Skip to content
This repository was archived by the owner on Sep 22, 2023. It is now read-only.

Conversation

@faix
Copy link

@faix faix commented Jun 6, 2023

Confidential clients should use regional ests-r

@faix

This comment was marked as resolved.

[Parameter(Mandatory = $false, ParameterSetName = 'ConfidentialClientClaims', ValueFromPipelineByPropertyName = $true)]
[Parameter(Mandatory = $false, ParameterSetName = 'ConfidentialClientAssertion', ValueFromPipelineByPropertyName = $true)]
[Parameter(Mandatory = $false, ParameterSetName = 'ConfidentialClient-InputObject', ValueFromPipelineByPropertyName = $true)]
[string] $AzureRegion = [Microsoft.Identity.Client.ConfidentialClientApplication]::AttemptRegionDiscovery
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be a parameter of type string? ESTS-R SHOULD most certainly not be enabled by default.

Note that for ESTS-R to work you need Certificate with SN/I, via the "sendX5C" param. Is this exposed?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The parameter was of type string. Here i was simply setting it to the TryAutoDetect const that the library provides. The SendX5C parameter is exposed yes

Copy link
Member

@bgavrilMS bgavrilMS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need update to latest MSAL + other comments

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants