MSI v1 token revocation specification #5137
Conversation
bgavrilMS
force-pushed
the
gladjohn-msi_v1
branch
from
c3a01d1 to
31af353
Compare
There was a problem hiding this comment.
Based on the original CAE design, the WithClientCapabilities is a per-app parameter in MSAL. That is one of the reason why xms_cc should not be used in the second last arrow in both diagrams, otherwise it would force SFRP to create new CCA instance per request, which would be too inefficient.
In the SF's MSIv1 token revocation design, their protocol accepts the claims parameter (signed off by eSTS architect), and it does not accept an xms_cc as a standalone parameter (which is not in original CAE protocol either). So, MSAL's ManagedIdentityApplication can simply relays the incoming WithClaims to SF.
I proposed suggestions on diagrams, accordingly.
You may also refer to this feature request for the same project.
Co-authored-by: Ray Luo <rayluo@microsoft.com>
* Create msiv1_token_revocation.md * Update MSI v1 token revocation documentation * Add manual testing guideline link for MSI v1 * 1 * Update docs * 2 * Update docs/msiv1_token_revocation.md Co-authored-by: Ray Luo <rayluo@microsoft.com> * Update token revocation documentation with new parameters * Update token revocation sequence diagram and explanation * Update mermaid diagram in token revocation doc * Remove redundant end statements in documentation * Update parameter name in MSAL API documentation * Update token revocation documentation --------- Co-authored-by: Bogdan Gavril <bogavril@microsoft.com> Co-authored-by: Ray Luo <rayluo@microsoft.com>
This pull request adds documentation for MSAL support for MSI v1 token revocation and capabilities. It introduces two optional parameters that developers can use to control token revocation and specify client capabilities when acquiring tokens via Managed Identity.
Key changes include:
docs/msiv1_token_revocation.md: Added detailed documentation describing thebypass_cacheandxms_ccparameters, their purposes, behaviors, and use cases.