[FEATURE REQ] DefaultAzureCredential should send x5c claim for app authentication

[trevorlacey-msft]

Library name

Azure.Identity

Please describe the feature.

DefaultAzureCredential covers many basic authentication scenarios, including application ID + certificate. However, if the application is configured to use subject name + issuer certificate validation (as opposed to thumbprint validation), DefaultAzureCredential fails because the certificate's x5c claim is never sent to AAD when generating an auth token. Given the increasing number of applications using SNI authentication for automatic certificate rollover support, this scenario should be supported by DefaultAzureCredential.

Proposal
Modify DefaultAzureCredentialOptions to support the option to send certificate x5c claim by adding a EnvironmentCredentialSendCertificateChain bool property.

Details
When AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_CERTIFICATE_PATH environment variables are set, DefaultAzureCredential creates an EnvironmentCredential which creates a ClientCertificateCredential which creates an MsalConfidentialClient which uses MSAL to conditionally send the x5c claim here. This condition is controlled by ClientCertificateCredentialOptions.SendCertificateChain property.

1. Add DefaultAzureCredentialOptions.EnvironmentCredentialSendCertificateChain property
2. Define a new EnvironmentCredentialOptions class with a SendCertificateChain property
3. Plumb option from DefaultAzureCredentialOptions to ClientCertificateCredentialOptions

Alternative Proposal
Enable ClientCertificateCredentialOptions.SendCertificateChain by default when EnvironmentCredential creates a ClientCertificateCredential.

Reference
Support for SNI was added in PR 14636

[trevorlacey-msft]

I'd be happy to submit a PR myself if either of these design proposals are acceptable.

[jsquire]

Thank you for your feedback. Tagging and routing to the team members best able to assist.

[trevorlacey-msft]

Feature completed with PR.