initial

GladwinJohnson · GladwinJohnson · commit b84937db8380 · 2025-05-13T12:02:29.000-07:00
diff --git a/src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenForManagedIdentityParameters.cs b/src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenForManagedIdentityParameters.cs
@@ -16,6 +16,8 @@ internal class AcquireTokenForManagedIdentityParameters : IAcquireTokenParameter
 
         public string Resource { get; set; }
 
+        public string Claims { get; set; }
+
         public void LogParameters(ILoggerAdapter logger)
         {
             if (logger.IsLoggingEnabled(LogLevel.Info))
diff --git a/src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs b/src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs
@@ -36,6 +36,7 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
             // Skip checking cache when force refresh or claims is specified
             if (_managedIdentityParameters.ForceRefresh || !string.IsNullOrEmpty(AuthenticationRequestParameters.Claims))
             {
+                _managedIdentityParameters.Claims = AuthenticationRequestParameters.Claims;
                 AuthenticationRequestParameters.RequestContext.ApiEvent.CacheInfo = CacheRefreshReason.ForceRefreshOrClaims;
                 
                 logger.Info("[ManagedIdentityRequest] Skipped looking for a cached access token because ForceRefresh or Claims were set. " +
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/AbstractManagedIdentity.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/AbstractManagedIdentity.cs
@@ -12,6 +12,8 @@
 using System.Net;
 using Microsoft.Identity.Client.ApiConfig.Parameters;
 using System.Text;
+using System.Collections.Generic;
+using System.Linq;
 #if SUPPORTS_SYSTEM_TEXT_JSON
 using System.Text.Json;
 #else
@@ -48,7 +50,7 @@ public virtual async Task<ManagedIdentityResponse> AuthenticateAsync(
             // Convert the scopes to a resource string.
             string resource = parameters.Resource;
 
-            ManagedIdentityRequest request = CreateRequest(resource);
+            ManagedIdentityRequest request = CreateRequest(resource, parameters);
 
             _requestContext.Logger.Info("[Managed Identity] Sending request to managed identity endpoints.");
 
@@ -130,7 +132,7 @@ protected virtual Task<ManagedIdentityResponse> HandleResponseAsync(
             throw exception;
         }
 
-        protected abstract ManagedIdentityRequest CreateRequest(string resource);
+        protected abstract ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters);
 
         protected ManagedIdentityResponse GetSuccessfulResponse(HttpResponse response)
         {
@@ -298,5 +300,54 @@ private static void CreateAndThrowException(string errorCode,
 
             throw exception;
         }
+
+        /// <summary>
+        /// Sets the claims and capabilities in the request.
+        /// </summary>
+        /// <param name="request"></param>
+        /// <param name="parameters"></param>
+        protected virtual void ApplyClaimsAndCapabilities(
+            ManagedIdentityRequest request,
+            AcquireTokenForManagedIdentityParameters parameters)
+        {
+            IEnumerable<string> clientCapabilities = _requestContext.ServiceBundle.Config.ClientCapabilities;
+
+            // If claims are present, set bypass_cache=true
+            if (!string.IsNullOrEmpty(parameters.Claims))
+            {
+                SetRequestParameter(request, "bypass_cache", "true");
+                _requestContext.Logger.Info("[Managed Identity] Setting bypass_cache=true in the Managed Identity request due to claims.");
+
+                // Set xms_cc only if clientCapabilities exist
+                if (clientCapabilities != null && clientCapabilities.Any())
+                {
+                    SetRequestParameter(request, "xms_cc", string.Join(",", clientCapabilities));
+                    _requestContext.Logger.Info("[Managed Identity] Adding client capabilities (xms_cc) to Managed Identity request.");
+                }
+            }
+            else
+            {
+                SetRequestParameter(request, "bypass_cache", "false");
+                _requestContext.Logger.Info("[Managed Identity] Setting bypass_cache=false (no claims provided).");
+            }
+        }
+
+        /// <summary>
+        /// Sets the request parameter in either the query or body based on the request method.
+        /// </summary>
+        /// <param name="request"></param>
+        /// <param name="key"></param>
+        /// <param name="value"></param>
+        protected void SetRequestParameter(ManagedIdentityRequest request, string key, string value)
+        {
+            if (request.Method == HttpMethod.Post)
+            {
+                request.BodyParameters[key] = value;
+            }
+            else
+            {
+                request.QueryParameters[key] = value;
+            }
+        }
     }
 }
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/AppServiceManagedIdentitySource.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/AppServiceManagedIdentitySource.cs
@@ -4,6 +4,8 @@
 using System;
 using System.Collections.Generic;
 using System.Globalization;
+using System.Linq;
+using Microsoft.Identity.Client.ApiConfig.Parameters;
 using Microsoft.Identity.Client.Core;
 using Microsoft.Identity.Client.Internal;
 using Microsoft.Identity.Client.Utils;
@@ -13,7 +15,7 @@ namespace Microsoft.Identity.Client.ManagedIdentity
     internal class AppServiceManagedIdentitySource : AbstractManagedIdentity
     {
         // MSI Constants. Docs for MSI are available here https://docs.microsoft.com/azure/app-service/overview-managed-identity
-        private const string AppServiceMsiApiVersion = "2019-08-01";
+        private const string AppServiceMsiApiVersion = "2025-03-30";
         private const string SecretHeaderName = "X-IDENTITY-HEADER";
 
         private readonly Uri _endpoint;
@@ -65,14 +67,16 @@ private static bool TryValidateEnvVars(string msiEndpoint, ILoggerAdapter logger
             return true;
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource)
+        protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)
         {
             ManagedIdentityRequest request = new(System.Net.Http.HttpMethod.Get, _endpoint);
             
             request.Headers.Add(SecretHeaderName, _secret);
             request.QueryParameters["api-version"] = AppServiceMsiApiVersion;
             request.QueryParameters["resource"] = resource;
 
+            ApplyClaimsAndCapabilities(request, parameters);
+
             switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)
             {
                 case AppConfig.ManagedIdentityIdType.ClientId:
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/AzureArcManagedIdentitySource.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/AzureArcManagedIdentitySource.cs
@@ -78,13 +78,16 @@ private AzureArcManagedIdentitySource(Uri endpoint, RequestContext requestContex
             }
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource)
+        protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)
         {
             ManagedIdentityRequest request = new ManagedIdentityRequest(System.Net.Http.HttpMethod.Get, _endpoint);
 
             request.Headers.Add("Metadata", "true");
             request.QueryParameters["api-version"] = ArcApiVersion;
             request.QueryParameters["resource"] = resource;
+            request.QueryParameters["bypass_cache"] = "false";
+
+            ApplyClaimsAndCapabilities(request, parameters);
 
             return request;
         }
@@ -118,7 +121,7 @@ protected override async Task<ManagedIdentityResponse> HandleResponseAsync(
 
                 var authHeaderValue = "Basic " + File.ReadAllText(splitChallenge[1]);
 
-                ManagedIdentityRequest request = CreateRequest(parameters.Resource);
+                ManagedIdentityRequest request = CreateRequest(parameters.Resource, parameters);
 
                 _requestContext.Logger.Verbose(() => "[Managed Identity] Adding authorization header to the request.");
                 request.Headers.Add("Authorization", authHeaderValue);
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/CloudShellManagedIdentitySource.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/CloudShellManagedIdentitySource.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Globalization;
 using System.Net.Http;
+using Microsoft.Identity.Client.ApiConfig.Parameters;
 using Microsoft.Identity.Client.Core;
 using Microsoft.Identity.Client.Internal;
 
@@ -73,14 +74,16 @@ private CloudShellManagedIdentitySource(Uri endpoint, RequestContext requestCont
             }
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource)
+        protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)
         {
             ManagedIdentityRequest request = new ManagedIdentityRequest(HttpMethod.Post, _endpoint);
 
             request.Headers.Add("ContentType", "application/x-www-form-urlencoded");
             request.Headers.Add("Metadata", "true");
 
             request.BodyParameters.Add("resource", resource);
+            
+            ApplyClaimsAndCapabilities(request, parameters);
 
             return request;
         }
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/ImdsManagedIdentitySource.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/ImdsManagedIdentitySource.cs
@@ -56,14 +56,16 @@ internal ImdsManagedIdentitySource(RequestContext requestContext) :
             requestContext.Logger.Verbose(() => "[Managed Identity] Creating IMDS managed identity source. Endpoint URI: " + _imdsEndpoint);
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource)
+        protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)
         {
             ManagedIdentityRequest request = new(HttpMethod.Get, _imdsEndpoint);
 
             request.Headers.Add("Metadata", "true");
             request.QueryParameters["api-version"] = ImdsApiVersion;
             request.QueryParameters["resource"] = resource;
 
+            ApplyClaimsAndCapabilities(request, parameters);
+
             switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)
             {
                 case AppConfig.ManagedIdentityIdType.ClientId:
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/MachineLearningManagedIdentitySource.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/MachineLearningManagedIdentitySource.cs
@@ -3,6 +3,7 @@
 
 using System;
 using System.Globalization;
+using Microsoft.Identity.Client.ApiConfig.Parameters;
 using Microsoft.Identity.Client.Core;
 using Microsoft.Identity.Client.Internal;
 
@@ -62,7 +63,7 @@ private static bool TryValidateEnvVars(string msiEndpoint, ILoggerAdapter logger
             return true;
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource)
+        protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)
         {
             ManagedIdentityRequest request = new(System.Net.Http.HttpMethod.Get, _endpoint);
 
@@ -71,6 +72,8 @@ protected override ManagedIdentityRequest CreateRequest(string resource)
             request.QueryParameters["api-version"] = MachineLearningMsiApiVersion;
             request.QueryParameters["resource"] = resource;
 
+            ApplyClaimsAndCapabilities(request, parameters);
+
             switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)
             {
                 case AppConfig.ManagedIdentityIdType.ClientId:
diff --git a/src/client/Microsoft.Identity.Client/ManagedIdentity/ServiceFabricManagedIdentitySource.cs b/src/client/Microsoft.Identity.Client/ManagedIdentity/ServiceFabricManagedIdentitySource.cs
@@ -5,6 +5,7 @@
 using System.Globalization;
 using System.Net.Http;
 using System.Net.Security;
+using Microsoft.Identity.Client.ApiConfig.Parameters;
 using Microsoft.Identity.Client.Core;
 using Microsoft.Identity.Client.Internal;
 
@@ -32,9 +33,9 @@ public static AbstractManagedIdentity Create(RequestContext requestContext)
                 var exception = MsalServiceExceptionFactory.CreateManagedIdentityException(
                     MsalError.InvalidManagedIdentityEndpoint,
                     errorMessage,
-                    null, 
+                    null,
                     ManagedIdentitySource.ServiceFabric,
-                    null); 
+                    null);
 
                 throw exception;
             }
@@ -54,7 +55,7 @@ internal override bool ValidateServerCertificate(HttpRequestMessage message, Sys
             return string.Equals(certificate.GetCertHashString(), EnvironmentVariables.IdentityServerThumbprint, StringComparison.OrdinalIgnoreCase);
         }
 
-        private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri endpoint, string identityHeaderValue) : 
+        private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri endpoint, string identityHeaderValue) :
         base(requestContext, ManagedIdentitySource.ServiceFabric)
         {
             _endpoint = endpoint;
@@ -66,7 +67,7 @@ private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri en
             }
         }
 
-        protected override ManagedIdentityRequest CreateRequest(string resource)
+        protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)
         {
             ManagedIdentityRequest request = new ManagedIdentityRequest(HttpMethod.Get, _endpoint);
 
@@ -75,6 +76,8 @@ protected override ManagedIdentityRequest CreateRequest(string resource)
             request.QueryParameters["api-version"] = ServiceFabricMsiApiVersion;
             request.QueryParameters["resource"] = resource;
 
+            ApplyClaimsAndCapabilities(request, parameters);
+
             switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)
             {
                 case AppConfig.ManagedIdentityIdType.ClientId:
diff --git a/tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHttpManagerExtensions.cs b/tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHttpManagerExtensions.cs
diff --git a/tests/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/ManagedIdentityTests.NetFwk.cs b/tests/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/ManagedIdentityTests.NetFwk.cs
diff --git a/tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ManagedIdentityTests.cs b/tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ManagedIdentityTests.cs

Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,8 @@ internal class AcquireTokenForManagedIdentityParameters : IAcquireTokenParameter`
`16`	`16`
`17`	`17`	`public string Resource { get; set; }`
`18`	`18`
	`19`	`+ public string Claims { get; set; }`
	`20`	`+`
`19`	`21`	`public void LogParameters(ILoggerAdapter logger)`
`20`	`22`	`{`
`21`	`23`	`if (logger.IsLoggingEnabled(LogLevel.Info))`
Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,7 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok`
`36`	`36`	`// Skip checking cache when force refresh or claims is specified`
`37`	`37`	`if (_managedIdentityParameters.ForceRefresh \|\| !string.IsNullOrEmpty(AuthenticationRequestParameters.Claims))`
`38`	`38`	`{`
	`39`	`+ _managedIdentityParameters.Claims = AuthenticationRequestParameters.Claims;`
`39`	`40`	`AuthenticationRequestParameters.RequestContext.ApiEvent.CacheInfo = CacheRefreshReason.ForceRefreshOrClaims;`
`40`	`41`
`41`	`42`	`logger.Info("[ManagedIdentityRequest] Skipped looking for a cached access token because ForceRefresh or Claims were set. " +`
Original file line number	Diff line number	Diff line change
`@@ -78,13 +78,16 @@ private AzureArcManagedIdentitySource(Uri endpoint, RequestContext requestContex`
`78`	`78`	`}`
`79`	`79`	`}`
`80`	`80`
`81`		`- protected override ManagedIdentityRequest CreateRequest(string resource)`
	`81`	`+ protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)`
`82`	`82`	`{`
`83`	`83`	`ManagedIdentityRequest request = new ManagedIdentityRequest(System.Net.Http.HttpMethod.Get, _endpoint);`
`84`	`84`
`85`	`85`	`request.Headers.Add("Metadata", "true");`
`86`	`86`	`request.QueryParameters["api-version"] = ArcApiVersion;`
`87`	`87`	`request.QueryParameters["resource"] = resource;`
	`88`	`+ request.QueryParameters["bypass_cache"] = "false";`
	`89`	`+`
	`90`	`+ ApplyClaimsAndCapabilities(request, parameters);`
`88`	`91`
`89`	`92`	`return request;`
`90`	`93`	`}`
`@@ -118,7 +121,7 @@ protected override async Task<ManagedIdentityResponse> HandleResponseAsync(`
`118`	`121`
`119`	`122`	`var authHeaderValue = "Basic " + File.ReadAllText(splitChallenge[1]);`
`120`	`123`
`121`		`- ManagedIdentityRequest request = CreateRequest(parameters.Resource);`
	`124`	`+ ManagedIdentityRequest request = CreateRequest(parameters.Resource, parameters);`
`122`	`125`
`123`	`126`	`_requestContext.Logger.Verbose(() => "[Managed Identity] Adding authorization header to the request.");`
`124`	`127`	`request.Headers.Add("Authorization", authHeaderValue);`
Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,7 @@`
`4`	`4`	`using System;`
`5`	`5`	`using System.Globalization;`
`6`	`6`	`using System.Net.Http;`
	`7`	`+using Microsoft.Identity.Client.ApiConfig.Parameters;`
`7`	`8`	`using Microsoft.Identity.Client.Core;`
`8`	`9`	`using Microsoft.Identity.Client.Internal;`
`9`	`10`
`@@ -73,14 +74,16 @@ private CloudShellManagedIdentitySource(Uri endpoint, RequestContext requestCont`
`73`	`74`	`}`
`74`	`75`	`}`
`75`	`76`
`76`		`- protected override ManagedIdentityRequest CreateRequest(string resource)`
	`77`	`+ protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)`
`77`	`78`	`{`
`78`	`79`	`ManagedIdentityRequest request = new ManagedIdentityRequest(HttpMethod.Post, _endpoint);`
`79`	`80`
`80`	`81`	`request.Headers.Add("ContentType", "application/x-www-form-urlencoded");`
`81`	`82`	`request.Headers.Add("Metadata", "true");`
`82`	`83`
`83`	`84`	`request.BodyParameters.Add("resource", resource);`
	`85`	`+`
	`86`	`+ ApplyClaimsAndCapabilities(request, parameters);`
`84`	`87`
`85`	`88`	`return request;`
`86`	`89`	`}`
Original file line number	Diff line number	Diff line change
`@@ -56,14 +56,16 @@ internal ImdsManagedIdentitySource(RequestContext requestContext) :`
`56`	`56`	`requestContext.Logger.Verbose(() => "[Managed Identity] Creating IMDS managed identity source. Endpoint URI: " + _imdsEndpoint);`
`57`	`57`	`}`
`58`	`58`
`59`		`- protected override ManagedIdentityRequest CreateRequest(string resource)`
	`59`	`+ protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)`
