Add FIC two-leg exchange over mTLS Proof-of-Possession (follow-up to #938)

[Robbie-Microsoft]

Summary

Follow-up to #938. Adds the optional two-leg Federated Identity Credential (FIC) exchange over mTLS PoP: the leg-2 confidential client presents the leg-1 (cert-bound mtls_pop) token as a jwt-pop client assertion over an mTLS connection bound by the same certificate, to obtain the final token.

Stacked on rginsburg/sni-mtls-pop (#938) — review/merge #938 first; GitHub auto-retargets this PR to dev once #938 merges.

Usage

# Leg 1: SN/I cert -> cert-bound mtls_pop token (see #938)
leg1 = leg1_app.acquire_token_for_client([exchange_scope], mtls_proof_of_possession=True)

# Leg 2: present the leg-1 token as a jwt-pop assertion over the same cert's mTLS connection
leg2_app = msal.ConfidentialClientApplication(
    client_id,
    authority="https://login.microsoftonline.com/<tenant-id>",
    client_credential={
        "client_assertion": leg1["access_token"],   # cert-bound leg-1 token
        "mtls_binding_certificate": {"private_key_pfx_path": "sni.pfx", "public_certificate": True},
    },
)
leg2 = leg2_app.acquire_token_for_client(scopes, mtls_proof_of_possession=True)

What changed (delta over #938)

• msal/oauth2cli/oauth2.py — jwt-pop client-assertion-type constant.
• msal/application.py — detect the mtls_binding_certificate credential sub-key (FIC leg 2); carry the leg-1 assertion as jwt-pop; route every leg-2 request over the mTLS endpoint (even a plain Bearer travels the cert-bound connection); reject a leg-2 app on non–client-credential / silent flows and reject a string assertion without a binding cert; FIC-aware error messages.
• Tests — FIC leg-2 (PoP + Bearer-over-mTLS) and the fail-fast cases in test_application.py; a self-skipping E2E case in test_e2e.py. Docstrings + docs/index.rst FIC bullet; fic_two_leg_over_mtls_pop() sample.

Full unit suite passes (base + FIC); no regressions.

[Copilot]

Pull request overview

Adds support for the optional two-leg Federated Identity Credential (FIC) token exchange over mTLS Proof-of-Possession, where a leg-1 mtls_pop token is presented as a jwt-pop client assertion over an mTLS connection bound to the same certificate to obtain the final token.

Changes:

• Introduces the jwt-pop client assertion type constant and uses it for FIC leg-2 requests.
• Extends ConfidentialClientApplication to detect client_credential["mtls_binding_certificate"] (FIC leg 2) and route leg-2 traffic over the mTLS token endpoint (including implicit Bearer-over-mTLS).
• Adds unit/E2E coverage, docs, and a gated sample for the two-leg flow.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
msal/oauth2cli/oauth2.py	Adds jwt-pop client assertion type constant for OAuth2 client assertions.
msal/application.py	Implements FIC leg-2 detection and mTLS routing; sets client_assertion_type to jwt-pop for leg-2.
tests/test_application.py	Adds unit tests validating jwt-pop assertion type and Bearer-over-mTLS behavior for FIC leg-2.
tests/test_e2e.py	Adds an E2E test for the two-leg FIC exchange over mTLS PoP (self-skipping when not configured).
docs/index.rst	Documents the FIC leg-2 mtls_binding_certificate configuration and jwt-pop behavior.
sample/confidential_client_mtls_pop_sample.py	Adds a gated sample function demonstrating the two-leg FIC flow over mTLS PoP.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

msal/application.py:892

• The new FIC leg-2 configuration requires passing a leg-1 access token as a string client_assertion, but the constructor currently emits a DeprecationWarning for any static string/bytes client_assertion. This makes the documented/expected FIC usage noisy (and can fail callers running with warnings-as-errors). Consider suppressing this warning when mtls_binding_certificate is present (FIC leg 2).

        # Warn if using a static string/bytes client_assertion (discouraged for long-running apps)
        if isinstance(client_credential, dict) and isinstance(
                client_credential.get("client_assertion"), (str, bytes)):
            warnings.warn(
                "Passing a static string/bytes 'client_assertion' is "