Add client assertion authentication - #145
Conversation
| Description = "Specify the client Secret that should be used." | ||
| }; | ||
|
|
||
| ClientAssertionOption = new Option<string>("--clientAssertion", "-ca") |
There was a problem hiding this comment.
Could we get a --clientAssertion case in ReconfigureCommandUnitTests alongside the existing --clientSecret one? Good to have the new option covered end to end.
2f55cfa to
28257f6
Compare
left a comment
There was a problem hiding this comment.
This is a big improvement — thanks for taking it on. Storing just the flag, supporting both the variable and a file, checking the assertion branch before the certificate, and short-circuiting the retry loop all look right to me. Three small things left, then I think we're there.
left a comment
There was a problem hiding this comment.
Pull request overview
Adds client assertion authentication across the CLI and Store APIs, including environment/file-based assertion retrieval.
Changes:
- Adds client assertion configuration and CLI support.
- Adds MSAL client assertion authentication overloads.
- Adds assertion handling for packaged and unpackaged APIs.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
MSStore.CLI/Services/StoreAPIFactory.cs |
Selects assertion authentication. |
MSStore.CLI/Services/ICLIConfigurator.cs |
Extends configuration contract. |
MSStore.CLI/Services/EnvironmentInfo.cs |
Reads assertions from environment or file. |
MSStore.CLI/Services/Configurations.cs |
Persists authentication mode. |
MSStore.CLI/Services/CLIConfigurator.cs |
Configures and validates assertion authentication. |
MSStore.CLI/MicrosoftStoreCLI.cs |
Recognizes assertion-based configuration. |
MSStore.CLI/Commands/ReconfigureCommand.cs |
Adds the client assertion option. |
MSStore.API/SubmissionClient.cs |
Adds MSAL assertion token acquisition. |
MSStore.API/StoreAPI.cs |
Supports assertions for Store API access. |
MSStore.API/Packaged/StorePackagedAPI.cs |
Supports assertions for Dev Center access. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
left a comment
There was a problem hiding this comment.
This is in good shape now — thanks for sticking with it through the back and forth.
Worth saying what this ended up as, because it moved a long way from where it started: the assertion never touches disk, it's resolved fresh on each invocation from either MSSTORE_CLIENT_ASSERTION or MSSTORE_CLIENT_ASSERTION_FILE, a missing or unreadable token fails immediately with a message that names the variable instead of dropping into a prompt nobody can answer in CI, and the file path works for setups like AKS that project a rotating token. That's a genuinely better shape than what any of us sketched at the start.
The tests are a nice touch too — using a fixture with real leading and trailing whitespace is a more honest trim test than asserting on a string literal.
One unrelated thing I noticed while reading through: reconfigure clears the stored credential before it validates, so a failed switch from a secret to another auth mode can leave you with no secret and a config that still expects one. That's pre-existing and not caused by your change — the certificate path reaches it too — so I'll handle it separately.
Thanks again for the contribution and for your patience with the review.
commented
Sep 2, 2026
|
is there an example how to use? I guess somewhere the env variable MSSTORE_CLIENT_ASSERTION needs to be set in the action? |
Add support for MSAL Client Assertion authentication. Client Assertion authentication enables users to use GitHub Actions OpenID Connect, which is a more secure way to authenticate to Microsoft services without requiring client secrets.
The Client Assertion mechanism uses the
MSSTORE_CLIENT_ASSERTION/MSSTORE_CLIENT_ASSERTION_FILEenvironment variables, and is activated bymsstore reconfigure --clientAssertion.