Implement SendX5C flag for certificate authentication

[Seáic Mac Murchadha (seaic-mac-murchadha)]

Resolves #348 by implementing CertificateSubjectName authentication support.

Issue:
CertificateSubjectName is already defined in AuthTypes, but was not handled by MsalAuth.

Solution:

• Validate that CERT_PFX_FILE is provided when using CertificateSubjectName
• Configure the MSAL client credential with public_certificate=True
• Add tests for configuration validation and MSAL credential creation

Corresponding tests were implemented in:

• tests/hosting_core/test_auth_configuration.py
• tests/authentication_msal/test_msal_auth.py

Full test suite passed:
3573 passed, 417 skipped, 0 failed in 57.26s

[Copilot]

🟢 Approval recommended

The implementation and validation are consistent with the stated requirements and include focused automated tests for the newly supported auth type.

Pull request overview

Adds full support for the existing AuthTypes.certificate_subject_name mode by validating configuration and wiring the correct MSAL client_credential options so Certificate Subject Name authentication behaves as expected in MsalAuth.

Changes:

• Extend AgentAuthConfiguration validation to require CERT_PFX_FILE for certificate_subject_name auth.
• Update MsalAuth._create_client_application() to pass public_certificate=True for certificate_subject_name credentials.
• Add targeted tests covering both configuration validation and MSAL credential creation for the new auth type.

File summaries

File	Description
tests/hosting_core/test_auth_configuration.py	Adds validation test cases ensuring CERT_PFX_FILE is required/accepted for certificate_subject_name.
tests/authentication_msal/test_msal_auth.py	Adds an MSAL client creation test asserting public_certificate=True is set for certificate_subject_name.
libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/agent_auth_configuration.py	Updates config validation logic to include certificate_subject_name in the certificate PFX requirement.
libraries/microsoft-agents-authentication-msal/microsoft_agents/authentication/msal/msal_auth.py	Implements MSAL credential construction for certificate_subject_name using PFX path + public_certificate=True.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Seáic Mac Murchadha (seaic-mac-murchadha)]

@microsoft-github-policy-service agree

[Rodrigo Brandão (rodrigobr-msft)]

This is good, but I believe this code implements the behavior for a SendX5C flag rather than the CertificateSubjectName auth type.

[Seáic Mac Murchadha (seaic-mac-murchadha)]

Thanks Rodrigo Brandão (@rodrigobr-msft),

For CertificateSubjectName, should I implement it in the same way as .NET, by resolving a certificate using the configured subject name?

[Rodrigo Brandão (rodrigobr-msft)]

Thanks Rodrigo Brandão (Rodrigo Brandão (@rodrigobr-msft)),

For CertificateSubjectName, should I implement it in the same way as .NET, by resolving a certificate using the configured subject name?

Yes, and like in the .NET implementation, that would introduce a new configuration setting CertificateSubjectName. That being said, if you were to modify this PR to simply add a new SendX5C flag to AgentAuthConfiguration and set the public_certificate to True conditionally on that flag, then that would be a good reuse of your current work.

[Copilot]

🟡 Changes recommended

CertificateSubjectName remains unsupported in MSAL creation, with required validation and test coverage incomplete.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/agent_auth_configuration.py:160

• Validation still ignores AuthTypes.certificate_subject_name: _validate() only checks AuthTypes.certificate (agent_auth_configuration.py:240-243). A subject-name configuration with no CERT_PFX_FILE therefore succeeds instead of raising the required configuration error. Include both certificate enum values in the PFX check.

        self.SEND_X5C = coerce_bool(
            send_x5c if send_x5c is not None else kwargs.get("SENDX5C", False),
            default=False,
            name="SENDX5C",
        )

tests/authentication_msal/test_msal_auth.py:293

• These tests exercise AuthTypes.certificate, not AuthTypes.certificate_subject_name, so they pass while the auth type named in the PR remains unimplemented. Add a subject-name case covering missing CERT_PFX_FILE and the MSAL credential's public_certificate=True setting.

    def test_create_client_application_send_x5c(self, mocker):
        config = AgentAuthConfiguration(
            auth_type=AuthTypes.certificate,
            tenant_id="12345678-1234-1234-1234-123456789abc",
            client_id="test-client-id",
            cert_pfx_file="test-cert.pfx",
            send_x5c=True,

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Seáic Mac Murchadha (seaic-mac-murchadha)]

Thanks Rodrigo Brandão (@rodrigobr-msft), I’ve updated this PR to add the new SendX5C flag. I’ll follow up with a separate PR for CertificateSubjectName.

[Copilot]

🟡 Changes recommended

A critical backward-compatibility issue changes positional constructor argument binding and must be fixed before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Rodrigo Brandão (rodrigobr-msft)]

Thanks for the contribution!

[Copilot]

🔵 Needs a closer look

Align the PR description and acceptance criteria with the implemented authentication behavior.

Review details

Suppressed comments (1)

libraries/microsoft-agents-authentication-msal/microsoft_agents/authentication/msal/msal_auth.py:310

• The PR description still says this change resolves #348 by implementing CertificateSubjectName, but this branch only handles AuthTypes.certificate; AuthTypes.certificate_subject_name still reaches the unsupported-auth path. Since the stated scope is now the SendX5C flag, please update the description/remove that issue resolution, or add the subject-name handling so the acceptance criteria match the implementation.

                if self._msal_configuration.SEND_X5C:
                    client_credential["public_certificate"] = True

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite