docs: Guidance for higher-level SDKs to consume MSAL mTLS PoP - #933
docs: Guidance for higher-level SDKs to consume MSAL mTLS PoP#933Gladwin Johnson (gladjohn) wants to merge 2 commits into
Conversation
Explains how azure-identity and other SDKs can integrate with the MSI v2 mTLS Proof-of-Possession API. Covers: - Public API surface and return value contract - WindowsCertificate object (accurate property names) - Step-by-step integration pattern (credential -> transport) - SchannelSession usage (cert in constructor, not per-request) - No-fallback behavior matching MSAL .NET - End-user DX goal (zero mTLS awareness) - .NET comparison table - Minimum integration example - Future OpenSSL 3 CNG Provider path Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a new documentation page intended to guide higher-level Azure SDKs in consuming MSAL Python’s Managed Identity v2 mTLS Proof-of-Possession (PoP) integration pattern (credential → transport) and related return-value/typing contracts.
Changes:
- Introduces a new guidance document describing an mTLS PoP consumption model for higher-level SDKs.
- Provides sample code for credential integration, auth header construction, and SChannel-based transport usage.
- Documents intended API contracts (parameters, return keys, and key object types) for the integration.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Add prerequisite note: APIs come from PR #931, not yet on dev - Note this is standalone docs (not Sphinx-rendered) - Fix rstrip('/.default') -> removesuffix('/.default') - Fix AccessToken usage: store token_type on credential (not AccessToken) - Fix auth policy: read token_type from credential, not token object Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
From Azure SDK POV:
|
Summary
Adds a single documentation file explaining how higher-level SDKs (e.g., azure-identity, azure-sdk-for-python) can integrate with the MSI v2 mTLS Proof-of-Possession API.
This PR contains only documentation — no code changes.
Contents
WindowsCertificateobject properties and methods (accurate to implementation)SchannelSessionusage (certificate in constructor, not per-request)MtlsPopTokenNotSupportedinImdsV1)Related
GetManagedIdentityCapabilitiesAsync)