auth0-server-python 1.0.0b15__tar.gz → 1.0.0b16__tar.gz

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth0-server-python
-Version: 1.0.0b15
+Version: 1.0.0b16
 Summary: Auth0 server-side Python SDK
 License: MIT
 License-File: LICENSE
@@ -109,6 +109,29 @@ The key must be a PKCS8 PEM private key. Register its public key on your Auth0 a
 > [!IMPORTANT]
 > Private keys must not be committed to source control. Load them from a secure secret store or an environment-provided file.
 
+#### Authenticating with Mutual TLS (mTLS)
+
+The SDK supports mTLS client authentication (RFC 8705): the client presents a TLS certificate during the handshake instead of a client secret. Pass `use_mtls=True` and a caller-built `ssl.SSLContext` that already has the certificate loaded:
+
+```python
+import ssl
+
+ssl_context = ssl.create_default_context()
+ssl_context.load_cert_chain("client.crt", "client.key")
+
+auth0 = ServerClient(
+    domain="login.example.com",   # self_managed_certs custom domain
+    client_id="<AUTH0_CLIENT_ID>",
+    use_mtls=True,
+    ssl_context=ssl_context,
+    secret="<AUTH0_SECRET>",
+)
+```
+
+`use_mtls=True` requires an Enterprise tenant with the Highly Regulated Identity add-on, a `self_managed_certs` custom domain, and mTLS endpoint aliases enabled. It cannot be combined with `client_secret`, `client_assertion_signing_key`, or a per-call `dpop_key`. Each raises `ConfigurationError`. See the [Auth0 mTLS configuration docs](https://auth0.com/docs/get-started/applications/configure-mtls) for tenant-side setup steps.
+
+See [examples/MutualTLS.md](examples/MutualTLS.md) for the full setup guide, certificate generation, and token sender-constraining details.
+
 ### 3. Add login to your Application (interactive)
 
 Before using redirect-based login, ensure the `redirect_uri` is configured when initializing the SDK:

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/README.md

@@ -84,6 +84,29 @@ The key must be a PKCS8 PEM private key. Register its public key on your Auth0 a
 > [!IMPORTANT]
 > Private keys must not be committed to source control. Load them from a secure secret store or an environment-provided file.
 
+#### Authenticating with Mutual TLS (mTLS)
+
+The SDK supports mTLS client authentication (RFC 8705): the client presents a TLS certificate during the handshake instead of a client secret. Pass `use_mtls=True` and a caller-built `ssl.SSLContext` that already has the certificate loaded:
+
+```python
+import ssl
+
+ssl_context = ssl.create_default_context()
+ssl_context.load_cert_chain("client.crt", "client.key")
+
+auth0 = ServerClient(
+    domain="login.example.com",   # self_managed_certs custom domain
+    client_id="<AUTH0_CLIENT_ID>",
+    use_mtls=True,
+    ssl_context=ssl_context,
+    secret="<AUTH0_SECRET>",
+)
+```
+
+`use_mtls=True` requires an Enterprise tenant with the Highly Regulated Identity add-on, a `self_managed_certs` custom domain, and mTLS endpoint aliases enabled. It cannot be combined with `client_secret`, `client_assertion_signing_key`, or a per-call `dpop_key`. Each raises `ConfigurationError`. See the [Auth0 mTLS configuration docs](https://auth0.com/docs/get-started/applications/configure-mtls) for tenant-side setup steps.
+
+See [examples/MutualTLS.md](examples/MutualTLS.md) for the full setup guide, certificate generation, and token sender-constraining details.
+
 ### 3. Add login to your Application (interactive)
 
 Before using redirect-based login, ensure the `redirect_uri` is configured when initializing the SDK:

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "auth0-server-python"
-version = "1.0.0b15"
+version = "1.0.0b16"
 description = "Auth0 server-side Python SDK"
 readme = "README.md"
 authors = ["Auth0 <support@okta.com>"]

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/src/auth0_server_python/auth_server/mfa_client.py

@@ -4,6 +4,7 @@ Handles Multi-Factor Authentication operations against the Auth0 MFA API.
 """
 
 import json
+import ssl
 import time
 from collections.abc import Awaitable, Callable
 from typing import TYPE_CHECKING, Any, Optional, Union
@@ -74,6 +75,9 @@ class MfaClient:
         ] = None,
         mfa_token_ttl: int = DEFAULT_MFA_TOKEN_TTL,
         apply_client_authentication: Optional[Callable] = None,
+        use_mtls: bool = False,
+        ssl_context: Optional[ssl.SSLContext] = None,
+        token_endpoint_resolver: Optional[Callable[..., Awaitable[str]]] = None,
     ):
         if callable(domain):
             self._domain = None
@@ -92,10 +96,15 @@ class MfaClient:
             raise ConfigurationError("mfa_token_ttl must be a positive number of seconds")
         self._mfa_token_ttl = mfa_token_ttl
         self._apply_client_authentication = apply_client_authentication
+        self._use_mtls = use_mtls
+        self._ssl_context = ssl_context
+        self._token_endpoint_resolver = token_endpoint_resolver
 
     def _get_http_client(self, **kwargs) -> httpx.AsyncClient:
         """Return an httpx.AsyncClient with default headers injected."""
         headers = {**kwargs.pop("headers", {}), **self._headers}
+        if self._use_mtls and "verify" not in kwargs:
+            kwargs["verify"] = self._ssl_context
         return httpx.AsyncClient(headers=headers, **kwargs)
 
     def _apply_mfa_client_authentication(self, body: dict, base_url: str) -> None:
@@ -502,8 +511,16 @@ class MfaClient:
             MfaVerifyError: When verification fails, or when dpop_key was supplied
                 but the server returned an unbound (Bearer) token.
             MfaRequiredError: When chained MFA is required.
+            ConfigurationError: If dpop_key is combined with use_mtls. DPoP and mTLS
+                use incompatible token-binding mechanisms and cannot be used together.
             ConfigurationError: If neither client_secret nor client_assertion_signing_key is configured.
         """
+        if self._use_mtls and dpop_key is not None:
+            raise ConfigurationError(
+                "dpop_key cannot be combined with use_mtls. DPoP and mTLS bind tokens "
+                "differently. DPoP would take precedence and the token would not be "
+                "certificate-bound."
+            )
         mfa_token = options.get("mfa_token")
         if not mfa_token:
             raise MfaTokenInvalidError()
@@ -534,7 +551,10 @@ class MfaClient:
             )
 
         try:
-            token_endpoint = f"{base_url}/oauth/token"
+            if self._use_mtls and self._token_endpoint_resolver:
+                token_endpoint = await self._token_endpoint_resolver(store_options)
+            else:
+                token_endpoint = f"{base_url}/oauth/token"
 
             async with self._get_http_client() as client:
                 headers = {"Content-Type": "application/x-www-form-urlencoded"}

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/src/auth0_server_python/auth_server/my_account_client.py

@@ -1,4 +1,5 @@
 import json
+import ssl
 from typing import TYPE_CHECKING, Optional
 from urllib.parse import quote, unquote, urlparse
 
@@ -46,20 +47,31 @@ class MyAccountClient:
     Client for interacting with the Auth0 MyAccount API.
     """
 
-    def __init__(self, domain: str, headers: Optional[dict[str, str]] = None):
+    def __init__(
+        self,
+        domain: str,
+        headers: Optional[dict[str, str]] = None,
+        ssl_context: Optional[ssl.SSLContext] = None,
+    ):
         """
         Initialize the MyAccount API client.
 
         Args:
             domain: Auth0 domain (e.g., '<tenant>.<locality>.auth0.com')
             headers: Optional default headers to include on every request
+            ssl_context: Optional SSL context for mTLS. When provided, the client
+                certificate is presented on every request so the My Account API can
+                verify cnf.x5t#S256 binding on cert-bound access tokens.
         """
         self._domain = domain
         self._headers = headers or {}
+        self._ssl_context = ssl_context
 
     def _get_http_client(self, **kwargs) -> httpx.AsyncClient:
         """Return an httpx.AsyncClient with default headers injected."""
         headers = {**kwargs.pop("headers", {}), **self._headers}
+        if self._ssl_context is not None and "verify" not in kwargs:
+            kwargs["verify"] = self._ssl_context
         return httpx.AsyncClient(headers=headers, **kwargs)
 
     @property

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/src/auth0_server_python/auth_server/passwordless_client.py

@@ -209,7 +209,12 @@ class PasswordlessClient:
                 e,
             )
 
-        token_endpoint = metadata["token_endpoint"]
+        token_endpoint = client._resolve_token_endpoint(metadata)
+        if not token_endpoint:
+            raise PasswordlessVerifyError(
+                PasswordlessErrorCode.DISCOVERY_ERROR,
+                "Token endpoint missing in OIDC metadata",
+            )
         origin_issuer = metadata.get("issuer")
 
         default_scope = (
@@ -393,7 +398,7 @@ class PasswordlessClient:
         if not id_token:
             raise PasswordlessVerifyError(
                 PasswordlessErrorCode.VERIFY_FAILED,
-                "Token response did not include an ID token; ensure 'openid' scope is requested",
+                "Token response did not include an ID token. Ensure 'openid' scope is requested.",
             )
 
         jwks = await client._get_jwks_cached(origin_domain, metadata)

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/src/auth0_server_python/auth_server/server_client.py

@@ -5,6 +5,8 @@ Handles authentication flows, token management, and user sessions.
 
 import asyncio
 import json
+import logging
+import ssl
 import time
 from collections import OrderedDict
 from typing import TYPE_CHECKING, Any, Callable, Generic, Optional, TypeVar, Union
@@ -101,6 +103,8 @@ SESSION_TRANSFER_TOKEN_TYPE = "urn:auth0:params:oauth:token-type:session_transfe
 # actor_token_type URN when the actor is sourced from the agent session's ID token.
 ID_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id_token"
 
+logger = logging.getLogger(__name__)
+
 
 class ServerClient(Generic[TStoreOptions]):
     """
@@ -133,6 +137,8 @@ class ServerClient(Generic[TStoreOptions]):
         pushed_authorization_requests: bool = False,
         organization: Optional[str] = None,
         mfa_token_ttl: int = DEFAULT_MFA_TOKEN_TTL,
+        use_mtls: bool = False,
+        ssl_context: Optional[ssl.SSLContext] = None,
     ):
         """
         Initialize the Auth0 server client.
@@ -158,6 +164,12 @@ class ServerClient(Generic[TStoreOptions]):
                 `mfa.verify()`/`mfa.challenge_authenticator()` reject it as expired.
                 Defaults to 300 (5 minutes). Increase for authenticator flows that
                 need more time (e.g. OOB push approval on a slow connection).
+            use_mtls: Enable mTLS (RFC 8705) client authentication. When True, the
+                client certificate in ssl_context is the sole credential - no
+                client_secret or client_assertion is sent in the request body.
+            ssl_context: TLS context carrying the client certificate and key.
+                Required when use_mtls=True. Build with ssl.create_default_context()
+                and load_cert_chain().
 
         Raises:
             ConfigurationError: If `mfa_token_ttl` is not a positive number of seconds.
@@ -189,6 +201,25 @@ class ServerClient(Generic[TStoreOptions]):
             self._domain = domain_str
             self._domain_resolver = None
 
+        self._use_mtls = use_mtls
+        self._ssl_context = ssl_context
+        if use_mtls:
+            if ssl_context is None:
+                raise ConfigurationError(
+                    "ssl_context is required when use_mtls=True. Create an ssl.SSLContext "
+                    "and call load_cert_chain() to load the client certificate."
+                )
+            if client_secret:
+                raise ConfigurationError(
+                    "use_mtls cannot be combined with client_secret. The client "
+                    "certificate is the sole credential under mTLS."
+                )
+            if client_assertion_signing_key:
+                raise ConfigurationError(
+                    "use_mtls cannot be combined with client_assertion_signing_key. "
+                    "The client certificate is the sole credential under mTLS."
+                )
+
         self._client_id = client_id
         self._client_secret = client_secret
         self._client_assertion_signing_key = client_assertion_signing_key
@@ -218,10 +249,13 @@ class ServerClient(Generic[TStoreOptions]):
             client_id=client_id,
             client_secret=None if client_assertion_signing_key else client_secret,
             headers=self._telemetry_headers,
+            **({"verify": self._ssl_context} if self._use_mtls else {}),
         )
 
         self._my_account_client = MyAccountClient(
-            domain=domain, headers=self._telemetry_headers
+            domain=domain,
+            headers=self._telemetry_headers,
+            **({"ssl_context": self._ssl_context} if self._use_mtls else {}),
         )
 
         # Unified cache for OIDC metadata and JWKS per domain (LRU eviction + TTL)
@@ -241,6 +275,9 @@ class ServerClient(Generic[TStoreOptions]):
             session_establisher=self._establish_session_from_mfa_verify_response,
             mfa_token_ttl=mfa_token_ttl,
             apply_client_authentication=self._apply_client_authentication,
+            use_mtls=self._use_mtls,
+            ssl_context=self._ssl_context,
+            token_endpoint_resolver=self._resolve_mfa_token_endpoint if self._use_mtls else None,
         )
 
         self._passwordless_client = PasswordlessClient(self)
@@ -248,8 +285,56 @@ class ServerClient(Generic[TStoreOptions]):
     def _get_http_client(self, **kwargs) -> httpx.AsyncClient:
         """Return an httpx.AsyncClient with telemetry headers injected."""
         headers = {**kwargs.pop("headers", {}), **self._telemetry_headers}
+        if self._use_mtls and "verify" not in kwargs:
+            kwargs["verify"] = self._ssl_context
         return httpx.AsyncClient(headers=headers, **kwargs)
 
+    async def _resolve_mfa_token_endpoint(self, store_options) -> str:
+        """Resolve the token endpoint for MfaClient, applying the mTLS alias when enabled."""
+        domain = await self._resolve_current_domain(store_options)
+        metadata = await self._get_oidc_metadata_cached(domain)
+        return self._resolve_token_endpoint(metadata)
+
+    def _resolve_token_endpoint(self, metadata: dict) -> Optional[str]:
+        """Return the token endpoint, routed to the mTLS alias when mTLS is enabled.
+
+        Returns:
+            The token endpoint URL, or None if not present and mTLS is not enabled.
+
+        Raises:
+            ConfigurationError: If mTLS is enabled but the discovery document does not
+                advertise mtls_endpoint_aliases.token_endpoint.
+        """
+        if self._use_mtls:
+            aliases = metadata.get("mtls_endpoint_aliases") or {}
+            endpoint = aliases.get("token_endpoint")
+            if not endpoint:
+                raise ConfigurationError(
+                    "use_mtls is enabled but the authorization server discovery document "
+                    "does not advertise mtls_endpoint_aliases.token_endpoint. Ensure mTLS "
+                    "endpoint aliases are enabled on your Auth0 tenant."
+                )
+            return endpoint
+        return metadata.get("token_endpoint")
+
+    def _resolve_par_endpoint(self, metadata: dict) -> Optional[str]:
+        """Return the PAR endpoint, routed to the mTLS alias when mTLS is enabled.
+
+        Under mTLS, raises ConfigurationError immediately if the alias is absent.
+        Under standard auth, returns None if the endpoint is missing (caller's guard handles it).
+        """
+        if self._use_mtls:
+            aliases = metadata.get("mtls_endpoint_aliases") or {}
+            endpoint = aliases.get("pushed_authorization_request_endpoint")
+            if not endpoint:
+                raise ConfigurationError(
+                    "use_mtls is enabled but the authorization server discovery document "
+                    "does not advertise mtls_endpoint_aliases.pushed_authorization_request_endpoint. "
+                    "Ensure mTLS endpoint aliases are enabled on your Auth0 tenant."
+                )
+            return endpoint
+        return metadata.get("pushed_authorization_request_endpoint")
+
     def _apply_client_authentication(
         self, params: dict, issuer: str, in_body: bool = False
     ) -> Optional[tuple[str, str]]:
@@ -270,6 +355,11 @@ class ServerClient(Generic[TStoreOptions]):
         for reserved in ("client_secret", "client_assertion", "client_assertion_type"):
             params.pop(reserved, None)
 
