Skip to content

Forward MSAL client metadata headers through IMDS to ESTS#902

Open
Copilot wants to merge 2 commits intodevfrom
copilot/add-client-metadata-headers
Open

Forward MSAL client metadata headers through IMDS to ESTS#902
Copilot wants to merge 2 commits intodevfrom
copilot/add-client-metadata-headers

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 13, 2026

IMDS cannot forward client telemetry to ESTS because MSAL Python never sends it. Adds three headers to IMDSv1 managed identity token requests, matching the .NET implementation (PR #5912).

Changes

  • msal/managed_identity.py: Added x-client-SKU, x-client-Ver, and x-ms-client-request-id headers to _obtain_token_on_azure_vm(). Uses x-ms-client-request-id (not client-request-id) as IMDS requires the x-ms- prefix.
headers={
    "Metadata": "true",
    "x-client-SKU": SKU,
    "x-client-Ver": __version__,
    "x-ms-client-request-id": str(uuid.uuid4()),
},
  • tests/test_mi.py: Updated three existing IMDS test assertions (test_happy_path_of_vm, test_happy_path_of_pod_identity, test_vm_resource_id_parameter_should_be_msi_res_id) to expect the new headers. SKU is validated against a hardcoded "MSAL.Python" constant; correlation ID is validated as a well-formed UUID.

Scoped to IMDS only — no changes to App Service, Arc, CloudShell, Machine Learning, or Service Fabric sources.

Add x-client-SKU, x-client-Ver, and x-ms-client-request-id headers to
_obtain_token_on_azure_vm() for IMDS token requests. Update existing
IMDS tests to assert the new headers and validate UUID correlation IDs.

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-python/sessions/3f0bb4c2-0e45-471e-9ab3-2a502ef8cddf

Co-authored-by: gladjohn <90415114+gladjohn@users.noreply.github.com>
Copilot AI requested review from Copilot and removed request for Copilot April 13, 2026 22:31
Copilot AI changed the title [WIP] Add support for forwarding MSAL client metadata headers Forward MSAL client metadata headers through IMDS to ESTS Apr 13, 2026
Copilot AI requested a review from gladjohn April 13, 2026 22:33
@gladjohn gladjohn marked this pull request as ready for review April 13, 2026 22:38
@gladjohn gladjohn requested a review from a team as a code owner April 13, 2026 22:38
Copilot AI review requested due to automatic review settings April 13, 2026 22:38
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds MSAL client metadata headers to IMDS (Azure VM / Pod Identity) token requests so IMDS can forward client telemetry to ESTS.

Changes:

  • Add x-client-SKU, x-client-Ver, and x-ms-client-request-id headers to IMDS managed identity token requests.
  • Update IMDS-related unit tests to assert the presence of these headers and validate the request-id as a UUID.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
msal/managed_identity.py Injects MSAL SKU/version and a per-request UUID into IMDS request headers.
tests/test_mi.py Updates IMDS tests to expect the new headers and validates the UUID format.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Engineering task] Support forwarding MSAL client metadata headers through IMDS (classic) to ESTS

3 participants