@microsoft/agents-hosting 1.6.0-beta.8.g226709c215 → 1.6.1

package/src/auth/jwt-middleware.ts

@@ -21,7 +21,7 @@ const logger = debug('agents:jwt-middleware')
 export function buildJwksUri (iss: string, authConfig: AuthConfiguration): string {
   return iss === 'https://api.botframework.com'
     ? 'https://login.botframework.com/v1/.well-known/keys'
-    : `${resolveAuthority(authConfig.authority, authConfig.tenantId)}/discovery/v2.0/keys`
+    : `${resolveAuthority(authConfig.authorityEndpoint ?? authConfig.authority, authConfig.tenantId)}/discovery/v2.0/keys`
 }
 
 /**

package/src/auth/msalConnectionManager.ts

@@ -5,7 +5,7 @@
 
 import { Activity, RoleTypes } from '@microsoft/agents-activity'
 import { debug } from '@microsoft/agents-telemetry'
-import { AuthConfiguration, resolveAuthority } from './authConfiguration'
+import { AuthConfiguration, AuthType, resolveAuthority } from './authConfiguration'
 import { Connections } from './connections'
 import { MsalTokenProvider } from './msalTokenProvider'
 import { JwtPayload } from 'jsonwebtoken'
@@ -44,13 +44,16 @@ export class MsalConnectionManager implements Connections {
 
     for (const [name, provider] of this._connections.entries()) {
       const cfg = provider.connectionSettings
-      const authType = cfg?.certPemFile
-        ? 'certificate'
-        : cfg?.clientSecret
-          ? 'clientSecret'
-          : cfg?.WIDAssertionFile || cfg?.FICClientId
-            ? 'workloadIdentity'
-            : 'none'
+      const authType = cfg?.authType ??
+        (cfg?.certPemFile
+          ? AuthType.Certificate
+          : cfg?.clientSecret
+            ? AuthType.ClientSecret
+            : cfg?.WIDAssertionFile
+              ? AuthType.WorkloadIdentity
+              : cfg?.federatedClientId || cfg?.FICClientId
+                ? AuthType.FederatedCredentials
+                : 'none')
       logger.debug('connection "%s" clientId=%s tenantId=%s authType=%s', name, cfg?.clientId ?? '<none>', cfg?.tenantId ?? '<none>', authType)
     }
 
@@ -185,13 +188,27 @@ export class MsalConnectionManager implements Connections {
 
   private applyConnectionDefaults (conn: MsalTokenProvider): MsalTokenProvider {
     if (conn.connectionSettings) {
-      conn.connectionSettings.authority ??= 'https://login.microsoftonline.com'
+      conn.connectionSettings.authorityEndpoint ??= conn.connectionSettings.authority || 'https://login.microsoftonline.com'
+      conn.connectionSettings.authority ??= conn.connectionSettings.authorityEndpoint
       conn.connectionSettings.issuers ??= [
         'https://api.botframework.com',
         `${resolveAuthority('https://sts.windows.net', conn.connectionSettings.tenantId)}/`,
-        `${resolveAuthority(conn.connectionSettings.authority, conn.connectionSettings.tenantId)}/v2.0`
+        `${resolveAuthority(conn.connectionSettings.authorityEndpoint, conn.connectionSettings.tenantId)}/v2.0`
       ]
+      // For backward compatibility
+      if (conn.connectionSettings.federatedClientId) {
+        conn.connectionSettings.FICClientId = conn.connectionSettings.federatedClientId
+      }
+
+      if (conn.connectionSettings.scopes?.length) {
+        conn.connectionSettings.scope = conn.connectionSettings.scopes?.[0]
+      }
+
+      if (conn.connectionSettings.authorityEndpoint) {
+        conn.connectionSettings.authority = conn.connectionSettings.authorityEndpoint
+      }
     }
+
     return conn
   }
 }

package/src/auth/msalTokenProvider.ts

@@ -4,20 +4,30 @@
  */
 
 import { ConfidentialClientApplication, LogLevel, ManagedIdentityApplication, NodeSystemOptions } from '@azure/msal-node'
-import axios from 'axios'
-import { AuthConfiguration, resolveAuthority as resolveAuthorityUtil } from './authConfiguration'
+import { AuthConfiguration, AuthType, resolveAuthority as resolveAuthorityUtil } from './authConfiguration'
 import { AuthProvider } from './authProvider'
 import { debug, trace } from '@microsoft/agents-telemetry'
-import { v4 } from 'uuid'
+import { randomUUID } from 'crypto'
 import { MemoryCache } from './MemoryCache'
 import jwt from 'jsonwebtoken'
 
 import fs from 'fs'
 import crypto from 'crypto'
 import { AuthenticationTraceDefinitions } from '../observability'
+import { ExceptionHelper } from '@microsoft/agents-activity'
+import { Errors } from '../errorHelper'
 
 const audience = 'api://AzureADTokenExchange'
 const logger = debug('agents:msal')
+const agenticTokenRequestTimeoutMs = 30000
+
+function isAbortError (error: unknown): error is Error {
+  return error instanceof Error && error.name === 'AbortError'
+}
+
+function createTokenRequestTimeoutError (timeoutMs: number): Error {
+  return ExceptionHelper.generateException(Error, Errors.TokenRequestTimeout, undefined, { timeoutMs: timeoutMs.toString() })
+}
 
