Repository navigation

Complete mTLS E2E parity and combined transport integration - #976

Open

Robbie-Microsoft wants to merge 72 commits into

devfrom

robbie-microsoft-comprehensive-mtls-e2e-parity

Open

Complete mTLS E2E parity and combined transport integration#976
Robbie-Microsoft wants to merge 72 commits into
devfrom
robbie-microsoft-comprehensive-mtls-e2e-parity

Commits on Jul 7, 2026
- Add SNI certificate support over mTLS Proof-of-Possession
  
  Robbie-Microsoft
  and
  Copilot
  committed
  dd4f13a
Commits on Jul 8, 2026
- Use SN/I-allow-listed app for mTLS PoP e2e tests
  
  Robbie-Microsoft
  and
  Copilot
  committed
  81c3eb7
- Enumerate key-bound ATs on sign-out and account removal
  
  Robbie-Microsoft
  and
  Copilot
  committed
  224a003
- Fail closed on mTLS PoP token_type downgrade; honor verify; lock session build
  
  Robbie-Microsoft
  and
  Copilot
  committed
  02ccacb
- Isolate key/ext-bound ATs unconditionally; normalize verify=None
  
  Robbie-Microsoft
  and
  Copilot
  committed
  51adcec
- Address review comments on mTLS PoP cert/key handling
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ba697e8
- Add FIC two-leg exchange over mTLS Proof-of-Possession
  
  Robbie-Microsoft
  and
  Copilot
  committed
  01b676b
- Fail fast when a FIC leg-2 app is used with a non-mTLS flow
  
  Robbie-Microsoft
  and
  Copilot
  committed
  90d0e67
- Reject FIC leg-2 apps on silent flows too
  
  Robbie-Microsoft
  and
  Copilot
  committed
  acd78ed
Commits on Jul 30, 2026
- Harden mTLS PoP e2e: prove token at resource + naming matrix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b79166d
- Strengthen X509->Bearer e2e: assert cert binding is absent
  
  Robbie-Microsoft
  and
  Copilot
  committed
  aaf62c1
- Note _call_graph_with_mtls_pop_token is shared with FIC #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  fec7d7f
- Split mtls_pop/Bearer e2e by region (drop regional PoP cell)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b9233c6
- Merge SNI mTLS PoP hardening (#938) into FIC branch
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3ce5d96
- Merge origin/dev into sni-mtls-pop (resync #938 with base)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  4ec592f
- Merge resync'd #938 (origin/dev) into FIC branch #939
  
  Robbie-Microsoft
  and
  Copilot
  committed
  09e8fb5
Commits on Jul 31, 2026
- Add Bearer-over-mTLS: app-level flag + client-credentials path
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f98961f
- Route OBO/refresh/auth-code through Bearer-over-mTLS when flag is set
  
  Robbie-Microsoft
  and
  Copilot
  committed
  93faa2f
- Add Bearer-over-mTLS second-call cache-hit regression
  
  Robbie-Microsoft
  and
  Copilot
  committed
  bf79927
- Add Bearer-over-mTLS end-to-end cells
  
  Robbie-Microsoft
  and
  Copilot
  committed
  ab024e7
- Document the send_certificate_over_mtls client_credential flag
  
  Robbie-Microsoft
  and
  Copilot
  committed
  92421b0
- Harden Bearer-over-mTLS 2nd-call cache test with an env-lock assertion
  
  Robbie-Microsoft
  and
  Copilot
  committed
  60a9f24
Commits on Oct 9, 2026
- Merge origin/dev into sni-mtls-pop
  Robbie-Microsoft
  committed
  e226f92
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3b45837
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  c78bb15
Commits on Oct 21, 2026
- Address mTLS review feedback
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6e2c371
- Merge origin/dev into sni-mtls-pop
  
  Robbie-Microsoft
  and
  Copilot
  committed
  077f11f
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3c66b97
Commits on Oct 22, 2026
- Address FIC mTLS review feedback
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1e41f24
- Merge updated sni-mtls-pop foundation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6270370
- Fix Bearer-over-mTLS transport enforcement and PFX chains
  
  Robbie-Microsoft
  and
  Copilot
  committed
  a3ee807
- Address mTLS PoP review comments
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0424c53
- Add downstream mTLS binding context
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d3a120c
- Merge mTLS binding context foundation
  Robbie-Microsoft
  committed
  c39abc6
- Merge mTLS binding context foundation
  Robbie-Microsoft
  committed
  c467604
Commits on Oct 23, 2026
- Fix mTLS cache isolation and transport compatibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  9e35a33
- Merge remote-tracking branch 'origin/rginsburg/sni-mtls-pop' into rginsburg/sni-mtls-pop-fic
  Robbie-Microsoft
  committed
  cd043fe
- Align FIC Bearer and PoP result binding
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d2b9ab2
- Merge mTLS PoP foundation and align Bearer semantics
  
  Robbie-Microsoft
  and
  Copilot
  committed
  5818a5c
- Add certificate-aware mTLS HTTP client extensibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  28b0126
- Fix mTLS cache compatibility and transport review findings
  
  Robbie-Microsoft
  and
  Copilot
  committed
  e574edd
- Avoid cache persistence reentry and quadratic migration cleanup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6f34f2e
- Reject mixed-case raw mTLS token types before cache lookup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  2de965f
- Reject redirects in the owned mTLS token transport
  
  Robbie-Microsoft
  and
  Copilot
  committed
  dd07393
- Merge PR #938 into Bearer-over-mTLS follow-up
  
  Robbie-Microsoft
  and
  Copilot
  committed
  8d4ecec
- Merge PR #938 into FIC mTLS follow-up
  
  Robbie-Microsoft
  and
  Copilot
  committed
  8b703d7
- Merge PR #938 into certificate-aware HTTP extensibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0109a28
- Fix custom mTLS transport response handling and dependency validation
  
  Robbie-Microsoft
  and
  Copilot
  committed
  18bfd0d
- Fix Bearer-over-mTLS routing, certificate overrides and PFX compatibility
  
  Robbie-Microsoft
  and
  Copilot
  committed
  30281ce
- Address FIC mTLS review feedback
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b70842b
- Align Bearer-over-mTLS E2E failure and coverage semantics
  
  Robbie-Microsoft
  and
  Copilot
  committed
  820c96f
- Clarify default-only mTLS live E2E coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  3bc3505
- Align FIC E2E cells with shared SDK lab setup
  
  Robbie-Microsoft
  and
  Copilot
  committed
  84ff3e8
- Fail required certificate E2E scenarios on missing lab configuration
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1fceb2f
- Merge shared mTLS E2E fixture validation from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6c1a0a5
- Make required E2E fixture checks independent of release environment
  
  Robbie-Microsoft
  and
  Copilot
  committed
  751aa0b
- Merge required certificate E2E coverage from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  eeb27d0
- Fix certificate fixture regression when release tag is unset
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f67c680
- Merge shared fail-closed certificate E2E fixtures
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b241b3d
- Merge shared E2E fixture portability fix
  
  Robbie-Microsoft
  and
  Copilot
  committed
  063325c
- Merge final shared certificate E2E fixture correction from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  2ca4c85
- Merge final shared certificate E2E correction from #938
  
  Robbie-Microsoft
  and
  Copilot
  committed
  51cd6fd
- Merge approved SNI mTLS PoP head (#938)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  a821098
- Merge approved FIC mTLS PoP head (#939)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  87b62c2
- Merge approved Bearer-over-mTLS head (#947)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  b0cf453
- Merge approved custom mTLS HTTP head (#974)
  
  Robbie-Microsoft
  and
  Copilot
  committed
  d9f87b1
- Share certificate transport across mTLS flows
  
  Robbie-Microsoft
  and
  Copilot
  committed
  6b0694c
- Expand required live mTLS E2E parity coverage
  
  Robbie-Microsoft
  and
  Copilot
  committed
  f5435b4
- Keep mTLS sample diagnostics safe and pin fixture TLS
  
  Robbie-Microsoft
  and
  Copilot
  committed
  fea35cf
- Match live mTLS service representations and rejection codes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  7f98208
- Hide sensitive E2E helper arguments from failure tracebacks
  
  Robbie-Microsoft
  and
  Copilot
  committed
  1208c07
- Index access-token identities for bounded cache writes
  
  Robbie-Microsoft
  and
  Copilot
  committed
  0cd290d

Commits

Commits on Jul 7, 2026

Commits on Jul 8, 2026

Commits on Jul 30, 2026

Commits on Jul 31, 2026

Commits on Oct 9, 2026

Commits on Oct 21, 2026

Commits on Oct 22, 2026

Commits on Oct 23, 2026