+        if self._use_mtls:
+            # The client certificate presented in the TLS handshake is the sole
+            # credential. No body credential or HTTP basic auth is sent.
+            return None
+
         if self._client_assertion_signing_key:
             params["client_assertion"] = build_client_assertion(
                 self._client_assertion_signing_key,
@@ -537,6 +627,26 @@ class ServerClient(Generic[TStoreOptions]):
 
         return jwks
 
+    def _warn_if_not_cert_bound(self, token_response: dict) -> None:
+        """Warn if the access token lacks a cnf.x5t#S256 claim."""
+        access_token = token_response.get("access_token")
+        if not access_token:
+            return
+        try:
+            claims = jwt.decode(
+                access_token,
+                options={"verify_signature": False},
+            )
+        except jwt.InvalidTokenError:
+            return  # opaque or unparseable token - nothing to assert
+        cnf = claims.get("cnf") if isinstance(claims, dict) else None
+        if not (isinstance(cnf, dict) and cnf.get("x5t#S256")):
+            logger.warning(
+                "mTLS is enabled but the access token does not contain a cnf.x5t#S256 "
+                "claim. The token is not certificate-bound. Configure Token "
+                "Sender-Constraining (mTLS) on the API resource server."
+            )
+
     # ============================================================================
     # INTERACTIVE LOGIN FLOW
     # Handles browser-based authentication using the Authorization Code flow
@@ -638,8 +748,7 @@ class ServerClient(Generic[TStoreOptions]):
         self._oauth.metadata = metadata
         # If PAR is enabled, use the PAR endpoint
         if self._pushed_authorization_requests:
-            par_endpoint = self._oauth.metadata.get(
-                "pushed_authorization_request_endpoint")
+            par_endpoint = self._resolve_par_endpoint(self._oauth.metadata)
             if not par_endpoint:
                 raise ApiError(
                     "configuration_error", "PAR is enabled but pushed_authorization_request_endpoint is missing in metadata")
@@ -752,7 +861,9 @@ class ServerClient(Generic[TStoreOptions]):
         )
 
         try:
-            token_endpoint = self._oauth.metadata["token_endpoint"]
+            token_endpoint = self._resolve_token_endpoint(self._oauth.metadata)
+            if not token_endpoint:
+                raise ApiError("configuration_error", "Token endpoint missing in OIDC metadata")
             token_response = await self._oauth.fetch_token(
                 token_endpoint,
                 code=code,
@@ -765,6 +876,9 @@ class ServerClient(Generic[TStoreOptions]):
             raise ApiError(
                 "token_error", f"Token exchange failed: {str(e)}", e)
 
+        if self._use_mtls:
+            self._warn_if_not_cert_bound(token_response)
+
         # Use the userinfo field from the token_response for user claims
         user_info = token_response.get("userinfo")
         user_claims = None
@@ -773,8 +887,6 @@ class ServerClient(Generic[TStoreOptions]):
         # ID token `iat`, used to detect a ceiling that is already past at login.
         issued_at = None
         id_token = token_response.get("id_token")
-        # Verified ID token claims, retained so the session `sid` can be sourced
-        # from them (back-channel logout matches on `sid`).
         id_token_claims = None
 
         expected_org = transaction_data.organization
@@ -973,7 +1085,7 @@ class ServerClient(Generic[TStoreOptions]):
         id_token = token_response.get("id_token")
         if not id_token:
             raise MfaVerifyError(
-                "MFA verification response did not include an ID token; cannot create a session"
+                "MFA verification response did not include an ID token. Cannot create a session."
             )
 
         origin_domain = await self._resolve_current_domain(store_options)
@@ -1382,7 +1494,7 @@ class ServerClient(Generic[TStoreOptions]):
             # Fetch OIDC metadata from the correct domain
             metadata = await self._get_oidc_metadata_cached(domain)
 
-            token_endpoint = metadata.get("token_endpoint")
+            token_endpoint = self._resolve_token_endpoint(metadata)
             if not token_endpoint:
                 raise ApiError("configuration_error",
                                "Token endpoint missing in OIDC metadata")
@@ -1448,6 +1560,9 @@ class ServerClient(Generic[TStoreOptions]):
                     token_response["expires_at"] = int(
                         time.time()) + token_response["expires_in"]
 
+                if self._use_mtls:
+                    self._warn_if_not_cert_bound(token_response)
+
                 return token_response
 
         except Exception as e:
@@ -1792,7 +1907,7 @@ class ServerClient(Generic[TStoreOptions]):
             domain = await self._resolve_current_domain(store_options)
             metadata = await self._get_oidc_metadata_cached(domain)
 
-            token_endpoint = metadata.get("token_endpoint")
+            token_endpoint = self._resolve_token_endpoint(metadata)
             if not token_endpoint:
                 raise ApiError("configuration_error",
                                "Token endpoint missing in OIDC metadata")
@@ -2241,7 +2356,7 @@ class ServerClient(Generic[TStoreOptions]):
             # Fetch OIDC metadata from the correct domain
             metadata = await self._get_oidc_metadata_cached(domain)
 
-            token_endpoint = metadata.get("token_endpoint")
+            token_endpoint = self._resolve_token_endpoint(metadata)
             if not token_endpoint:
                 raise ApiError("configuration_error",
                                "Token endpoint missing in OIDC metadata")
@@ -2621,7 +2736,7 @@ class ServerClient(Generic[TStoreOptions]):
             domain = await self._resolve_current_domain(store_options)
             metadata = await self._get_oidc_metadata_cached(domain)
 
-            token_endpoint = metadata.get("token_endpoint")
+            token_endpoint = self._resolve_token_endpoint(metadata)
             if not token_endpoint:
                 raise ApiError("configuration_error", "Token endpoint missing in OIDC metadata")
 
@@ -3281,6 +3396,8 @@ class ServerClient(Generic[TStoreOptions]):
 
         Raises:
             MissingRequiredArgumentError: If auth_session or authn_response is missing.
+            ConfigurationError: If dpop_key is combined with use_mtls. DPoP and mTLS
+                use incompatible token-binding mechanisms and cannot be used together.
             PasskeyError: If token exchange or session creation fails.
             OrganizationTokenValidationError: If an organization was requested but the
                 token response included no ID token, or the ID token's org claim does
@@ -3290,12 +3407,18 @@ class ServerClient(Generic[TStoreOptions]):
             raise MissingRequiredArgumentError("auth_session")
         if authn_response is None:
             raise MissingRequiredArgumentError("authn_response")
+        if self._use_mtls and dpop_key is not None:
+            raise ConfigurationError(
+                "dpop_key cannot be combined with use_mtls. DPoP and mTLS bind tokens "
+                "differently. DPoP would take precedence and the token would not be "
+                "certificate-bound."
+            )
 
         try:
             domain = await self._resolve_current_domain(store_options)
             metadata = await self._get_oidc_metadata_cached(domain)
 
-            token_endpoint = metadata.get("token_endpoint")
+            token_endpoint = self._resolve_token_endpoint(metadata)
             if not token_endpoint:
                 raise PasskeyError(PasskeyErrorCode.TOKEN_EXCHANGE_FAILED, "Token endpoint missing in OIDC metadata")
 

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/src/auth0_server_python/tests/test_mfa_client.py

