Skip to content

Add mTLS Bearer token design specification#5848

Open
gladjohn wants to merge 1 commit intomainfrom
gladjohn-sni-mtls-bearer
Open

Add mTLS Bearer token design specification#5848
gladjohn wants to merge 1 commit intomainfrom
gladjohn-sni-mtls-bearer

Conversation

@gladjohn
Copy link
Contributor

This PR adds app-level support for sending confidential client certificates over mTLS transport independently from token type.

Today, WithMtlsProofOfPossession() effectively drives both:

  • the token type (mTLS PoP)
  • the certificate transport path (mTLS)

That makes it hard to express the missing scenario:

  • mTLS transport + Bearer token

This change introduces a new certificate option:

new CertificateOptions
{
    SendCertificateOverMtls = true
}

This keeps token type and certificate transport as separate concerns:

  • SendCertificateOverMtls controls how the certificate is sent
  • WithMtlsProofOfPossession() continues to control whether the request asks for PoP

This PR adds app-level support for sending confidential client certificates over **mTLS transport** independently from token type.

Today, `WithMtlsProofOfPossession()` effectively drives both:
- the **token type** (`mTLS PoP`)
- the **certificate transport path** (mTLS)

That makes it hard to express the missing scenario:
- **mTLS transport + Bearer token**

This change introduces a new certificate option:

```csharp
new CertificateOptions
{
    SendCertificateOverMtls = true
}
```
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a design mini-spec documenting a proposed API/config change to decouple token type (Bearer vs mTLS PoP) from certificate transport (request-body assertion vs mTLS handshake) for confidential client certificates, enabling the “mTLS transport + Bearer token” scenario.

Changes:

  • Introduces a new proposed CertificateOptions.SendCertificateOverMtls flag (design-level) and defines its intended semantics.
  • Documents precedence rules between app-level defaults and request-level .WithMtlsProofOfPossession().
  • Adds a behavior matrix plus validation/implementation/testing notes for the new scenario.

You can also share your feedback on Copilot code review. Take the survey.

public bool AssociateTokensWithCertificate { get; init; } = false;

// New
public bool SendCertificateOverMtls { get; init; } = false;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to be a breaking change right? How do you plan to handle that?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the table below answers that question. Thanks

Copy link
Contributor

@neha-bhargava neha-bhargava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants