Skip to content

Migrate OBO tests from old lab to ID4SLAB1 #6021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RyAuld wants to merge 5 commits into
base: main
Choose a base branch
from
+45 −36
Open

Migrate OBO tests from old lab to ID4SLAB1 #6021

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fa2a58a
Migrate OBO tests from old lab to ID4SLAB1
RyAuld May 21, 2026
69656d5
Remove unused _keyVault field from OBO test classes
RyAuld May 21, 2026
0e05c21
Merge branch 'main' into ryauld/migrate-obo-tests-to-lab1
RyAuld May 27, 2026
9907ff9
Remove unused MsalAppRegion and MsalAppAzureAdMultipleOrgs constants
RyAuld May 27, 2026
5e7a3bb
Merge branch 'main' into ryauld/migrate-obo-tests-to-lab1
RyAuld May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions src/client/Microsoft.Identity.Lab.Api/LabInfra/KeyVaultSecrets.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,10 +79,29 @@ public static class KeyVaultSecrets
/// </summary>
public const string MsalAppAzureAdMultipleOrgsRegional = "MSAL-APP-AzureADMultipleOrgsRegional-JSON";
Copy link
Copy Markdown
Member

@bgavrilMS bgavrilMS May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to have the terminlogy:

  • S2S
  • OBO client
  • OBO service

I don't see any reason for having more than 3 apps.

Copy link
Copy Markdown
Contributor Author

@RyAuld RyAuld May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved - only AppS2S, AppOBOClient, AppOBOService remain as the new constants/Apps

/// <summary>
/// Multiple orgs app in public cloud (id4slab1 tenant). Used for client credentials and regional token acquisition tests.
Copy link
Copy Markdown
Member

@bgavrilMS bgavrilMS May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use "multi-tenant" app term.

Copy link
Copy Markdown
Contributor Author

@RyAuld RyAuld May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved - that constant (MsalAppAzureAdMultipleOrgs) is now deleted

/// </summary>
public const string MsalAppAzureAdMultipleOrgs = "MSAL-APP-AzureADMultipleOrgs-JSON";
/// <summary>
/// Regional app in id4slab1 tenant with SN+I claims (xms_idrel, xms_ds_cnf). Used for regional ESTS token acquisition tests.
/// </summary>
public const string MsalAppRegion = "MSAL-App-Region-JSON";
Copy link
Copy Markdown
Member

@bgavrilMS bgavrilMS May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are too many apps. Existing apps should be regional enabled. Pls do a replace existing apps, not an add.

Copy link
Copy Markdown
Contributor Author

@RyAuld RyAuld May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved - removed MsalAppRegion and MsalAppAzureAdMultipleOrgs

/// <summary>
/// Represents the application identifier used for Arlington CCA test scenarios in the MSAL App Arlington CCA JSON configuration.
/// </summary>
public const string MsalAppArlingtonCCA = "MSAL-App-ArlingtonCCA-JSON";

/// <summary>
/// OBO service app (MSAL-APP-TodoListService) in ID4SLAB1 tenant. Used for On-Behalf-Of flow integration tests
/// with certificate-based authentication (LabAuth cert from msidlabs vault).
/// </summary>
public const string AppOBOService = "MSAL-APP-TodoListService-JSON";
/// <summary>
/// OBO public client app (MSAL-APP-TodoListClient) in ID4SLAB1 tenant. Used as the public client
/// that acquires user tokens for On-Behalf-Of flow integration tests.
/// </summary>
public const string AppOBOClient = "MSAL-APP-TodoListClient-JSON";

// Name of key vault secrets for app secrets and certificates
/// <summary>
/// default secret value used for testing application authentication scenarios that require a client secret. This secret is typically associated with a test application registered in Azure Active Directory and is used to validate authentication flows that involve client credentials or other secret-based authentication methods.
Expand Down
4 changes: 4 additions & 0 deletions src/client/Microsoft.Identity.Lab.Api/PublicAPI.Unshipped.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,18 @@ const Microsoft.Identity.Test.Common.TestCategories.UnifiedSchemaValidation = "U
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultInstance.MsalTeam = "https://id4skeyvault.vault.azure.net/" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultInstance.MSIDLab = "https://msidlabs.vault.azure.net" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppAdfsNativeClient = "App-AdfsNativeClient-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppOBOClient = "MSAL-APP-TodoListClient-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppOBOService = "MSAL-APP-TodoListService-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppPCAClient = "App-PCAClient-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppS2S = "App-S2S-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.AppWebApi = "App-WebApi-Config" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.ArlAppIdLabsApp = "MSAL-App-Arlington-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.B2CAppIdLabsAppB2C = "MSAL-App-B2C-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.DefaultAppSecret = "MSAL-App-Default" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.MsalAppArlingtonCCA = "MSAL-App-ArlingtonCCA-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.MsalAppAzureAdMultipleOrgs = "MSAL-APP-AzureADMultipleOrgs-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.MsalAppAzureAdMultipleOrgsRegional = "MSAL-APP-AzureADMultipleOrgsRegional-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.MsalAppRegion = "MSAL-App-Region-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.MsalAppCiam = "MSAL-App-CIAM-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.UserArlington = "MSAL-USER-Arlington-JSON" -> string
const Microsoft.Identity.Test.LabInfrastructure.KeyVaultSecrets.UserB2C = "MSAL-USER-B2C-JSON" -> string
Expand Down
27 changes: 14 additions & 13 deletions ...s/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/LongRunningOnBehalfOfTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