`60`	`60`	`{`
`61`	`61`	`ManagedIdentityRequest request = new(HttpMethod.Get, _imdsEndpoint);`
`62`	`62`
`63`	`63`	`request.Headers.Add("Metadata", "true");`
`64`	`64`	`request.QueryParameters["api-version"] = ImdsApiVersion;`
`65`	`65`	`request.QueryParameters["resource"] = resource;`
`66`	`66`
	`67`	`+ ApplyClaimsAndCapabilities(request, parameters);`
	`68`	`+`
`67`	`69`	`switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)`
`68`	`70`	`{`
`69`	`71`	`case AppConfig.ManagedIdentityIdType.ClientId:`
Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,7 @@`
`3`	`3`
`4`	`4`	`using System;`
`5`	`5`	`using System.Globalization;`
	`6`	`+using Microsoft.Identity.Client.ApiConfig.Parameters;`
`6`	`7`	`using Microsoft.Identity.Client.Core;`
`7`	`8`	`using Microsoft.Identity.Client.Internal;`
`8`	`9`
`@@ -62,7 +63,7 @@ private static bool TryValidateEnvVars(string msiEndpoint, ILoggerAdapter logger`
`62`	`63`	`return true;`
`63`	`64`	`}`
`64`	`65`
`65`		`- protected override ManagedIdentityRequest CreateRequest(string resource)`
	`66`	`+ protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)`
`66`	`67`	`{`
`67`	`68`	`ManagedIdentityRequest request = new(System.Net.Http.HttpMethod.Get, _endpoint);`
`68`	`69`
`@@ -71,6 +72,8 @@ protected override ManagedIdentityRequest CreateRequest(string resource)`
`71`	`72`	`request.QueryParameters["api-version"] = MachineLearningMsiApiVersion;`
`72`	`73`	`request.QueryParameters["resource"] = resource;`
`73`	`74`
	`75`	`+ ApplyClaimsAndCapabilities(request, parameters);`
	`76`	`+`
`74`	`77`	`switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)`
`75`	`78`	`{`
`76`	`79`	`case AppConfig.ManagedIdentityIdType.ClientId:`
Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,7 @@`
`5`	`5`	`using System.Globalization;`
`6`	`6`	`using System.Net.Http;`
`7`	`7`	`using System.Net.Security;`
	`8`	`+using Microsoft.Identity.Client.ApiConfig.Parameters;`
`8`	`9`	`using Microsoft.Identity.Client.Core;`
`9`	`10`	`using Microsoft.Identity.Client.Internal;`
`10`	`11`
`@@ -32,9 +33,9 @@ public static AbstractManagedIdentity Create(RequestContext requestContext)`
`32`	`33`	`var exception = MsalServiceExceptionFactory.CreateManagedIdentityException(`
`33`	`34`	`MsalError.InvalidManagedIdentityEndpoint,`
`34`	`35`	`errorMessage,`
`35`		`- null,`
	`36`	`+ null,`
`36`	`37`	`ManagedIdentitySource.ServiceFabric,`
`37`		`- null);`
	`38`	`+ null);`
`38`	`39`
`39`	`40`	`throw exception;`
`40`	`41`	`}`
`@@ -54,7 +55,7 @@ internal override bool ValidateServerCertificate(HttpRequestMessage message, Sys`
`54`	`55`	`return string.Equals(certificate.GetCertHashString(), EnvironmentVariables.IdentityServerThumbprint, StringComparison.OrdinalIgnoreCase);`
`55`	`56`	`}`
`56`	`57`
`57`		`- private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri endpoint, string identityHeaderValue) :`
	`58`	`+ private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri endpoint, string identityHeaderValue) :`
`58`	`59`	`base(requestContext, ManagedIdentitySource.ServiceFabric)`
`59`	`60`	`{`
`60`	`61`	`_endpoint = endpoint;`
`@@ -66,7 +67,7 @@ private ServiceFabricManagedIdentitySource(RequestContext requestContext, Uri en`
`66`	`67`	`}`
`67`	`68`	`}`
`68`	`69`
`69`		`- protected override ManagedIdentityRequest CreateRequest(string resource)`
	`70`	`+ protected override ManagedIdentityRequest CreateRequest(string resource, AcquireTokenForManagedIdentityParameters parameters)`
`70`	`71`	`{`
`71`	`72`	`ManagedIdentityRequest request = new ManagedIdentityRequest(HttpMethod.Get, _endpoint);`
`72`	`73`
`@@ -75,6 +76,8 @@ protected override ManagedIdentityRequest CreateRequest(string resource)`
`75`	`76`	`request.QueryParameters["api-version"] = ServiceFabricMsiApiVersion;`
`76`	`77`	`request.QueryParameters["resource"] = resource;`
`77`	`78`
	`79`	`+ ApplyClaimsAndCapabilities(request, parameters);`
	`80`	`+`
`78`	`81`	`switch (_requestContext.ServiceBundle.Config.ManagedIdentityId.IdType)`
`79`	`82`	`{`
`80`	`83`	`case AppConfig.ManagedIdentityIdType.ClientId:`