RequestAppToken for sidecar is not respected

[christian-posta]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

auth-sidecar:1.0.0-azurelinux3.0-distroless

Web app

Not Applicable

Web API

Protected web APIs (validating tokens)

Token cache serialization

In-memory caches

Description

From this page:

https://learn.microsoft.com/en-us/entra/msidweb/agent-id-sdk/endpoints

We should be able to override parameters from the sidecar.

curl -v "localhost:5000/AuthorizationHeaderUnauthenticated/graph?optionsOverride.RequestAppToken=true"

Currently this override is ignored. This is a bug.

Reproduction steps

curl -v "localhost:5000/AuthorizationHeaderUnauthenticated/graph?optionsOverride.RequestAppToken=true"

Will fail because it otherwise expects a user OBO scenario

Error message

No response

Id Web logs

No response

Relevant code snippets

NA

Regression

No response

Expected behavior

Get the appropriate app access token