Removing sensitive info logging

[Rodrigo Brandão (rodrigobr-msft)]

This pull request makes improvements to logging messages in the authentication and OAuth flow code. The main changes focus on removing sensitive information from logs and making the log messages more generic to enhance security and privacy.

Logging improvements:

• msal_auth.py: Updated the error log in acquire_token_on_behalf_of to remove the user assertion from the message, reducing potential exposure of sensitive data.

• _oauth_flow.py:

  • Changed the info log in get_user_token to avoid logging the entire token response, which may contain sensitive information.
  • Updated the debug log in continue_flow to no longer include the full TokenResponse object, further protecting sensitive details.

[Copilot]

Pull request overview

This pull request updates logging in the MSAL on-behalf-of token acquisition path and the hosting-core OAuth flow to avoid emitting potentially sensitive token contents into logs, improving security/privacy in the authentication pipeline.

Changes:

• Remove logging of full TokenResponse objects in the OAuth flow (get_user_token, continue_flow).
• Remove logging of the user_assertion value when MSAL OBO token acquisition fails.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/_oauth/_oauth_flow.py	Makes success logs more generic by not logging the full token response object.
libraries/microsoft-agents-authentication-msal/microsoft_agents/authentication/msal/msal_auth.py	Removes user_assertion from the OBO failure log message to prevent sensitive data exposure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.