Auth configuration logging with redaction for sensitive values - #444
Closed
Rodrigo Brandão (rodrigobr-msft) wants to merge 8 commits into
Closed
Auth configuration logging with redaction for sensitive values#444Rodrigo Brandão (rodrigobr-msft) wants to merge 8 commits into
Rodrigo Brandão (rodrigobr-msft) wants to merge 8 commits into
Conversation
Rodrigo Brandão (rodrigobr-msft)
linked an issue
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
July 7, 2026 17:04
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves authentication/configuration logging by introducing redaction utilities for MSAL auth configuration, tightening CONNECTIONSMAP typing/defaults, and reducing noisy debug logging in samples and core app initialization.
Changes:
- Add MSAL redaction/logging helpers and integrate them into
MsalConnectionManagerinitialization logging. - Make
CONNECTIONSMAPconsistently default to a list and add runtime type validation inMsalConnectionManager. - Minor config-handling adjustments in OAuth authorization plus cleanup of sample/core debug logging; add tests for the new redaction helpers.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/authentication_msal/test_utils.py | Adds tests validating redaction behavior for strings, URLs, and scopes. |
| test_samples/app_style/empty_agent.py | Removes redundant logging setup from a sample. |
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/app/oauth/authorization.py | Adjusts handler config defaults when building OAuth auth handlers. |
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/app/agent_application.py | Removes debug logging during AgentApplication initialization and drops an unused import. |
| libraries/microsoft-agents-authentication-msal/microsoft_agents/authentication/msal/msal_connection_manager.py | Adds config logging + stricter CONNECTIONSMAP default/type checks. |
| libraries/microsoft-agents-authentication-msal/microsoft_agents/authentication/msal/_utils.py | Introduces redaction + safe config summarization/logging helpers. |
| libraries/microsoft-agents-activity/microsoft_agents/activity/config/_load_configuration.py | Changes default CONNECTIONSMAP return type to an empty list. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
July 17, 2026 16:47
View session
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
July 17, 2026 16:51
View session
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
July 17, 2026 16:56
View session
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
July 17, 2026 17:09
View session
Comment on lines
63
to
67
| raw_connections_map = ( | ||
| connections_map | ||
| if connections_map is not None | ||
| else kwargs.get("CONNECTIONSMAP", []) | ||
| ) |
Comment on lines
+99
to
+100
| _log_config(logger, self._config_map, self._connections_map) | ||
|
|
Comment on lines
+73
to
+77
| try: | ||
| url_parsed = urlparse(url) | ||
| return f"{url_parsed.scheme}://{url_parsed.netloc}/..." | ||
| except Exception: | ||
| return "..." |
Comment on lines
+154
to
+163
| """ | ||
| Log the configuration of the MSAL connection manager. | ||
|
|
||
| :arg logger: The logger to use for logging. | ||
| :type logger: :class:`logging.Logger` | ||
| :arg connections_map: A list of connection mappings. | ||
| :type connections_map: list[dict[str, str]] | ||
| :arg config_map: A dictionary of connection configurations. | ||
| :type config_map: dict[str, :class:`microsoft_agents.hosting.core.AgentAuthConfiguration`] | ||
| """ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements and fixes across configuration loading, authentication, and logging utilities, with a focus on better handling of sensitive information and more robust type checks. The most important changes are summarized below.
Authentication and Logging Utilities
_utils.pymodule inmicrosoft_agents.authentication.msalcontaining helper functions for redacting sensitive information (strings, URLs, scopes) and for logging summarized authentication configuration in a safe way. This includes_redact_str,_redact_url,_redact_scopes, and_log_configfunctions.MsalConnectionManager, ensuring that authentication configurations and connection maps are logged in a redacted and summarized format during initialization. [1] [2] [3]Configuration and Type Handling
CONNECTIONSMAPfield in both the configuration loader andMsalConnectionManager, ensuring it is always a list (not a dict), and raising aValueErrorif the type is incorrect. [1] [2]auth_typeargument defaults to an empty string instead ofNone.Testing and Miscellaneous
AgentApplicationinitialization and a redundant logging setup from theempty_agent.pytest sample. [1] [2]agent_application.py.These changes collectively improve the security, reliability, and maintainability of configuration and authentication handling in the codebase.