using System;
using System.Linq;
using System.Net;
using System.Security.Cryptography.X509Certificates;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Identity.Client;
Expand All @@ -22,18 +23,18 @@ public class LongRunningOnBehalfOfTests
{
private static readonly string[] s_scopes = { "User.Read" };

private string _confidentialClientSecret;
private X509Certificate2 _labAuthCert;

private readonly KeyVaultSecretsProvider _keyVault = new KeyVaultSecretsProvider(KeyVaultInstance.MsalTeam);
private readonly KeyVaultSecretsProvider _keyVaultMsidLab = new KeyVaultSecretsProvider(KeyVaultInstance.MSIDLab);

#region Test Hooks
[TestInitialize]
public void TestInitialize()
public async Task TestInitializeAsync()
{
ApplicationBase.ResetStateForTest();
if (string.IsNullOrEmpty(_confidentialClientSecret))
if (_labAuthCert is null)
{
_confidentialClientSecret = _keyVault.GetSecretByName(TestConstants.MsalOBOKeyVaultSecretName).Value;
_labAuthCert = await _keyVaultMsidLab.GetCertificateWithPrivateMaterialAsync("LabAuth").ConfigureAwait(false);
}
}

Expand All @@ -51,7 +52,7 @@ public async Task LongRunningAndNormalObo_WithDifferentKeys_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -106,7 +107,7 @@ public async Task LongRunningThenNormalObo_WithTheSameKey_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -182,7 +183,7 @@ public async Task InitiateLRWithCustomKey_ThenAcquireLRWithSameKey_Succeeds_Test
// Arrange
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

IPublicClientApplication pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -256,7 +257,7 @@ public async Task NormalOboThenLongRunningAcquire_WithTheSameKey_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -330,7 +331,7 @@ public async Task NormalOboThenLongRunningInitiate_WithTheSameKey_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -389,7 +390,7 @@ public async Task WithDifferentScopes_TestAsync()
{
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(app.AppId)
Expand Down Expand Up @@ -442,7 +443,7 @@ private ConfidentialClientApplication BuildCCA(string tenantId, string appId)
var builder = ConfidentialClientApplicationBuilder
.Create(appId)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{tenantId}"), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithLegacyCacheCompatibility(false);

return builder.BuildConcrete();
Expand Down
41 changes: 18 additions & 23 deletions tests/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/OnBehalfOfTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Security.Cryptography.X509Certificates;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Identity.Client;
Expand All @@ -24,24 +25,21 @@ namespace Microsoft.Identity.Test.Integration.HeadlessTests
public class OnBehalfOfTests
{
private static readonly string[] s_scopes = { "User.Read" };
//private static readonly string[] s_oboServiceScope = { "api://23c64cd8-21e4-41dd-9756-ab9e2c23f58c/access_as_user" };
//const string OboConfidentialClientID = "23c64cd8-21e4-41dd-9756-ab9e2c23f58c";

private static InMemoryTokenCache s_inMemoryTokenCache = new InMemoryTokenCache();
private string _confidentialClientSecret;
private X509Certificate2 _labAuthCert;

private readonly KeyVaultSecretsProvider _keyVault = new KeyVaultSecretsProvider(KeyVaultInstance.MsalTeam);
private readonly KeyVaultSecretsProvider _keyVaultMsidLab = new KeyVaultSecretsProvider(KeyVaultInstance.MSIDLab);

