…l X-MS-TOKEN- headers (#3915)

* Apply reserved-header handling on the request-clone path

Filter reserved headers when cloning a request for challenge retries and mTLS PoP, consistently with ExtraHeaderParameters. Broaden the reserved X-MS-TOKEN- prefix to cover the whole X-MS-TOKEN-* family. Move the internal ReservedHeaderNames helper to the TokenAcquisition assembly so both the clone path and DownstreamApi share it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Move changelog entry to 4.12.3

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… unit tests (#3935)

* Revert "Revert PRs #3933 and #3934: restore single-job PR pipeline (#3936)"

This reverts commit f6d7aef.

* Make MI E2E identity pool-aware; add net472 unit tests

Restores the 4-stage PR pipeline and extra unit-test coverage from
#3933/#3934 (reverted in #3936), with two fixes so the managed-identity
E2E test runs on every pool that consumes these tests:

- TokenAcquirer MI test now reads the UAMI client id from
  IDWEB_MI_UAMI_CLIENTID, falling back to the Msal_Integration_tests
  identity (45344e7d) assigned to the Wilson pool used by the
  id4s-official pipeline. That pipeline needs no changes.
- template-run-managed-identity-e2e-tests.yaml sets IDWEB_MI_UAMI_CLIENTID
  to the msiv2uami identity (6325cd32) assigned to the MSALMSIV2 pool,
  so the Id.Web PR pipeline and IdWeb OneBranch official MI job use it.

Also re-adds the net472 dotnet test step that VSTest@2 cannot discover
on hosted agents.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add the 4.13.0 changelog section (OWIN GetAuthorizationHeaderProvider2 #3928, IAuthorizationHeaderProvider2 DI registration #3927, MSAL 4.86.0 bump #3931), move the OWIN unshipped public API entries to shipped, and bump the dev version to 4.13.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Iarek Kovtunenko <16271112+iarekk@users.noreply.github.com>

The ADO PR pipeline now runs the full unit test matrix (incl. net462/472)
after #3935, making the dotnetcore.yml GitHub Action redundant. Remove it
and rely on the ADO check for PR validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…3940)

SignIn was missing the IsPercentEncodedSlashBypass guard that Challenge
already had. A redirectUri like /%2fevil.example passes Url.IsLocalUrl
(the framework only checks for literal // and /\), but a normalising
reverse proxy decodes it to //evil.example; browsers then follow it as
a protocol-relative URL after sign-in.

Add !IsPercentEncodedSlashBypass(redirectUri) to the SignIn guard,
matching the guard on Challenge.

Also update the IsPercentEncodedSlashBypass XML doc to note it is a
local copy of RedirectUriHelper.HasPercentEncodedSlashPrefix (internal
in a separate assembly) so future changes keep both in sync.

Tests: two new facts in AccountControllerTests covering the %2f and %5c
variants on the SignIn path, using the realistic IsLocalUrl mock so
removing either guard breaks the tests.


Copilot-Session: 00c4f24d-188f-4bd9-926c-a6d0620eb053

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…) (#3941)

* Fix duplicate logging of MsalUiRequiredException

MsalUiRequiredException is already logged by MSAL.NET internally, so
re-logging it via Logger.TokenAcquisitionError in TokenAcquisition.cs
produced a duplicate log entry for every exception. Removed the
redundant logging in the two catch blocks that only rethrow/wrap the
exception.

Fixes #3528

* Removing try-catch block to allow the exception propagate naturally

---------

Co-authored-by: armin-azar <armin@azars.io>

* Fix #3840: Use native MSAL UserFIC API for agentic UPN flows

Replace ROPC piggybacking with MSAL's native
AcquireTokenByUserFederatedIdentityCredential API using the multi-CCA
pattern (blueprint + per-agent CCAs with assertion callbacks).

This enables proper token caching for agentic User FIC flows when
ClaimsPrincipal is null, eliminating 2-4 unnecessary network round-trips
per bot message.

Phase 1: UPN-based flows only. OID-based flows remain on the existing
ROPC+add-in path pending MSAL .NET support for the OID overload.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add OID UserFIC support, bump MSAL to 4.84.2, remove add-in

- Bump MSAL .NET from 4.84.1 to 4.84.2 (adds Guid userObjectId overload
  for AcquireTokenByUserFederatedIdentityCredential)
- Extend TryGetAuthenticationResultForAgentUserFicAsync to handle both
  UPN-based and OID-based agentic flows via native MSAL APIs
- Remove AgentUserIdentityMsalAddIn (ROPC body-rewriting workaround) and
  its registration in AddAgentIdentities — no longer needed
- Remove dead agent identity extraction code from ROPC path
- Add 3 OID-specific tests: cache on second call, fresh ClaimsPrincipal
  per call, and UPN/OID cache isolation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Better handling of national cloud endpoints for FIC scope

* Fix #3840: Use native MSAL UserFIC API for agentic UPN flows

Replace ROPC piggybacking with MSAL's native
AcquireTokenByUserFederatedIdentityCredential API using the multi-CCA
pattern (blueprint + per-agent CCAs with assertion callbacks).

This enables proper token caching for agentic User FIC flows when
ClaimsPrincipal is null, eliminating 2-4 unnecessary network round-trips
per bot message.

Phase 1: UPN-based flows only. OID-based flows remain on the existing
ROPC+add-in path pending MSAL .NET support for the OID overload.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add OID UserFIC support, bump MSAL to 4.84.2, remove add-in

- Bump MSAL .NET from 4.84.1 to 4.84.2 (adds Guid userObjectId overload
  for AcquireTokenByUserFederatedIdentityCredential)
- Extend TryGetAuthenticationResultForAgentUserFicAsync to handle both
  UPN-based and OID-based agentic flows via native MSAL APIs
- Remove AgentUserIdentityMsalAddIn (ROPC body-rewriting workaround) and
  its registration in AddAgentIdentities — no longer needed
- Remove dead agent identity extraction code from ROPC path
- Add 3 OID-specific tests: cache on second call, fresh ClaimsPrincipal
  per call, and UPN/OID cache isolation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Better handling of national cloud endpoints for FIC scope

* Add agent CCA instance eviction strategy

* PR feedback

* Fix test issue

* More logging and less overrides

* Remove upn/oid from agentic flow logs

* Enable shared static cache for agent CCAs and add cache isolation tests

- Default agent User FIC CCAs to use EnableSharedCacheOptions so tokens
  survive CCA eviction (backed by process-level static dictionaries)
- Add UseSharedCacheForAgentCcas internal property (default true) for
  test controllability
- Add 4 shared cache isolation tests:
  1. Multi-agent/multi-user correctness (initial + silent)
  2. Cache miss with wrong agent/user (strict isolation)
  3. Per-instance cache: tokens lost on eviction (UseSharedCache=false)
  4. Shared cache: tokens survive CCA re-creation after eviction

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Clean up tests and comments: consolidate redundant tests, fix stale comments

- Remove 4 redundant tests:
  - WorksWithNonNullClaimsPrincipal (subsumed by CacheWorksWithNewClaimsPrincipalPerCall)
  - OidCacheWorksWithNewClaimsPrincipalPerCall (OID basic caching already covered)
  - DifferentAgentOrUser_DoesNotReturnCachedToken (covered by MultiAgentMultiUser test)
  - ReturnsZero_WhenNothingExpired (trivial, covered by DoesNotRemoveRecentlyAccessed)
- Update GetOrBuildAgentUserFicCcaAsync docstring to reflect shared cache design
- Remove fragile line-number reference in comment
- Clean up verbose metacommentary in test comments

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Replace periodic sweep with simple size-threshold eviction

Replace the timer-based idle sweep (AgentCcaEntry, Stopwatch timestamps,
SweepExpiredAgentCcas, EnsureAgentCcaSweepTimerStarted) with a simple
size-threshold clear: when _agentUserFicCcas exceeds AgentCcaMaxCount
(default 10,000), clear the entire dictionary.

This is safe because tokens live in MSAL's shared static cache (enabled
via EnableSharedCacheOptions), not per-CCA instance caches. Clearing the
dictionary only discards lightweight CCA wrapper objects. New CCAs built
with the same clientId will find cached tokens via AcquireTokenSilent.

