Add Claims and Capability Support to Managed Identity Flows

[gladjohn]

Add Claims and Capability Support to Managed Identity Flows

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (copilot generated)

This pull request introduces several updates to the Microsoft.Identity.Web library, focusing on enabling Continuous Access Evaluation (CAE) for Managed Identity, adding a new test-only interface for custom HTTP client factories, and enhancing token acquisition functionality. Additionally, it includes updates to the solution file and adds a new test application. Below is a summary of the most important changes:

Continuous Access Evaluation (CAE) for Managed Identity

• Added support for CAE by enabling the cp1 client capability in Managed Identity applications. This includes automatic handling of 401 responses with claims challenges, bypassing the token cache, and retrying the request with a fresh token. [1] [2] [3]
• Documented the CAE design, configuration, and usage in docs/design/managed_identity_capabilities_devex.md.

New Test-Only Interface for Custom HTTP Client Factories

• Introduced IManagedIdentityTestHttpClientFactory, an internal interface to allow unit tests to provide custom IMsalHttpClientFactory implementations.
• Registered the new interface in public API files across multiple target frameworks.

Enhancements to Token Acquisition

• Updated the TokenAcquisition class to support client capabilities and claims challenges during token acquisition for Managed Identity. [1] [2] [3]
• Added _miHttpFactory to inject custom HTTP client factories into Managed Identity applications. [1] [2]

Solution File Updates

• Added a new test application project, daemon-app-msi, to the solution file (Microsoft.Identity.Web.sln). This includes updates to the project list, build configurations, and project dependencies. [1] [2] [3]

New Test Application

• Added a new test application, daemon-app-msi, to demonstrate token acquisition for Managed Identity and interaction with a downstream API (e.g., Azure Key Vault).

Detail

Fixes #2759650

Fixes #3370

[jmprieur]

I'd like to understand first what you are doing and why.
In particular I'm not too keen in adding test features in product code

[gladjohn]

I'd like to understand first what you are doing and why. In particular I'm not too keen in adding test features in product code

@jmprieur this enables us to inject HttpClient into ManagedIdentityApplication, but now this uses DI for the mocks.

[jmprieur]

LGTM
once you have addressed at least the namespace.

[gladjohn]

Thanks @jmprieur @bgavrilMS @jennyf19, just needs one re-approval