Repository navigation

Complete exportable-certificate mTLS E2E coverage and combined transport integration - #976

Open

Robbie-Microsoft wants to merge 153 commits into

devfrom

robbie-microsoft-comprehensive-mtls-e2e-parity

Open

Complete exportable-certificate mTLS E2E coverage and combined transport integration#976
Robbie-Microsoft wants to merge 153 commits into
devfrom
robbie-microsoft-comprehensive-mtls-e2e-parity

Commits on Jul 7, 2026
- Add SNI certificate support over mTLS Proof-of-Possession
  
  Robbie-Microsoft
  and
  Copilot
  committed
  dd4f13a
Commits on Jul 8, 2026
- Use SN/I-allow-listed app for mTLS PoP e2e tests
  
  Robbie-Microsoft
  and
  Copilot
  committed
  81c3eb7
- Enumerate key-bound ATs on sign-out and account removal
  
  Robbie-Microsoft
  and
  Copilot
  committed
  224a003
- Fail closed on mTLS PoP token_type downgrade; honor verify; lock session build
  
  Robbie-Microsoft
  and
  Copilot
  committed
  02ccacb
- Isolate key/ext-bound ATs unconditionally; normalize verify=None
  
  Robbie-Microsoft
  and
  Copilot
  committed
  51adcec
- Address review comments on mTLS PoP cert/key handling
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ba697e8
- Add FIC two-leg exchange over mTLS Proof-of-Possession
  
  Robbie-Microsoft
  and
  Copilot
  committed
  01b676b
- Fail fast when a FIC leg-2 app is used with a non-mTLS flow
  
  Robbie-Microsoft
  and
  Copilot
  committed
  90d0e67
- Reject FIC leg-2 apps on silent flows too
  
  Robbie-Microsoft
  and
  Copilot
  committed
  acd78ed
Commits on Jul 30, 2026
- Harden mTLS PoP e2e: prove token at resource + naming matrix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b79166d
- Strengthen X509->Bearer e2e: assert cert binding is absent
  
  Robbie-Microsoft
  and
  Copilot
  committed
  aaf62c1
- Note _call_graph_with_mtls_pop_token is shared with FIC #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  fec7d7f
- Split mtls_pop/Bearer e2e by region (drop regional PoP cell)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b9233c6
- Merge SNI mTLS PoP hardening (#938) into FIC branch
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3ce5d96
- Merge origin/dev into sni-mtls-pop (resync #938 with base)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  4ec592f
- Merge resync'd #938 (origin/dev) into FIC branch #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  09e8fb5
Commits on Jul 31, 2026
- Add Bearer-over-mTLS: app-level flag + client-credentials path
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f98961f
- Route OBO/refresh/auth-code through Bearer-over-mTLS when flag is set
  
  Robbie-Microsoft
  and
  Copilot
  committed
  93faa2f
- Add Bearer-over-mTLS second-call cache-hit regression
  
  Robbie-Microsoft
  and
  Copilot
  committed
  bf79927
- Add Bearer-over-mTLS end-to-end cells
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ab024e7
- Document the send_certificate_over_mtls client_credential flag
  
  Robbie-Microsoft
  and
  Copilot
  committed
  92421b0
- Harden Bearer-over-mTLS 2nd-call cache test with an env-lock assertion
  
  Robbie-Microsoft
  and
  Copilot
  committed
  60a9f24
Commits on Oct 9, 2026
- Merge origin/dev into sni-mtls-pop
  Robbie-Microsoft
  committed
  e226f92
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3b45837
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  c78bb15
Commits on Oct 21, 2026
- Address mTLS review feedback
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6e2c371
- Merge origin/dev into sni-mtls-pop
  
  Robbie-Microsoft
  and
  Copilot
  committed
  077f11f
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3c66b97
Commits on Oct 22, 2026
- Address FIC mTLS review feedback
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1e41f24
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6270370
- Fix Bearer-over-mTLS transport enforcement and PFX chains
  
  Robbie-Microsoft
  and
  Copilot
  committed
  a3ee807
- Address mTLS PoP review comments
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0424c53
- Add downstream mTLS binding context
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d3a120c
- Merge mTLS binding context foundation
  Robbie-Microsoft
  committed
  c39abc6
- Merge mTLS binding context foundation
  Robbie-Microsoft
  committed
  c467604
Commits on Oct 23, 2026
- Fix mTLS cache isolation and transport compatibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  9e35a33
- Merge remote-tracking branch 'origin/rginsburg/sni-mtls-pop' into rginsburg/sni-mtls-pop-fic
  Robbie-Microsoft
  committed
  cd043fe
- Align FIC Bearer and PoP result binding
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d2b9ab2
- Merge mTLS PoP foundation and align Bearer semantics
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5818a5c
- Add certificate-aware mTLS HTTP client extensibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  28b0126
- Fix mTLS cache compatibility and transport review findings
  
  Robbie-Microsoft
  and
  Copilot
  committed
  e574edd
- Avoid cache persistence reentry and quadratic migration cleanup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6f34f2e
- Reject mixed-case raw mTLS token types before cache lookup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  2de965f
- Reject redirects in the owned mTLS token transport
  
  Robbie-Microsoft
  and
  Copilot
  committed
  dd07393
- Merge PR #938 into Bearer-over-mTLS follow-up
  
  Robbie-Microsoft
  and
  Copilot
  committed
  8d4ecec
- Merge PR #938 into FIC mTLS follow-up
  
  Robbie-Microsoft
  and
  Copilot
  committed
  8b703d7
- Merge PR #938 into certificate-aware HTTP extensibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0109a28
- Fix custom mTLS transport response handling and dependency validation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  18bfd0d
- Fix Bearer-over-mTLS routing, certificate overrides and PFX compatibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  30281ce
- Address FIC mTLS review feedback
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b70842b
- Align Bearer-over-mTLS E2E failure and coverage semantics
  
  Robbie-Microsoft
  and
  Copilot
  committed
  820c96f
- Clarify default-only mTLS live E2E coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3bc3505
- Align FIC E2E cells with shared SDK lab setup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  84ff3e8
- Fail required certificate E2E scenarios on missing lab configuration
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1fceb2f
- Merge shared mTLS E2E fixture validation from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6c1a0a5
- Make required E2E fixture checks independent of release environment
  
  Robbie-Microsoft
  and
  Copilot
  committed
  751aa0b
- Merge required certificate E2E coverage from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  eeb27d0
- Fix certificate fixture regression when release tag is unset
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f67c680
- Merge shared fail-closed certificate E2E fixtures
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b241b3d
- Merge shared E2E fixture portability fix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  063325c
- Merge final shared certificate E2E fixture correction from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  2ca4c85
- Merge final shared certificate E2E correction from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  51cd6fd
- Merge approved SNI mTLS PoP head (#938)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  a821098
- Merge approved FIC mTLS PoP head (#939)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  87b62c2
- Merge approved Bearer-over-mTLS head (#947)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b0cf453
- Merge approved custom mTLS HTTP head (#974)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d9f87b1
- Share certificate transport across mTLS flows
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6b0694c
- Expand required live mTLS E2E parity coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f5435b4
- Keep mTLS sample diagnostics safe and pin fixture TLS
  
  Robbie-Microsoft
  and
  Copilot
  committed
  fea35cf
- Match live mTLS service representations and rejection codes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7f98208
- Hide sensitive E2E helper arguments from failure tracebacks
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1208c07
- Index access-token identities for bounded cache writes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0cd290d
Commits on Oct 27, 2026
- Move custom mTLS recorder and sample safety coverage to its owning PR
  
  Robbie-Microsoft
  and
  Copilot
  committed
  9814be5
- Restore default FIC E2E wire and binding guarantees
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3a9c636
- Relocate core mTLS parity fixtures and cache scaling regressions
  
  Robbie-Microsoft
  and
  Copilot
  committed
  a447ee5
- Document targeted offline FIC guard invocation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  cd295d4
- Document the custom source inventory and reuse shared privacy guards
  
  Robbie-Microsoft
  and
  Copilot
  committed
  960195b
- Relocate default Bearer-over-mTLS E2E coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f481380
- Merge redistributed core coverage and cache fix from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5b0a590
- Merge shared certificate E2E core into default FIC coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  70d4137
- Keep redistributed base logging coverage single-collected
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3e1d350
- Merge core mTLS parity fixtures and cache fix into Bearer coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5b0c827
- Merge redistributed default FIC coverage from #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b3a8920
- Merge shared core mTLS parity fixtures and cache regressions from #938
  Robbie-Microsoft
  committed
  66fdf17
- Merge redistributed default Bearer transport coverage from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  e91bf51
- Merge redistributed custom HTTP coverage from #974
  
  Robbie-Microsoft
  and
  Copilot
  committed
  37c5177
- Close default E2E transports across core and shared client layouts
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3186192
- Merge shared E2E cleanup layout compatibility from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  70f7281
- Merge shared default-transport cleanup correction from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f7b306d
- Merge compatible mTLS E2E transport cleanup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7692d10
- Keep actual-client cleanup regression portable to shared transports
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1876aac
- Keep cleanup regression portable to shared mTLS transports
  
  Robbie-Microsoft
  and
  Copilot
  committed
  c203bfe
- Merge cleanup ownership regression coverage from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  c609ef5
- Merge final portable cleanup regressions from #938
  Robbie-Microsoft
  committed
  bdbd7e7
- Merge final portable cleanup guard from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  321d9f6
- Merge final portable cleanup assertions from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f377fbc
- Merge corrected default Bearer coverage head from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d293040
- Merge corrected default FIC coverage head from #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  53bb9ac
- Merge final redistributed FIC owner ancestry from #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  a5ac724
- Merge final redistributed custom HTTP owner ancestry from #974
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6e39ab9
- Clarify custom HTTP support for combined Bearer-over-mTLS
  
  Robbie-Microsoft
  and
  Copilot
  committed
  eb0c10f
- Sanitize custom recorder transport failure tracebacks
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5908a19
- Treat an unspecified certificate consistently across mTLS requests
  
