1.22.0

New Features:

Microsoft Identity Web, as a proof of concept, supports certificate-less auth using Managed Service Identity (MSI). See issue #1585 for details.

Microsoft Identity Web now allows you set the request headers for the IDownstreamWebAPI. See issues #1063 and #891 for details.

Microsoft.Identity.Web.TokenCache exposes a boolean EnableAsyncL2Write as part of the MsalDistributedTokenCacheAdapterOptions, which enables you to do async writes (fire and forget) to the L2 cache. See issue #1047 and #1526 for details.

Bug Fixes:

When integrating with the MISE pipeline, client certificates are now taken into account when calling downstream APIs in controllers. See issue #1583 for details.

When using the L1/L2 cache, the L2 eviction is now based on the token expiration value from MSAL.NET, similar to what is done with the L1 eviction. See issue #1566 for details.

Compliance:

Add an SBOM generate to release builds. See issue #1546 for details.