[POC] Use secure HTTP client factory and force certificate credential for token binding

[cpp11nullptr]

No description provided.

[bgavrilMS]

I don't understand the purpose of this class. It derives from IMsalMtlsHttpClientFactory and encapsulates an IMsalMtlsHttpClientFactory .

I think what you mean is for a class that dervices from IMsalMtlsHttpClientFactory but it should encapsulate System.Net.HttpIHttpClientFactory

[cpp11nullptr]

I consider it more like an adaptor because IMsalMtlsHttpClientFactory doesn't derive from IHttpClientFactory, which means that it this class needed need to implement what SecureHttpClientFactory does but we'd have a code duplication between MSAL.NET and Identity.Web in this case. I don't have strong opinion there though, so it's better to have encapsulated IHttpClientFactory rather than IMsalMtlsHttpClientFactory, is it correct?

[bgavrilMS]

I think the simplest for now is to intervene here:

microsoft-identity-web/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

Line 933 in a8b9273

.WithHttpClientFactory(_httpClientFactory)

- if mtls POP is used, don't add WithHttpClientFactory.

If you do want to inject HTTP transport, then you must provide an adapter between IHttpClientFactory and IMsalMtlsHttpClientFactory i.e.

public class Impl : IMsalMtlsHttpClientFactory 
{
  Impl(IHttpClientFactory aspFactory) { }
}

However, I am not sure how / if this ^^ adapter can be implemnted.

[cpp11nullptr]

I changed it to use IHttpClientFactory for non-mTLS HTTP clients with managing a pool of mTLS clients, which are created in place (due to a fact that its handler needs to be configured before an actual instance is created).

[bgavrilMS]

I think this works for a POC, but we probably need more abstraction here. Each credential may, or may not, be compatible with mTLS POP. In particular, I am thinking of the 2 FIC credentials.

CC @jmprieur @MZOLN