Removes:
- AgentCcaEntry class (timestamps, Touch, IsExpired)
- AgentCcaMaxIdleMilliseconds, AgentCcaSweepInterval properties
- _agentCcaSweepTimer field
- EnsureAgentCcaSweepTimerStarted(), SweepExpiredAgentCcas() methods
- System.Diagnostics using (Stopwatch no longer needed)
- 4 sweep eviction tests (timer, touch, companion cleanup, selective)

Adds:
- AgentCcaMaxCount property (default 10,000)
- Inline size check after CCA creation
- 1 size-threshold eviction test

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address review feedback: normalize agentAppId, handle Guid OID values, clear semaphores on eviction, fix stale XML docs and log message

- Normalize agentAppId to uppercase to prevent duplicate CCAs from GUID casing
- Accept Guid objects (not just strings) for OID via ToString() fallback
- Clear _agentCcaSemaphores alongside CCA/account dictionaries on threshold eviction
- Fix stale XML docs referencing timestamp-based eviction (now size-threshold)
- Add shared-cache caveat to AgentCcaMaxCount doc
- Fix _agentUserFicAccountIds doc (opportunistic cleanup, not MSAL-driven eviction)
- Update log message from 'sweep evicted' to 'cache cleared (exceeded size threshold)'

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix CS8602 on older TFMs and drop unnecessary agentAppId normalization

Revert agentAppId.ToUpperInvariant() — existing ID Web patterns (GetApplicationKey,
_applicationsByAuthorityClientId) do not normalize client IDs, so adding
case-normalization only in the agentic flow would be inconsistent.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address review feedback: simplify OID detection, use MSAL TenantId, remove ExtractTenant, drop WithExperimentalFeatures

- Simplify OID detection to Guid.TryParse(userIdObj?.ToString(), ...) instead
  of complex || assignment with null-forgiving operator
- Use AssertionRequestOptions.TenantId directly with WithTenantId() for Leg 1
  tenant propagation, replacing custom ExtractTenantFromTokenEndpointIfSameInstance
- Remove ExtractTenantFromTokenEndpointIfSameInstance method and its 4 tests
  (OidcIdpSignedAssertionProvider's copy in OidcFIC project is unaffected)
- Remove WithExperimentalFeatures() from agent CCA builder — none of the APIs
  used (WithClientAssertion, WithFmiPath, AcquireTokenByUserFederatedIdentityCredential)
  require it

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Tighten catch

* Remove unneeded shared cache toggle

* Refactor CCA instance management in agentic flows (#3930)

* Refactor agent CCA instance management

* PR feedback

* PR feedback

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ader (#3943)

CustomizeHttpRequestMessage is documented to run after the message is formed,
including the Authorization header, and just before it is sent. #3902 moved it
before authorization-header creation (to flow the finalized request for
request-binding), which regressed callers that read the header in the callback -
they saw a null Authorization header.

This moves only the CustomizeHttpRequestMessage invocation back to after the
header is set, leaving the request-flow plumbing (options material +
SetHttpRequestMessage) untouched. Adds a regression test asserting the callback
observes the Authorization header.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---
updated-dependencies:
- dependency-name: Microsoft.IdentityModel.Tokens.Saml
  dependency-version: 8.19.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: Microsoft.IdentityModel.Tokens.Saml
  dependency-version: 8.19.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Reverts the default IdentityModelV5Version bump from 8.19.1 back to 5.7.0.
This property deliberately pins Microsoft.IdentityModel.Tokens.Saml and
Microsoft.IdentityModel.Protocols.WsFederation to the 5.x line for the
net472 OWIN package. The bump only touched the default branch (CI/TF_BUILD
stays 5.7.1) and left the MSB3277 suppression keyed to 5.7.1, causing a
local-vs-CI version divergence. Reverting until the intent is clarified.


Copilot-Session: 742e5e40-2da7-4d10-af81-d038b3802ce4

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

12.5.0 adds the OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation request
hooks that DownstreamApi consumes for request-binding (SHR) support.

Add the two new (inherited) DownstreamApiOptions properties to the Sidecar
DownstreamApiOptionsMerger reflection test's not-merged set, alongside
CustomizeHttpRequestMessage - they are per-request callbacks, not config-merged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ownstreamApi (#3942)

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ect files (#3950)

Co-authored-by: trwalke <trwalke@microsoft.com>

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Gladwin Johnson <90415114+gladjohn@users.noreply.github.com>

* Initial plan

* Bump Microsoft.Identity.Client and KeyAttestation to 4.86.1

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Bumps Microsoft.Identity.Client from 4.86.0 to 4.86.1
Bumps Microsoft.Identity.Client.KeyAttestation from 4.86.0 to 4.86.1
Bumps Microsoft.IdentityModel.JsonWebTokens from 8.19.1 to 8.19.2

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Client
  dependency-version: 4.86.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: notsecurity
- dependency-name: Microsoft.Identity.Client.KeyAttestation
  dependency-version: 4.86.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: notsecurity
- dependency-name: Microsoft.IdentityModel.JsonWebTokens
  dependency-version: 8.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: notsecurity
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>