[Feature Request] Update extensibility API to cature CertificateOptions

[neha-bhargava]

MSAL client type

Confidential

Problem statement

Update the extensibility API WithCertificate to WithCertificate(certCallback, certificateOptions)

Proposed solution

No response

Alternatives

No response

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• [Feature Request] Add 3 new extensiblity APIs #5568
• [Feature Request] Specify WithCertificate while fetching the token to deal with certificate rotation #2705

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Provide an override with .WithCertificate that accepts a delegate as we've done for .WithClientAssertion():

var result = await s_cca.AcquireTokenForClient("scope_for_downstream_api")
                      .WithCertificate(certificate)  // Add new API here
                      .WithAuthority("https://login.microsoft.com/<tenant_id>")
                      .WithSendX5C(true)

Reference:

• [Feature Request] Specify WithCertificate while fetching the token to deal with certificate rotation #2705 (comment)

Solution 2:

Use the override of .WithClientAssertion() with the delegate. This is documented in the article linked in the comment. It would be better to expose the override of .WithCertificate.

Reference:

• [Feature Request] Specify WithCertificate while fetching the token to deal with certificate rotation #2705 (comment)

Solution 3:

Creating a new ConfidentialClientApplication instance for each request is a recommended pattern. It eliminates bottlenecks associated with having one app handling multiple requests and points the app to the common cache. This approach is used by Microsoft.Identity.Web.

Reference:

• [Feature Request] Specify WithCertificate while fetching the token to deal with certificate rotation #2705 (comment)

Powered by issue-sentinel