Skip to content

Migrate OBO tests from old lab to ID4SLAB1 #6021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RyAuld wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Migrate OBO tests from old lab to ID4SLAB1 #6021

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fa2a58a
Migrate OBO tests from old lab to ID4SLAB1
RyAuld May 21, 2026
69656d5
Remove unused _keyVault field from OBO test classes
RyAuld May 21, 2026
0e05c21
Merge branch 'main' into ryauld/migrate-obo-tests-to-lab1
RyAuld May 27, 2026
9907ff9
Remove unused MsalAppRegion and MsalAppAzureAdMultipleOrgs constants
RyAuld May 27, 2026
5e7a3bb
Merge branch 'main' into ryauld/migrate-obo-tests-to-lab1
RyAuld May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/client/Microsoft.Identity.Lab.Api/LabInfra/KeyVaultSecrets.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,17 @@ public static class KeyVaultSecrets
/// </summary>
public const string MsalAppArlingtonCCA = "MSAL-App-ArlingtonCCA-JSON";

/// <summary>
/// OBO service app (MSAL-APP-TodoListService) in ID4SLAB1 tenant. Used for On-Behalf-Of flow integration tests
/// with certificate-based authentication (LabAuth cert from msidlabs vault).
/// </summary>
public const string AppOBOService = "MSAL-APP-TodoListService-JSON";
/// <summary>
/// OBO public client app (MSAL-APP-TodoListClient) in ID4SLAB1 tenant. Used as the public client
/// that acquires user tokens for On-Behalf-Of flow integration tests.
/// </summary>
public const string AppOBOClient = "MSAL-APP-TodoListClient-JSON";

// Name of key vault secrets for app secrets and certificates
/// <summary>
/// default secret value used for testing application authentication scenarios that require a client secret. This secret is typically associated with a test application registered in Azure Active Directory and is used to validate authentication flows that involve client credentials or other secret-based authentication methods.
Expand Down
2 changes: 2 additions & 0 deletions src/client/Microsoft.Identity.Lab.Api/PublicAPI.Unshipped.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ const Microsoft.Identity.Test.Common.TestCategories.UnifiedSchemaValidation = "U
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultInstance.MsalTeam = "https://id4skeyvault.vault.azure.net/" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultInstance.MSIDLab = "https://msidlabs.vault.azure.net" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppAdfsNativeClient = "App-AdfsNativeClient-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppOBOClient = "MSAL-APP-TodoListClient-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppOBOService = "MSAL-APP-TodoListService-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppPCAClient = "App-PCAClient-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppS2S = "App-S2S-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppWebApi = "App-WebApi-Config" -> string
Expand Down
27 changes: 14 additions & 13 deletions ...s/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/LongRunningOnBehalfOfTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

using System;
using System.Linq;
using System.Net;
using System.Security.Cryptography.X509Certificates;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Identity.Client;
Expand All @@ -22,18 +23,18 @@ public class LongRunningOnBehalfOfTests
{
private static readonly string[] s_scopes = { "User.Read" };

private string _confidentialClientSecret;
private X509Certificate2 _labAuthCert;

private readonly KeyVaultSecretsProvider _keyVault = new KeyVaultSecretsProvider(KeyVaultInstance.MsalTeam);
private readonly KeyVaultSecretsProvider _keyVaultMsidLab = new KeyVaultSecretsProvider(KeyVaultInstance.MSIDLab);

#region Test Hooks
[TestInitialize]
public void TestInitialize()
public async Task TestInitializeAsync()
{
ApplicationBase.ResetStateForTest();
if (string.IsNullOrEmpty(_confidentialClientSecret))
if (_labAuthCert is null)
{
_confidentialClientSecret = _keyVault.GetSecretByName(TestConstants.MsalOBOKeyVaultSecretName).Value;
_labAuthCert = await _keyVaultMsidLab.GetCertificateWithPrivateMaterialAsync("LabAuth").ConfigureAwait(false);
}
}

Expand All @@ -51,7 +52,7 @@ public async Task LongRunningAndNormalObo_WithDifferentKeys_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -106,7 +107,7 @@ public async Task LongRunningThenNormalObo_WithTheSameKey_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -182,7 +183,7 @@ public async Task InitiateLRWithCustomKey_ThenAcquireLRWithSameKey_Succeeds_Test
// Arrange
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

IPublicClientApplication pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -256,7 +257,7 @@ public async Task NormalOboThenLongRunningAcquire_WithTheSameKey_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -330,7 +331,7 @@ public async Task NormalOboThenLongRunningInitiate_WithTheSameKey_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -389,7 +390,7 @@ public async Task WithDifferentScopes_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -442,7 +443,7 @@ private ConfidentialClientApplication BuildCCA(string tenantId, string appId)
var builder = ConfidentialClientApplicationBuilder
.Create(appId)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{tenantId}"), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithLegacyCacheCompatibility(false);

return builder.BuildConcrete();
Expand Down
41 changes: 18 additions & 23 deletions tests/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/OnBehalfOfTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Security.Cryptography.X509Certificates;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Identity.Client;
Expand All @@ -24,24 +25,21 @@ namespace Microsoft.Identity.Test.Integration.HeadlessTests
public class OnBehalfOfTests
{
private static readonly string[] s_scopes = { "User.Read" };
//private static readonly string[] s_oboServiceScope = { "api://23c64cd8-21e4-41dd-9756-ab9e2c23f58c/access_as_user" };
//const string OboConfidentialClientID = "23c64cd8-21e4-41dd-9756-ab9e2c23f58c";

private static InMemoryTokenCache s_inMemoryTokenCache = new InMemoryTokenCache();
private string _confidentialClientSecret;
private X509Certificate2 _labAuthCert;

private readonly KeyVaultSecretsProvider _keyVault = new KeyVaultSecretsProvider(KeyVaultInstance.MsalTeam);
private readonly KeyVaultSecretsProvider _keyVaultMsidLab = new KeyVaultSecretsProvider(KeyVaultInstance.MSIDLab);

#region Test Hooks

[TestInitialize]
public void TestInitialize()
public async Task TestInitializeAsync()
{
ApplicationBase.ResetStateForTest();
if (string.IsNullOrEmpty(_confidentialClientSecret))
if (_labAuthCert is null)
{
_confidentialClientSecret = _keyVault.GetSecretByName(TestConstants.MsalOBOKeyVaultSecretName).Value;
_labAuthCert = await _keyVaultMsidLab.GetCertificateWithPrivateMaterialAsync("LabAuth").ConfigureAwait(false);
}
}

Expand All @@ -61,7 +59,7 @@ public async Task OboAndSilent_ReturnsCorrectTokens_TestAsync(bool serializeCach
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var user2 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud2).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var partitionedInMemoryTokenCache = new InMemoryPartitionedTokenCache();
var nonPartitionedInMemoryTokenCache = new InMemoryTokenCache();
Expand Down Expand Up @@ -152,7 +150,7 @@ IConfidentialClientApplication CreateCCA()
var app = ConfidentialClientApplicationBuilder
.Create(appApi.AppId)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{user1AuthResult.TenantId}"), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithLegacyCacheCompatibility(false)
.Build();

Expand Down Expand Up @@ -182,7 +180,7 @@ public async Task OboAndClientCredentials_WithRegional_ReturnsCorrectTokens_Test
// Setup: Get lab user, create PCA and get user tokens
var user = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

// Use the correct public client ID from KeyVault for all tests
var publicClientId = app.AppId;
Expand Down Expand Up @@ -305,7 +303,7 @@ public async Task WithCache_TestAsync()
{
var user = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var factory = new HttpSnifferClientFactory();

Expand All @@ -325,7 +323,7 @@ public async Task WithCache_TestAsync()
var confidentialApp = ConfidentialClientApplicationBuilder
.Create(appApi.AppId)
.WithAuthority(new Uri("https://login.microsoftonline.com/" + authResult.TenantId), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithTestLogging()
.BuildConcrete();

Expand Down Expand Up @@ -378,7 +376,7 @@ public async Task WithCache_TestAsync()
var confidentialApp2 = ConfidentialClientApplicationBuilder
.Create(appApi.AppId)
.WithAuthority(new Uri("https://login.microsoftonline.com/" + authResult.TenantId), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithTestLogging()
.WithHttpClientFactory(factory)
.BuildConcrete();
Expand Down Expand Up @@ -438,7 +436,7 @@ private async Task<IConfidentialClientApplication> RunOnBehalfOfTestAsync(
multiTenantAppId = app.AppId;
}

var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(multiTenantAppId)
Expand Down Expand Up @@ -475,7 +473,7 @@ private async Task<IConfidentialClientApplication> RunOnBehalfOfTestAsync(
.Create(appApi.AppId)
.WithAuthority(new Uri("https://login.microsoftonline.com/" + authResult.TenantId), true)
.WithTestLogging(out HttpSnifferClientFactory factory)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.Build();
s_inMemoryTokenCache.Bind(cca.UserTokenCache);

Expand Down Expand Up @@ -522,20 +520,17 @@ void AssertExtraHttpHeadersAreSent(HttpSnifferClientFactory factory)

private async Task<ConfidentialClientApplication> BuildCcaAsync(string tenantId, bool withRegion = false)
{
var appConfig = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApiConfig = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
string secret = LabResponseHelper.FetchSecretString(appConfig.SecretName, LabResponseHelper.KeyVaultSecretsProviderMsal);
var appApiConfig = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var builder = ConfidentialClientApplicationBuilder
.Create(withRegion ? appApiConfig.AppId : appConfig.AppId)
.Create(appApiConfig.AppId)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{tenantId}"), true)
.WithClientSecret(withRegion ? _confidentialClientSecret : secret)
.WithCertificate(_labAuthCert, true)
.WithLegacyCacheCompatibility(false);

if (withRegion)
{
builder
.WithAzureRegion(TestConstants.Region);
builder.WithAzureRegion(TestConstants.Region);
}

return builder.BuildConcrete();
Expand Down
Loading