Adding client assertion claims

src/Microsoft.Identity.Abstractions/ApplicationOptions/MicrosoftEntraApplicationOptions.cs

@@ -74,6 +74,14 @@ public override string? Authority
         /// The default is <c>false</c>.
         /// </summary>
         public bool SendX5C { get; set; }
+
+        /// <summary>
+        /// Gets or sets the claims used to create the client assertion for authentication.
+        /// </summary>
+        /// <remarks>The client assertion claims are typically used in scenarios where client
+        /// authentication requires a signed JWT (JSON Web Token). Ensure the claims are properly formatted and encoded
+        /// as a JSON string before setting this property.</remarks>
+        public IDictionary<string, string>? ClientAssertionClaims { get; set; }
         #endregion Token Acquisition
     }
 }

src/Microsoft.Identity.Abstractions/PublicAPI/net10.0/PublicAPI.Unshipped.txt

@@ -1,2 +1,4 @@
 #nullable enable
 Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider2
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.get -> System.Collections.Generic.IDictionary<string!, string!>?
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.set -> void

src/Microsoft.Identity.Abstractions/PublicAPI/net462/PublicAPI.Unshipped.txt

@@ -1,2 +1,4 @@
 #nullable enable
 Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider2
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.get -> System.Collections.Generic.IDictionary<string!, string!>?
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.set -> void

src/Microsoft.Identity.Abstractions/PublicAPI/net8.0/PublicAPI.Unshipped.txt

@@ -1,2 +1,4 @@
 #nullable enable
 Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider2
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.get -> System.Collections.Generic.IDictionary<string!, string!>?
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.set -> void

src/Microsoft.Identity.Abstractions/PublicAPI/net9.0/PublicAPI.Unshipped.txt

@@ -1,2 +1,4 @@
 #nullable enable
 Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider2
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.get -> System.Collections.Generic.IDictionary<string!, string!>?
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.set -> void

src/Microsoft.Identity.Abstractions/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt

@@ -1,2 +1,4 @@
 #nullable enable
 Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider2
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.get -> System.Collections.Generic.IDictionary<string!, string!>?
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.set -> void

src/Microsoft.Identity.Abstractions/PublicAPI/netstandard2.1/PublicAPI.Unshipped.txt

@@ -1,2 +1,4 @@
 #nullable enable
 Microsoft.Identity.Abstractions.IAuthorizationHeaderProvider2
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.get -> System.Collections.Generic.IDictionary<string!, string!>?
+Microsoft.Identity.Abstractions.MicrosoftEntraApplicationOptions.ClientAssertionClaims.set -> void

test/Microsoft.Identity.Abstractions.Tests/DownstreamApiTests.cs

@@ -42,8 +42,8 @@
                     PopPublicKey = "PopKey",
                     PopClaim = "jwkClaim",
                     Tenant = "domain.com",
-                    UserFlow = "susi"
-
+                    UserFlow = "susi",
+                    ClientAssertionClaims = new Dictionary<string, string> { { "clientClaim", "claim" } },
                 },
                 BaseUrl = "https://apitocall.domain.com",
                 CustomizeHttpRequestMessage = message => message.Headers.Add("x-sku", "sku-value"),
@@ -96,6 +96,7 @@
             Assert.Equal(downstreamApiOptions.AcquireTokenOptions.PopClaim, downstreamApiClone.AcquireTokenOptions.PopClaim);
             Assert.Equal(downstreamApiOptions.AcquireTokenOptions.Tenant, downstreamApiClone.AcquireTokenOptions.Tenant);
             Assert.Equal(downstreamApiOptions.AcquireTokenOptions.UserFlow, downstreamApiClone.AcquireTokenOptions.UserFlow);
+            Assert.Equal(downstreamApiOptions.AcquireTokenOptions.ClientAssertionClaims, downstreamApiClone.AcquireTokenOptions.ClientAssertionClaims);
             Assert.Equal("application/json", downstreamApiClone.AcceptHeader);
             Assert.Equal("application/json", downstreamApiClone.ContentType);
             Assert.Equal(downstreamApiOptions.ExtraHeaderParameters, downstreamApiClone.ExtraHeaderParameters);

test/Microsoft.Identity.Abstractions.Tests/MicrosoftIdentityApplicationOptionsTests.cs

@@ -53,6 +53,7 @@ public void MicrosoftIdentityApplicationOptionsProperties()
                 ResetPasswordPolicyId = "ResetPasswordPolicyId",
                 ResetPasswordPath = "ResetPasswordPath",
                 ErrorPath = "ErrorPath",
+                ClientAssertionClaims = new Dictionary<string, string> { { "claim1", "value1" } }
             };
 
             Assert.Equal("https://login.microsoftonline.com/common/v2.0", microsoftIdentityApplicationOptions.Authority);
@@ -81,6 +82,7 @@ public void MicrosoftIdentityApplicationOptionsProperties()
             Assert.Equal(nameof(microsoftIdentityApplicationOptions.ErrorPath), microsoftIdentityApplicationOptions.ErrorPath);
             Assert.Equal(nameof(microsoftIdentityApplicationOptions.SignUpSignInPolicyId), microsoftIdentityApplicationOptions.DefaultUserFlow);
             Assert.NotEmpty(microsoftIdentityApplicationOptions.ExtraQueryParameters);
+            Assert.Equal(microsoftIdentityApplicationOptions.ClientAssertionClaims, microsoftIdentityApplicationOptions.ClientAssertionClaims);
         }