Connections and AccessTokenProviderBase interface improvements - #484
Closed
Rodrigo Brandão (rodrigobr-msft) wants to merge 1 commit into
Closed
Connections and AccessTokenProviderBase interface improvements#484Rodrigo Brandão (rodrigobr-msft) wants to merge 1 commit into
Connections and AccessTokenProviderBase interface improvements#484Rodrigo Brandão (rodrigobr-msft) wants to merge 1 commit into
Conversation
Rodrigo Brandão (rodrigobr-msft)
linked an issue
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
July 21, 2026 21:11
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors the authentication/authorization core to standardize how token providers expose their configuration and to improve token-provider selection APIs. It introduces a unified configuration surface across providers and expands the Connections contract to allow selecting a provider directly from an Activity.
Changes:
- Introduces
AccessTokenProviderBase.configurationand implements it in MSAL and anonymous providers to enable provider-agnostic configuration access. - Adds
Connections.get_token_provider_from_activity(...)and implements it inConnectionManagerto support activity-based provider selection (including agentic flows). - Simplifies agentic token retrieval in
RestChannelServiceClientFactoryto useconnection.configurationdirectly.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/rest_channel_service_client_factory.py | Refactors agentic token retrieval to use the unified connection.configuration property. |
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/connections.py | Extends the Connections protocol with get_token_provider_from_activity(...). |
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/connection_manager.py | Implements activity-based token provider selection and alternate blueprint routing. |
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/anonymous_token_provider.py | Adds the configuration property for the anonymous provider. |
| libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/access_token_provider_base.py | Converts the base contract to an ABC and adds the abstract configuration property plus updated return type annotations. |
| libraries/microsoft-agents-authentication-msal/microsoft_agents/authentication/msal/msal_auth.py | Implements the configuration property for MSAL-backed providers. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+58
to
+59
| raise NotImplementedError( | ||
| ) |
Comment on lines
+11
to
+15
| @property | ||
| @abstractmethod | ||
| def configuration(self) -> AgentAuthConfiguration: | ||
| """ | ||
| The configuration for the access token provider. |
Comment on lines
+206
to
+213
| :param claims_identity: The claims identity of the bot. | ||
| :type claims_identity: :class:`microsoft_agents.hosting.core.ClaimsIdentity` | ||
| :param activity: The activity of the bot. | ||
| :type activity: dict | ||
| :return: The OAuth token provider for the agent. | ||
| :rtype: :class:`microsoft_agents.hosting.core.AccessTokenProviderBase` | ||
| :raises ValueError: If no connection is found for the given audience and service URL. | ||
| """ |
Comment on lines
+214
to
+230
| connection: AccessTokenProviderBase | None = None | ||
| try: | ||
| connection = self.get_token_provider(claims_identity, activity.service_url) | ||
| finally: | ||
| if (connection is not None and ( | ||
| activity.recipient.role == RoleTypes.agentic_identity or | ||
| activity.recipient.role == RoleTypes.agentic_user | ||
| )): | ||
| if connection.configuration.ALT_BLUEPRINT_ID: | ||
| connection = self.get_connection(connection.configuration.ALT_BLUEPRINT_ID) | ||
|
|
||
| if connection: | ||
| return connection | ||
|
|
||
| raise RuntimeError( | ||
| "The connection returned by get_token_provider is not compatible with the activity's recipient role." | ||
| ) |
Comment on lines
+198
to
+203
| def get_token_provider_from_activity( | ||
| self, | ||
| claims_identity: ClaimsIdentity, | ||
| activity: Activity | ||
| ) -> AccessTokenProviderBase: | ||
| """ |
Rodrigo Brandão (rodrigobr-msft)
deleted the
users/robrandao/get-token-provider
branch
July 31, 2026 22:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements and refactors to the authentication and authorization core, focusing on standardizing access to configuration, enhancing type safety, and improving the interface for retrieving access token providers. The most significant change is the addition of a unified
configurationproperty to all access token providers, enabling consistent and type-safe access to provider configuration. Additionally, the codebase now supports retrieving a token provider directly from an activity, and several type annotations and interface contracts have been clarified.Interface and API Improvements
configurationproperty toAccessTokenProviderBase, requiring all access token providers to expose their configuration in a consistent way.configurationproperty inMsalAuthandAnonymousTokenProvider, returning the provider's configuration (or a default/empty configuration for anonymous providers). [1] [2]Connectionsprotocol to require aget_token_provider_from_activitymethod, allowing retrieval of a token provider based on bothClaimsIdentityandActivity.Type and Annotation Enhancements
AccessTokenProviderBasefromOptional[str]tostr | Nonefor improved clarity and Python 3.10+ compatibility. [1] [2]Refactoring and Consistency
_get_agentic_tokeninrest_channel_service_client_factory.pyto use the newconfigurationproperty directly, removing legacy and provider-specific code paths.get_token_provider_from_activitymethod toconnection_manager.pyto select the appropriate token provider based on the recipient role and configuration, supporting alternate blueprint IDs.These changes collectively improve maintainability, type safety, and the extensibility of the authentication core.