Bump Microsoft.Identity.Client from 4.84.1 to 4.87.0

[dependabot]

Updated Microsoft.Identity.Client from 4.84.1 to 4.87.0.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.87.0

What's Changed

• Expose MsalServiceException.ErrorCodesForLogging for diagnostics in #​6138
• Expose WithOtelTagsEnricher for managed identity requests in #​6144
• Forward OpenTelemetry tags enricher to the client-assertion callback in #​6142
• Add client-side opaque-token log scrubber in #​6119
• Populate ExecutionResult.Exception for non-MSAL failures in #​6139
• Use PSS padding in KeyGuard liveness probe (CodeQL SM03799) in #​6141
• Remove managed identity support from WithClaimsFromClient (confidential-client only) in #​6113
• Remove experimental features from client setup in #​6143
• Update Azure Arc managed identity API version from 2019-11-01 to 2020-06-01 in #​6130

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.86.1...4.87.0

4.86.1

Bug Fixes

• Fixed the mTLS Proof-of-Possession token cache to key on the certificate's full DER (x5t#S256) instead of only the public key, preventing a stale token (and AADSTS500181) after a same-key certificate renewal. #​6123
• Fell back to RS256 when a certificate's PSS signing operation is rejected by RSACryptoServiceProvider, rebuilding the client assertion so authentication can proceed. #​6126
• Detect and reject symbolic links in the Unix cache-file write path (lstat pre-check plus O_NOFOLLOW), closing a TOCTOU window. #​6115
• Corrected misleading "region required" error messages and doc comments in the mTLS PoP flow. #​6127

4.86.0

What's Changed

• Propagate KeyGuard attestation failures and bridge native MAA logs to the MSAL logger by @​gladjohn in Propagate KeyGuard attestation failures and bridge native MAA logs to the MSAL logger AzureAD/microsoft-authentication-library-for-dotnet#6081
• Token Binding Demo Helper by @​gladjohn in Token Binding Demo Helper AzureAD/microsoft-authentication-library-for-dotnet#6097
• Include ManagedIdentitySource in managed identity error messages and request-failure logs by @​Robbie-Microsoft in Include ManagedIdentitySource in managed identity error messages and request-failure logs AzureAD/microsoft-authentication-library-for-dotnet#6101
• Remove Mooncake (AzureChinaCloud) lab client from WAM dev apps by @​RyAuld in Remove Mooncake (AzureChinaCloud) lab client from WAM dev apps AzureAD/microsoft-authentication-library-for-dotnet#6103
• Surface token-acquisition failure metadata on MsalException by @​neha-bhargava in Surface token-acquisition failure metadata on MsalException AzureAD/microsoft-authentication-library-for-dotnet#6096
• Skip IMDS lookup for explicit regions by @​4gust in Skip IMDS lookup for explicit regions AzureAD/microsoft-authentication-library-for-dotnet#6092
• Fix region failure-metadata test broken by explicit-region IMDS skip by @​neha-bhargava in Fix region failure-metadata test broken by explicit-region IMDS skip AzureAD/microsoft-authentication-library-for-dotnet#6105

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.2...4.86.0

4.85.2

What's Changed

• Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) by @​Robbie-Microsoft in Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) AzureAD/microsoft-authentication-library-for-dotnet#6070
• Enforce mTLS PoP minimum binding strength for Managed Identity (#​6049 Phase 2) by @​Robbie-Microsoft in Enforce mTLS PoP minimum binding strength for Managed Identity (#6049 Phase 2) AzureAD/microsoft-authentication-library-for-dotnet#6059
• Add refresh token cache partitioning support by @​iNinja in Add refresh token cache partitioning support AzureAD/microsoft-authentication-library-for-dotnet#6077
• Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) by @​Robbie-Microsoft in Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) AzureAD/microsoft-authentication-library-for-dotnet#6089

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.1...4.85.2

4.85.1

What's Changed

• Migrate OBO tests from old lab to ID4SLAB1 by @​RyAuld in Migrate OBO tests from old lab to ID4SLAB1 AzureAD/microsoft-authentication-library-for-dotnet#6021
• Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade by @​neha-bhargava in Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade AzureAD/microsoft-authentication-library-for-dotnet#6084
• Expose canonical tag names per-metric by @​ssmelov in Expose canonical tag names per-metric AzureAD/microsoft-authentication-library-for-dotnet#6076

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.0...4.85.1

4.85.0

What's Changed

• Fix proactive token refresh bypassing cancellation, leading to unbounded semaphore wait by @​jayesh-a-shah in Fix proactive token refresh bypassing cancellation, leading to unbounded semaphore wait AzureAD/microsoft-authentication-library-for-dotnet#6054
• Add GovFr, GovDe, GovSg to AzureCloudInstance enum by @​bgavrilMS in Add GovFr, GovDe, GovSg to AzureCloudInstance enum AzureAD/microsoft-authentication-library-for-dotnet#6023
• Take home account from request, if not available elsewhere. by @​yowl in Take home account from request, if not available elsewhere. AzureAD/microsoft-authentication-library-for-dotnet#5657
• Validate Azure region format to prevent region poisoning (fixes #​6060) by @​Robbie-Microsoft in Validate Azure region format to prevent region poisoning (fixes #6060) AzureAD/microsoft-authentication-library-for-dotnet#6061
• Promote MsalServiceException.SubError to public by @​neha-bhargava in Promote MsalServiceException.SubError to public AzureAD/microsoft-authentication-library-for-dotnet#6063
• Migrate region discovery to IMDS /compute JSON endpoint (#​6039) by @​Robbie-Microsoft in Migrate region discovery to IMDS /compute JSON endpoint (#6039) AzureAD/microsoft-authentication-library-for-dotnet#6057
• fix: Service Fabric MI sends principalId for ObjectId; reject ClientId/ResourceId (mirror of #​6066) by @​neha-bhargava in fix: Service Fabric MI sends principalId for ObjectId; reject ClientId/ResourceId (mirror of #6066) AzureAD/microsoft-authentication-library-for-dotnet#6069
• Exclude caller SDK telemetry from access token cache keys by @​bgavrilMS in Exclude caller SDK telemetry from access token cache keys AzureAD/microsoft-authentication-library-for-dotnet#6074
• Add MSAL.NET telemetry enrichment by @​ssmelov in Add MSAL.NET telemetry enrichment AzureAD/microsoft-authentication-library-for-dotnet#6071

New Contributors

• @​jayesh-a-shah made their first contribution in Fix proactive token refresh bypassing cancellation, leading to unbounded semaphore wait AzureAD/microsoft-authentication-library-for-dotnet#6054
• @​yowl made their first contribution in Take home account from request, if not available elsewhere. AzureAD/microsoft-authentication-library-for-dotnet#5657

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.84.2...4.85.0

4.84.2

New Features

• Added ManagedIdentityApplication.GetManagedIdentityCapabilitiesAsync(CancellationToken) returning a ManagedIdentityCapabilities object that reports the detected managed identity Source, the host's MaxSupportedBindingStrength (new MtlsBindingStrength enum: None, Software, KeyGuard), and a derived IsMtlsPopSupportedByHost. Replaces GetManagedIdentitySourceAsync()/ManagedIdentitySourceResult. The public ManagedIdentitySource.ImdsV2 value is folded into Imds (v1/v2 routing remains internal). #​6049
• Added OID-based user identification to the User Federated Identity Credential (user_fic) flow via AcquireTokenByUserFederatedIdentityCredential(scopes, Guid userObjectId, assertion). #​6050
• Added WithClaimsFromClient(claimsJson) to forward client-originated claims across managed identity and confidential client flows. #​5999
• Added mTLS PoP support for WithCertificate(() => x509) (dynamic certificate credential). #​5957
• Added opt-in token-acquisition metrics covering both successful and failed attempts. #​6004

Changes

• Extended mTLS bearer transport (CertificateOptions.SendCertificateOverMtls) to the OBO, refresh-token, and authorization-code flows. #​6009
• General Availability of the Microsoft.Identity.Client.KeyAttestation package. #​6038
• Managed identity now probes IMDSv2 first and the preview latch was removed. #​6041
• Updated NativeInterop baseline and corrected devapp version ranges. #​6045
• Simplified GetTenantedAuthority in CiamAuthority and DstsAuthority. #​6001

Bug Fixes

• Fixed WithExtraQueryParameters on ManagedIdentityApplicationBuilder bypassing token caching. #​6035
• Guarded HTTP status codes on discovery endpoints in KnownInstanceMetadataIsUpToDateAsync. #​6048
• Detect orphaned KeyGuard certificates via public-key modulus comparison. #​6020

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.