 /**
  * Provides tokens using MSAL.
@@ -70,34 +80,77 @@ export class MsalTokenProvider implements AuthProvider {
       }
 
       let token
-      if (authConfig.WIDAssertionFile !== undefined) {
-        record({ method: 'wid' })
-        logger.debug('getAccessToken via WID clientId=%s scope=%s', authConfig.clientId, actualScope)
+      if (authConfig.authType) {
+        record({ method: authConfig.authType })
+        logger.debug(`getAccessToken via ${authConfig.authType} clientId=${authConfig.clientId} scope=${actualScope}`)
+        switch (authConfig.authType) {
+          case AuthType.WorkloadIdentity: {
+            const tokenFilePath = authConfig.federatedTokenFile ?? authConfig.WIDAssertionFile
+            if (!tokenFilePath) {
+              throw ExceptionHelper.generateException(Error, Errors.WorkloadIdentityTokenFileRequired)
+            }
+            token = await this.acquireAccessTokenViaWID(authConfig, actualScope)
+            break
+          }
+          case AuthType.FederatedCredentials:
+            if (!authConfig.federatedClientId && !authConfig.FICClientId) {
+              throw ExceptionHelper.generateException(Error, Errors.FICClientIdRequired)
+            }
+            token = await this.acquireAccessTokenViaFIC(authConfig, actualScope)
+            break
+          case AuthType.ClientSecret:
+            if (!authConfig.clientSecret) {
+              throw ExceptionHelper.generateException(Error, Errors.ClientSecretRequired)
+            }
+            token = await this.acquireAccessTokenViaSecret(authConfig, actualScope)
+            break
+          case AuthType.Certificate:
+          case AuthType.CertificateSubjectName:
+            if (!authConfig.certPemFile || !authConfig.certKeyFile) {
+              throw ExceptionHelper.generateException(Error, Errors.CertificateFilesRequired)
+            }
+            token = await this.acquireTokenWithCertificate(authConfig, actualScope)
+            break
+          case AuthType.UserManagedIdentity:
+            if (!authConfig.clientId) {
+              throw ExceptionHelper.generateException(Error, Errors.ClientIdRequiredForUserManagedIdentity)
+            }
+            token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope)
+            break
+          case AuthType.SystemManagedIdentity:
+            token = await this.acquireTokenWithSystemAssignedIdentity(authConfig, actualScope)
+            break
+          default:
+            throw ExceptionHelper.generateException(Error, Errors.UnsupportedAuthType, undefined, { authType: authConfig.authType })
+        }
+      } else if (authConfig.WIDAssertionFile !== undefined) {
+        record({ method: AuthType.WorkloadIdentity })
+        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.WorkloadIdentity, authConfig.clientId, actualScope)
         token = await this.acquireAccessTokenViaWID(authConfig, actualScope)
-      } else if (authConfig.FICClientId !== undefined) {
-        record({ method: 'fic' })
-        logger.debug('getAccessToken via FIC clientId=%s scope=%s', authConfig.clientId, actualScope)
+      } else if (authConfig.federatedClientId !== undefined || authConfig.FICClientId !== undefined) {
+        record({ method: AuthType.FederatedCredentials })
+        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.FederatedCredentials, authConfig.clientId, actualScope)
         token = await this.acquireAccessTokenViaFIC(authConfig, actualScope)
       } else if (authConfig.clientSecret !== undefined) {
-        record({ method: 'secret' })
-        logger.debug('getAccessToken via secret clientId=%s scope=%s', authConfig.clientId, actualScope)
+        record({ method: AuthType.ClientSecret })
+        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.ClientSecret, authConfig.clientId, actualScope)
         token = await this.acquireAccessTokenViaSecret(authConfig, actualScope)
       } else if (authConfig.certPemFile !== undefined &&
           authConfig.certKeyFile !== undefined) {
-        record({ method: 'certificate' })
-        logger.debug('getAccessToken via certificate clientId=%s scope=%s', authConfig.clientId, actualScope)
+        record({ method: AuthType.Certificate })
+        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.Certificate, authConfig.clientId, actualScope)
         token = await this.acquireTokenWithCertificate(authConfig, actualScope)
       } else if (authConfig.clientSecret === undefined &&
           authConfig.certPemFile === undefined &&
           authConfig.certKeyFile === undefined) {
-        record({ method: 'managed_identity' })
-        logger.debug('getAccessToken via managed identity clientId=%s scope=%s', authConfig.clientId, actualScope)
+        record({ method: AuthType.UserManagedIdentity })
+        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.UserManagedIdentity, authConfig.clientId, actualScope)
         token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope)
       } else {
-        throw new Error('Invalid authConfig. ')
+        throw ExceptionHelper.generateException(Error, Errors.InvalidAuthConfig)
       }
       if (token === undefined) {
-        throw new Error('Failed to acquire token')
+        throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireToken)
       }
 
