Skip to content

Fix override merging for app token (and others)#3644

Merged
bgavrilMS merged 3 commits into
AzureAD:masterfrom
christian-posta:ceposta-fix-requestapptoken
Feb 4, 2026
Merged

Fix override merging for app token (and others)#3644
bgavrilMS merged 3 commits into
AzureAD:masterfrom
christian-posta:ceposta-fix-requestapptoken

Conversation

@christian-posta

Copy link
Copy Markdown
Contributor

Fix override merging for app token

Description

Fix some missing override parameters including requestAppToken

Fixes #3643

@christian-posta christian-posta requested a review from a team as a code owner December 5, 2025 21:16

@bgavrilMS bgavrilMS left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would add a test that uses reflection to check that each property is copied.

@christian-posta

Copy link
Copy Markdown
Contributor Author

LMK if this is what you had in mind @bgavrilMS

@jmprieur jmprieur left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
Thanks @christian-posta for raising and fixing

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes missing override parameter merging in the DownstreamApiOptionsMerger class by adding support for several previously unhandled properties including RequestAppToken, HTTP-related properties (BaseUrl, HttpMethod, ContentType, AcceptHeader), and additional AcquireTokenOptions properties.

Key Changes:

  • Added merging logic for RequestAppToken to enable proper app token vs user delegation override control
  • Added merging support for HTTP configuration properties (BaseUrl, HttpMethod, ContentType, AcceptHeader)
  • Added merging support for additional token acquisition options (LongRunningWebApiSessionKey, PopPublicKey, CorrelationId, ManagedIdentity)

@bgavrilMS bgavrilMS force-pushed the ceposta-fix-requestapptoken branch from 93b33c5 to 5748d52 Compare December 11, 2025 13:04
@keegan-caruso

Copy link
Copy Markdown
Contributor

@christian-posta - Can you fix the failing unit test?

@bgavrilMS bgavrilMS force-pushed the ceposta-fix-requestapptoken branch from 5748d52 to f771de0 Compare February 4, 2026 13:23
@bgavrilMS

Copy link
Copy Markdown
Member

@christian-posta - I pushed a test fix to your branch. I hope this is ok. Your commits are still attributed to you of course.

@bgavrilMS bgavrilMS merged commit ce4adbc into AzureAD:master Feb 4, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RequestAppToken for sidecar is not respected

6 participants