#region Test Hooks

[TestInitialize]
public void TestInitialize()
public async Task TestInitializeAsync()
{
ApplicationBase.ResetStateForTest();
if (string.IsNullOrEmpty(_confidentialClientSecret))
if (_labAuthCert is null)
{
_confidentialClientSecret = _keyVault.GetSecretByName(TestConstants.MsalOBOKeyVaultSecretName).Value;
_labAuthCert = await _keyVaultMsidLab.GetCertificateWithPrivateMaterialAsync("LabAuth").ConfigureAwait(false);
}
}

Expand All @@ -61,7 +59,7 @@ public async Task OboAndSilent_ReturnsCorrectTokens_TestAsync(bool serializeCach
var user1 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var user2 = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud2).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var partitionedInMemoryTokenCache = new InMemoryPartitionedTokenCache();
var nonPartitionedInMemoryTokenCache = new InMemoryTokenCache();
Expand Down Expand Up @@ -152,7 +150,7 @@ IConfidentialClientApplication CreateCCA()
var app = ConfidentialClientApplicationBuilder
.Create(appApi.AppId)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{user1AuthResult.TenantId}"), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithLegacyCacheCompatibility(false)
.Build();

Expand Down Expand Up @@ -182,7 +180,7 @@ public async Task OboAndClientCredentials_WithRegional_ReturnsCorrectTokens_Test
// Setup: Get lab user, create PCA and get user tokens
var user = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

// Use the correct public client ID from KeyVault for all tests
var publicClientId = app.AppId;
Expand Down Expand Up @@ -305,7 +303,7 @@ public async Task WithCache_TestAsync()
{
var user = await LabResponseHelper.GetUserConfigAsync(KeyVaultSecrets.UserPublicCloud).ConfigureAwait(false);
var app = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var factory = new HttpSnifferClientFactory();

Expand All @@ -325,7 +323,7 @@ public async Task WithCache_TestAsync()
var confidentialApp = ConfidentialClientApplicationBuilder
.Create(appApi.AppId)
.WithAuthority(new Uri("https://login.microsoftonline.com/" + authResult.TenantId), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithTestLogging()
.BuildConcrete();

Expand Down Expand Up @@ -378,7 +376,7 @@ public async Task WithCache_TestAsync()
var confidentialApp2 = ConfidentialClientApplicationBuilder
.Create(appApi.AppId)
.WithAuthority(new Uri("https://login.microsoftonline.com/" + authResult.TenantId), true)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.WithTestLogging()
.WithHttpClientFactory(factory)
.BuildConcrete();
Expand Down Expand Up @@ -438,7 +436,7 @@ private async Task<IConfidentialClientApplication> RunOnBehalfOfTestAsync(
multiTenantAppId = app.AppId;
}

var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
var appApi = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var pca = PublicClientApplicationBuilder
.Create(multiTenantAppId)
Expand Down Expand Up @@ -475,7 +473,7 @@ private async Task<IConfidentialClientApplication> RunOnBehalfOfTestAsync(
.Create(appApi.AppId)
.WithAuthority(new Uri("https://login.microsoftonline.com/" + authResult.TenantId), true)
.WithTestLogging(out HttpSnifferClientFactory factory)
.WithClientSecret(_confidentialClientSecret)
.WithCertificate(_labAuthCert)
.Build();
s_inMemoryTokenCache.Bind(cca.UserTokenCache);

Expand Down Expand Up @@ -522,20 +520,17 @@ void AssertExtraHttpHeadersAreSent(HttpSnifferClientFactory factory)

private async Task<ConfidentialClientApplication> BuildCcaAsync(string tenantId, bool withRegion = false)
{
var appConfig = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppS2S).ConfigureAwait(false);
var appApiConfig = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppWebApi).ConfigureAwait(false);
string secret = LabResponseHelper.FetchSecretString(appConfig.SecretName, LabResponseHelper.KeyVaultSecretsProviderMsal);
var appApiConfig = await LabResponseHelper.GetAppConfigAsync(KeyVaultSecrets.AppOBOService).ConfigureAwait(false);

var builder = ConfidentialClientApplicationBuilder
.Create(withRegion ? appApiConfig.AppId : appConfig.AppId)
.Create(appApiConfig.AppId)
.WithAuthority(new Uri($"https://login.microsoftonline.com/{tenantId}"), true)
.WithClientSecret(withRegion ? _confidentialClientSecret : secret)
.WithCertificate(_labAuthCert, true)
.WithLegacyCacheCompatibility(false);

if (withRegion)
{
builder
.WithAzureRegion(TestConstants.Region);
builder.WithAzureRegion(TestConstants.Region);
}

return builder.BuildConcrete();
Expand Down
Loading