  Robbie-Microsoft
  and
  Copilot
  committed
  8e6acee
- Sanitize real transport failures in shared mTLS E2E helpers
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7e14c4f
- Merge shared transport privacy guards from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3d32aa0
- Merge approved shared request privacy guards from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  47740dd
- Merge sanitized mTLS transport failure boundaries
  
  Robbie-Microsoft
  and
  Copilot
  committed
  37d8099
- Merge shared transport-failure privacy fix from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d61ce7c
- Merge approved None certificate override correction from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3e4c806
- Cover custom Bearer and PoP cert=None cold and cached requests
  
  Robbie-Microsoft
  and
  Copilot
  committed
  eb2519f
- Merge final approved Bearer owner privacy ancestry from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0d6e3c3
- Merge final approved FIC owner privacy ancestry from #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  326ac1a
- Sanitize outer custom acquisition tracebacks and guard cert None
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5543468
- Reject real Bearer certificate overrides before cache lookup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  4ec4536
- Merge approved custom privacy guards and protect combined grant boundaries
  
  Robbie-Microsoft
  and
  Copilot
  committed
  38e7f9d
- Merge final approved Bearer certificate override cache guard from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  2f1adab
- Isolate synthetic OBO acquisition from traceback source rendering
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6d408b3
- Merge Python 3.9 source-rendering privacy correction from #974
  
  Robbie-Microsoft
  and
  Copilot
  committed
  59eb44a
- Sanitize recorder validation and remove equal legacy token copies
  
  Robbie-Microsoft
  and
  Copilot
  committed
  4206e32
- Merge shared validation privacy and cache removal corrections from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  e072a5c
- Merge recorder validation privacy and duplicate-removal fixes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  873937b
- Merge final shared recorder privacy and cache removal fixes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  bb9c101
- Merge approved native duplicate removal and summary privacy fixes from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  32c1e84
- Merge final approved Bearer owner cache and summary ancestry from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  8f39c0a
- Sanitize custom recorder summary validation at the acquisition boundary
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7a5756b
- Merge final approved FIC owner cache and summary ancestry from #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7b128b2
- Merge approved custom summary-validation privacy and cache ancestry from #974
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1a8acf1
- Wire the shared hidden custom OBO acquisition boundary into combined capture
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ab34c5b
Commits on Nov 2, 2026
- Preserve actual certificate binding across FIC legs
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0611fbd
- Snapshot nested FIC certificate credential dictionaries
  
  Robbie-Microsoft
  and
  Copilot
  committed
  bf763f9
- Validate Bearer-over-mTLS responses before cache callbacks
  
  Robbie-Microsoft
  and
  Copilot
  committed
  4309d51
- Harden mTLS credential snapshots and live-test contracts
  
  Robbie-Microsoft
  and
  Copilot
  committed
  c587a89
- Merge final shared mTLS review corrections from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  76858bb
- Merge approved nine-comment core fixes from #938
  Robbie-Microsoft
  committed
  6b52ad6
- Merge shared mTLS review fixes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7adea94
- Merge shared mTLS snapshot and opaque Graph contracts
  
  Robbie-Microsoft
  and
  Copilot
  committed
  59dfd90
- Defer PFX chain verification while retaining one credential snapshot
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ddb0280
- Merge lazy PFX snapshot compatibility correction
  
  Robbie-Microsoft
  and
  Copilot
  committed
  21ad1c1
- Merge approved PFX snapshot compatibility correction from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f64a447
- Merge final PFX snapshot compatibility correction
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6756266
- Integrate shared mTLS safeguards with custom transport parity
  
  Robbie-Microsoft
  and
  Copilot
  committed
  4b392ae
- Merge approved final FIC certificate handoff fixes from #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  487be72
- Merge approved final Bearer response validation from #947
  
  Robbie-Microsoft
  and
  Copilot
  committed
  9acccb0
- Merge approved final custom mTLS transport regressions from #974
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5d56577
- Cover combined mTLS review regressions
  
  Robbie-Microsoft
  and
  Copilot
  committed
  eac73a2
- Retire original access token records when modify changes identity
  
  Robbie-Microsoft
  and
  Copilot
  committed
  230a4cd
- Merge indexed cache identity-update correction
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6a90b0f
- Integrate approved cache identity update fix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  91105e6
- Merge approved access-token cache identity correction
  
  Robbie-Microsoft
  and
  Copilot
  committed
  9619231
- Merge approved cache identity retirement correction
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ed9c608
- Integrate final feature head with approved cache fix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  07e5510
- Integrate final feature head with approved cache fix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1c66c8d
- Integrate final feature head with approved cache fix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  244fa09

Commits

Commits on Jul 7, 2026

Commits on Jul 8, 2026

Commits on Jul 30, 2026

Commits on Jul 31, 2026

Commits on Oct 9, 2026

Commits on Oct 21, 2026

Commits on Oct 22, 2026

Commits on Oct 23, 2026

Commits on Oct 27, 2026

Commits on Nov 2, 2026