecate WithClientClaims

Proposed solution

No response

Alternatives

No response

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Add .WithClientAssertion to support client assertions #1188
• [Feature Request] Add a new WithClientAssertion API that exposes the token endpoint #3352
• [Feature Request] Expose WithAssertion at request level #5412
• [Feature Request] Token Acquisition Extensibility support #4889

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

For additional claims to sign, pass them in a new override of WithCertificate:

Dictionary<string, string> additionalClaimsToSign = new[] 
{
 { "client_ip", ipAddres}
};

var app = ConfidentialClientApplicationBuilder.Create(clientId)
                      .WithCertificate(clientAssertion, additionalClaimsToSign)
                      .Build();

With a custom already signed assertion:

string signedAssertion = 
          string.Concat(token, ".", UrlEncodeSegment(credential.Sign(certificate, token)));

var app = ConfidentialClientApplicationBuilder.Create(clientId)
                      .WithSignedClientAssertion(signedAssertion ))
                      .Build();

Reference:

• Add .WithClientAssertion to support client assertions #1188 (comment)

Solution 2:

Use MSAL's extensibility API OnBeforeTokenRequest, which allows you to add or remove body parameters from the token request. This can be used as a workaround until a better way to create an assertion is added as a new feature.

Reference:

• [Feature Request] Add a new WithClientAssertion API that exposes the token endpoint #3352 (comment)

Powered by issue-sentinel