Open scottaddie opened 1 year ago
This is blocked on https://github.com/AzureAD/microsoft-authentication-library-for-go/issues/284 because it requires calling into WAM (related: #17388).
Is there any progress on this feature and is it being considered for support?
We still want to support this, however we rely on MSAL for Go for public client authentication and it doesn't support this yet:
MSAL for Go seems to already support pop https://github.com/AzureAD/microsoft-authentication-library-for-go/pull/443
That PR added a confidential client feature. This issue tracks SHR PoP for public clients, which requires brokered authentication (WAM on Windows). MSAL for Go doesn't support brokered authentication, so this issue is still blocked.
Intro: Proof of Possession is intended to ensure that the client that requests a token is the only client that can use the token. This is accomplished by the client generating a key pair and requesting that the public key be included in the issued access token. The client library then generates a wrapper token signing it with the private key that is only known to it.
Proposal: