[Robbie-Microsoft]

Summary

Adds Bearer-over-mTLS support, equivalent to MSAL.NET's CertificateOptions.SendCertificateOverMtls.

Set send_certificate_over_mtls=True on an SN/I certificate credential to make MSAL present that certificate during the TLS handshake with the regional or global mtlsauth.microsoft.com token endpoint. MSAL also signs the private_key_jwt client assertion and forces the public certificate chain into its x5c header.

The resulting access token is an ordinary, non-certificate-bound Bearer token:

• The request does not contain req_cnf, key_id, or token_type=mtls_pop.
• The result does not contain binding_certificate.
• The cache entry is not fenced by the certificate thumbprint.
• The certificate is used to authenticate the token-endpoint connection, not a downstream resource connection.

This remains distinct from mtls_proof_of_possession=True, which requests a certificate-bound mtls_pop token, fences its cache entry by key_id, and returns binding_certificate. Per-request mTLS PoP takes precedence when both options are configured.

Developer experience

credential = {
    "private_key": PRIVATE_KEY_PEM,
    "thumbprint": THUMBPRINT,
    "public_certificate": CERTIFICATE_CHAIN_PEM,
    "send_certificate_over_mtls": True,
}

app = msal.ConfidentialClientApplication(
    CLIENT_ID,
    authority=AUTHORITY,
    client_credential=credential,
    azure_region="westus3",
)

result = app.acquire_token_for_client([
    "https://vault.azure.net/.default",
])

assert result["token_type"] == "Bearer"
assert "binding_certificate" not in result

MSAL owns the certificate-bearing token transport for this flow. Custom application HTTP clients and per-request post overrides are rejected rather than silently bypassing mTLS.

Coverage

• Client credentials, OBO, authorization-code, refresh-token, device-code, username/password, and silent/cache paths.
• Global and regional mtlsauth.microsoft.com endpoint routing.
• Forced x5c assertion headers and PEM/PFX certificate-chain ordering.
• Proxy, Requests connection-pool, environment/session/request CA-bundle, and certificate-isolation behavior.
• Cache reuse as a normal Bearer token without a returned binding context.
• Live E2E acquisition using the Key Vault scope and westus3; no downstream mTLS resource call is made because the final token is not certificate-bound.

Validation

248 passed, 47 subtests passed

Targets rginsburg/sni-mtls-pop.

[Copilot]

🔵 Needs a closer look

Unresolved transport and certificate-chain issues, combined with authentication and persistent-cache changes, require fixes and final human review.

2 open issues

• Reject post overrides for Bearer-over-mTLS token requests · New
• Order PKCS#12 certificate chains and exclude unrelated certificates · New

What changed in this PR

Adds opt-in Bearer-over-mTLS authentication to MSAL’s confidential-client flows, distinct from certificate-bound mTLS PoP tokens.

Changes:

• Adds certificate validation, forced x5c assertions, and mTLS routing for client-credentials and user flows.
• Updates certificate-chain handling, TLS trust configuration, and bound-token cache isolation.
• Expands regression and live-test coverage; live user-flow acquisition remains gated.

File	Description
tests/​test_token_cache.py	Tests key normalization, collision prevention, and legacy-entry handling.
tests/​test_mtls_transport.py	Tests certificate chains, TLS handshakes, and CA-bundle handling.
tests/​test_e2e.py	Adds live client-credentials coverage and user-flow request capture.
tests/​test_application.py	Tests routing, assertions, cache behavior, and PoP safeguards.
msal/​token_cache.py	Hardens bound-token keys, lookup isolation, and legacy removal.
msal/​mtls.py	Restricts supported hosts and selects sessions by TLS verification settings.
msal/​application.py	Implements Bearer-over-mTLS routing and certificate-chain support.
docs/​index.rst	Documents PoP transport restrictions and rejected-response handling.

_{Review effort: Balanced}