@@ -3,6 +3,7 @@ Tests for MfaClient — MFA API operations.
 """
 
 import json
+import ssl
 from unittest.mock import AsyncMock, MagicMock
 
 import pytest
@@ -1093,3 +1094,66 @@ class TestVerify:
         result = await client.verify({"mfa_token": _enc(), "otp": "123456"})
         assert result.token_type == "Bearer"
         assert "DPoP" not in captured_request["kwargs"]["headers"]
+
+
+# ============================================================================
+# mTLS - MfaClient SSLContext threading + DPoP exclusion + endpoint override
+# ============================================================================
+
+
+def _mtls_mfa_client() -> MfaClient:
+    return MfaClient(
+        domain=DOMAIN,
+        client_id=CLIENT_ID,
+        client_secret=None,
+        secret=SECRET,
+        use_mtls=True,
+        ssl_context=ssl.create_default_context(),
+    )
+
+
+@pytest.mark.asyncio
+async def test_mfa_get_http_client_passes_ssl_context(mocker):
+    mfa = _mtls_mfa_client()
+    spy = mocker.patch("auth0_server_python.auth_server.mfa_client.httpx.AsyncClient")
+    mfa._get_http_client()
+    _, kwargs = spy.call_args
+    assert kwargs.get("verify") is mfa._ssl_context
+
+
+@pytest.mark.asyncio
+async def test_mfa_verify_rejects_dpop_under_mtls():
+    mfa = _mtls_mfa_client()
+    with pytest.raises(ConfigurationError):
+        await mfa.verify({"mfa_token": _enc(), "otp": "123456"}, dpop_key=object())
+
+
+@pytest.mark.asyncio
+async def test_mfa_verify_uses_token_endpoint_resolver_under_mtls(mocker):
+    async def resolver(store_options):
+        return "https://mtls.auth0.local/oauth/token"
+
+    mfa = MfaClient(
+        domain=DOMAIN,
+        client_id=CLIENT_ID,
+        client_secret=None,
+        secret=SECRET,
+        use_mtls=True,
+        ssl_context=ssl.create_default_context(),
+        token_endpoint_resolver=resolver,
+    )
+    response = AsyncMock()
+    response.status_code = 200
+    response.json = MagicMock(return_value={
+        "access_token": "at", "token_type": "Bearer", "expires_in": 3600
+    })
+    captured = {}
+
+    async def mock_post(self_client, url, **kwargs):
+        captured["url"] = url
+        return response
+
+    mocker.patch("httpx.AsyncClient.post", new=mock_post)
+
+    await mfa.verify({"mfa_token": _enc(), "otp": "123456"})
+    assert captured["url"] == "https://mtls.auth0.local/oauth/token"

{auth0_server_python-1.0.0b15 → auth0_server_python-1.0.0b16}/src/auth0_server_python/tests/test_my_account_client.py

@@ -1,5 +1,6 @@
 import base64
 import json
+import ssl
 from unittest.mock import ANY, AsyncMock, MagicMock
 
 import httpx
@@ -1422,3 +1423,24 @@ def test_dpop_auth_flow_no_retry_on_non_401():
 
     assert not retried
 
+
+# =============================================================================
+# mTLS ssl_context wiring
+# =============================================================================
+
+
+def test_get_http_client_passes_ssl_context_when_set(mocker):
+    ctx = ssl.create_default_context()
+    client = MyAccountClient(domain="auth0.local", ssl_context=ctx)
+    spy = mocker.patch("auth0_server_python.auth_server.my_account_client.httpx.AsyncClient")
+    client._get_http_client()
+    _, kwargs = spy.call_args
+    assert kwargs.get("verify") is ctx
+
+
+def test_get_http_client_omits_verify_without_ssl_context(mocker):
+    client = MyAccountClient(domain="auth0.local")
+    spy = mocker.patch("auth0_server_python.auth_server.my_account_client.httpx.AsyncClient")
+    client._get_http_client()
+    _, kwargs = spy.call_args
+    assert "verify" not in kwargs