Add in-process MAA token caching to PopKeyAttestor

[Robbie-Microsoft]

Summary

MAA (Microsoft Azure Attestation) tokens are acquired during mTLS binding certificate minting, requiring a native DLL call + network round-trip to the MAA endpoint. Since MAA tokens carry their
own JWT expiry and have a longer TTL than binding certs, they can safely be reused across cert re-mints.

This PR adds an in-memory cache for MAA tokens inside PopKeyAttestor to avoid redundant native DLL and network calls.

Key point: when the cert cache is warm, attestation is skipped entirely by the cert-reuse path. The MAA cache activates when the cert cache is cold (first boot, cert expiry, or explicit
eviction) — it ensures that if multiple cert re-mints happen before the MAA token expires, only the first one calls the attestation service.

Changes

PopKeyAttestor.cs

• Adds a static ConcurrentDictionary<string, AttestationToken> cache keyed by "{endpoint}|{keyId}"
  • endpoint — different MAA regional endpoints have different trust domains
  • keyId — CngKey.KeyName; ensures key rotation does not return a stale token for the new key
  • clientId intentionally omitted — MAA attests the CNG key, not the identity; SAMI and UAMI sharing the same key at the same endpoint correctly share the cached token
• Key handle validation (null, IsInvalid, SafeNCryptKeyHandle cast) always runs before the cache check
• Tokens within 5 minutes of expiry are evicted (matches AccessTokenExpirationBuffer); freshness check guards against DateTimeOffset.MinValue - buffer overflow
• Per-key single-flight via KeyedSemaphorePool prevents thundering-herd redundant attestation calls
• Cache hit/miss/store logged via ILoggerAdapter threaded from request context through AttestationTokenProvider delegate
• Static constructor registers ResetCacheForTest with ApplicationBase.RegisterResetCallback so ApplicationBase.ResetStateForTest() automatically clears the MAA cache

ApplicationBase.cs

• Adds RegisterResetCallback(Action) + ConcurrentBag<Action> s_resetCallbacks
• ResetStateForTest() invokes all registered callbacks after its own resets

AcquireTokenCommonParameters / AcquireTokenForManagedIdentityParameters

• AttestationTokenProvider delegate updated to include ILoggerAdapter and string keyId

ImdsV2ManagedIdentitySource.cs

• Extracts rsaCng.Key.KeyName and forwards it as keyId to the attestation delegate

ImdsV2Tests.cs

• [TestCleanup] calls PopKeyAttestor.ResetCacheForTest() (belt-and-suspenders alongside the ApplicationBase callback)
• Adds 6 new tests:
  • MaaTokenCache_Hit_DoesNotCallAttestationProviderAgain
  • MaaTokenCache_ExpiredToken_CallsAttestationProviderAgain
  • MaaTokenCache_DifferentEndpoints_CachedSeparately
  • MaaTokenCache_DifferentKeyIds_CachedSeparately — two different CNG keys at the same endpoint get separate cache entries (key rotation safety)
  • MaaTokenCache_ConcurrentCacheMiss_SingleFlightCallsProviderOnce
  • MaaTokenCache_CertCacheMiss_MaaTokenCacheStillFresh_DoesNotCallAttestationProviderAgain

Test results

81/81 ImdsV2Tests passing on .NET 4.8 and .NET 8, no regressions.

No public API changes

Caching is entirely internal to PopKeyAttestor. WithAttestationSupport() is unchanged.

[Copilot]

Pull request overview

This PR adds in-process caching of Microsoft Azure Attestation (MAA) tokens in PopKeyAttestor to avoid repeated native DLL calls and network round-trips during mTLS certificate minting, and introduces unit tests to validate cache behavior.

Changes:

• Added a static in-memory token cache keyed by {maaEndpoint}|{clientId} with an expiration buffer.
• Cached-token fast path now returns without requiring a key handle; cache-miss path performs key validation and attestation.
• Added/updated ImdsV2Tests to reset the cache and validate cache hit/expiry/separate endpoints behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ImdsV2Tests.cs	Adds cleanup to reset the new cache and introduces tests for cache hit/expiry/isolation by endpoint.
src/client/Microsoft.Identity.Client.KeyAttestation/PopKeyAttestor.cs	Implements token caching, cache lookup before native/network call, and test hooks to reset cache/change expiration buffer.

[gladjohn]

Thanks Robbie, looks good overall. Are we able to use any of the cache helper pattern from the cert cache here?

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

[Robbie-Microsoft]

Are we able to use any of the cache helper pattern from the cert cache here?

The cert cache uses a two-tier (in-memory + persistent) design with a full interface hierarchy (ICertificateCache, IMtlsCertificateCache, etc.) because certs need to survive process restarts and are encrypted at rest. The MAA token cache is intentionally simpler — in-memory only, with a ConcurrentDictionary + per-key semaphore for single-flight. Reusing the cert cache pattern would bring in persistence, encryption, and MtlsBindingCache orchestration that aren't warranted for a short-lived JWT. If the requirements change (e.g. persist across reboots), we can adopt that pattern then.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.