GetTokenAcquirer cannot set SendX5C

[keegan-caruso]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.19.0

Web app

Not Applicable

Web API

Not Applicable

Token cache serialization

Not Applicable

Description

As a user of

microsoft-identity-web/src/Microsoft.Identity.Web.TokenAcquisition/DefaultTokenAcquirerFactoryImplementation.cs

Line 57 in 77df2a6

public ITokenAcquirer GetTokenAcquirer(IdentityApplicationOptions IdentityApplicationOptions)

I have no way to set SendX5C to true.

Reproduction steps

1. Try to use GetTokenAcquirer where sending the x5c header is required.

Error message

No response

Id Web logs

No response

Relevant code snippets

GetTokenAcquirer(myOptionsWithX5CAsTrue)

Regression

No response

Expected behavior

GetTokenAcquirer should support sending x5c

[bgavrilMS]

Is this a regression?

[bgavrilMS]

I don't think this is a regression as this never worked. Still, an important bug since SN/I is pretty much mandatory internally.

The problem is that Id.Web does not add X5C to the assertion, which is creates manually because this is how this protocol works.

Here's an example of how X5C should be added. Well, there is probably easier way to inject X5C than using JSON, but this is to show where it is needed.

[bgavrilMS]

I am taking this over as I have worked on this area before.

[jennyf19]

https://github.com/AzureAD/microsoft-identity-web/releases/tag/3.1.0