Feature/azuread fic

[mehighlow]

Azure AD (Entra ID) Federated Identity Credentials

Implements federated identity credentials so an external IdP’s OIDC-issued tokens can be trusted by a Microsoft Entra ID app. A common use case is an OIDC-enabled Kubernetes workload: the cluster issues a service account token and publishes OIDC metadata; the app registration is configured with a federated credential, allowing that token to authenticate without a client secret.

Links:
https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview
https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-create-trust
https://azure.github.io/azure-workload-identity/docs/topics/federated-identity-credential.html

[mehighlow]

docs PR python-social-auth/social-docs#393

[codecov]

Codecov Report

❌ Patch coverage is 93.10345% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.15%. Comparing base (0781adc) to head (7569463).
⚠️ Report is 4 commits behind head on master.

Files with missing lines	Patch %	Lines
social_core/backends/azuread.py	85.71%	3 Missing and 3 partials ⚠️
social_core/tests/backends/test_azuread.py	96.11%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1553      +/-   ##
==========================================
+ Coverage   78.98%   79.15%   +0.17%     
==========================================
  Files         354      354              
  Lines       11523    11666     +143     
  Branches      526      537      +11     
==========================================
+ Hits         9101     9234     +133     
- Misses       2241     2246       +5     
- Partials      181      186       +5     

Flag	Coverage Δ
unittests	79.15% <93.10%> (+0.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR implements support for Azure AD (Entra ID) Federated Identity Credentials, allowing applications to authenticate using OIDC tokens from external identity providers instead of client secrets. This is particularly useful for Kubernetes workloads using service account tokens.

Changes:

• Added client_assertion support to AzureAD OAuth2 backend as an alternative to client secrets
• Modified token request methods to use client assertions when secrets are not configured
• Added comprehensive test coverage for federated identity credential authentication flows

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
social_core/backends/azuread.py	Implements client assertion authentication logic with fallback to environment variables and file-based tokens
social_core/tests/backends/test_azuread.py	Adds test classes covering FIC authentication, assertion validation, and missing credentials scenarios

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nijel]

Merged, thanks for your contribution!

[mehighlow]

@nijel , I understand this feature alone might not be enough for a new release. When do you think it would be possible to get social-core 4.9.0?

[nijel]

Let's release it now, there are some SAML fixes I wanted to release anyway: #1566