Design Document: Mutual TLS (mTLS) Proof-of-Possession (PoP) Tokens Implementation

[gladjohn]

Mutual TLS (mTLS) Proof-of-Possession (PoP) Tokens Design Document

This pull request introduces a comprehensive design document for the implementation of mutual TLS (mTLS) Proof-of-Possession (PoP) tokens using Subject Name Issuer (SNI) certificates. The document outlines the security benefits, token flow, implementation details, and testing strategies for this feature.

Key Changes

Design and Implementation Details

• Added an overview of mTLS PoP tokens and their compliance with RFC 8705, including a diagram outlining the mTLS PoP flow.
• Detailed the certificate acquisition and token binding processes, explaining how tokens are bound to certificates used in mTLS connections.
• Introduced the new WithMtlsProofOfPossession() API at the CCA request level, specifying the required configurations and validations for certificates, authority types, and Azure regions.

Testing and Validation

• Provided a comprehensive list of tests to validate mTLS PoP tokens, including:
  • Certificate validation
  • Authority tests
  • Region validation
  • Token acquisition
  • Integration tests

Developer Guidance and Task List

• Included detailed developer guidance for implementing the WithMtlsProofOfPossession() feature.
• Created a task list for the public preview of SDK support for mTLS PoP tokens across different programming languages, including:
  • MSAL .NET
  • JAVA
  • NODE
  • PYTHON

By highlighting that the design is based on the MSAL .NET implementation, this description provides context for reviewers and collaborators, indicating that the document leverages existing work and insights from the .NET version of the Microsoft Authentication Library.

Reference Documentation

For more detailed information on Proof-of-Possession (PoP) tokens implementation in MSAL .NET, you can refer to the MSAL .NET Pull Request:

Proof-of-Possession (PoP) tokens in MSAL .NET

[trwalke]

Maybe you can add an example code snippet of what the app creation and token acquisition apis look like?

[trwalke]

I would maybe add a few more details to the image. Like, what is sent to ESTS to initialize this flow and acquire the token initially. What does ESTS return (what is special about the token). Things like that.

[trwalke]

Overall looks great @gladjohn