       return token
@@ -137,7 +190,7 @@ export class MsalTokenProvider implements AuthProvider {
       const cca = new ConfidentialClientApplication({
         auth: {
           clientId: authConfig.clientId as string,
-          authority: `${authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
+          authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
           clientSecret: authConfig.clientSecret
         },
         system: this.sysOptions
@@ -174,7 +227,7 @@ export class MsalTokenProvider implements AuthProvider {
 
       const token = await cca.acquireTokenByClientCredential({
         scopes: ['api://AzureAdTokenExchange/.default'],
-        correlationId: v4(),
+        correlationId: randomUUID(),
         azureRegion: this.connectionSettings?.azureRegion
       })
 
@@ -193,16 +246,16 @@ export class MsalTokenProvider implements AuthProvider {
    * @returns
    */
   private resolveAuthority (tenantId?: string) : string {
-    const { authority: configuredAuth, tenantId: configuredTenantId } = this.connectionSettings ?? {}
+    const { authorityEndpoint: configuredAuth, authority, tenantId: configuredTenantId } = this.connectionSettings ?? {}
 
     if (!tenantId) {
       // No agentic tenant override — delegate to shared utility
-      return resolveAuthorityUtil(configuredAuth, configuredTenantId)
+      return resolveAuthorityUtil(configuredAuth ?? authority, configuredTenantId)
     }
 
     // Agentic override: build a clean base using the override tenant, then replace any
     // /common or GUID placeholder left in the authority (e.g. from a multi-tenant config)
-    const base = resolveAuthorityUtil(configuredAuth, tenantId)
+    const base = resolveAuthorityUtil(configuredAuth ?? authority, tenantId)
     const guidPattern = /\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/
 
     if (base.endsWith('/common') || guidPattern.test(base)) {
@@ -257,22 +310,42 @@ export class MsalTokenProvider implements AuthProvider {
       data.client_info = '2'
     }
 
-    const token = await axios.post(
+    const controller = new AbortController()
+    const timeoutId = setTimeout(() => {
+      controller.abort(createTokenRequestTimeoutError(agenticTokenRequestTimeoutMs))
+    }, agenticTokenRequestTimeoutMs)
+
+    const token = await fetch(
       url,
-      data,
       {
+        method: 'POST',
         headers: {
           'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8'
-        }
+        },
+        body: new URLSearchParams(data as Record<string, string>).toString(),
+        signal: controller.signal
       }
-    ).catch((error) => {
-      logger.error('Error acquiring token: ', error.toJSON())
-      throw error
+    ).then(async (response) => {
+      if (!response.ok) {
+        const errorBody = await response.text()
+        const error = new Error(`Token request failed with status ${response.status}: ${errorBody}`)
+        ;(error as any).toJSON = () => ({ status: response.status, body: errorBody })
+        throw error
+      }
+      return response.json() as Promise<{ access_token: string, expires_in: number }>
+    }).catch((error) => {
+      const resolvedError = isAbortError(error)
+        ? (controller.signal.reason instanceof Error ? controller.signal.reason : createTokenRequestTimeoutError(agenticTokenRequestTimeoutMs))
+        : error
+      logger.error('Error acquiring token: ', resolvedError.toJSON ? resolvedError.toJSON() : resolvedError)
+      throw resolvedError
+    }).finally(() => {
+      clearTimeout(timeoutId)
     })
 
     // capture token, expire local cache 5 minutes early
-    this._agenticTokenCache.set(cacheKey, token.data.access_token, token.data.expires_in - 300)
-    return token.data.access_token
+    this._agenticTokenCache.set(cacheKey, token.access_token, token.expires_in - 300)
+    return token.access_token
   }
 
   public async getAgenticUserToken (tenantId: string, agentAppInstanceId: string, agenticUserId: string, scopes: string[]): Promise<string> {
@@ -303,12 +376,60 @@ export class MsalTokenProvider implements AuthProvider {
     }
     logger.debug('getAgenticApplicationToken clientId=%s tenantId=%s agentAppInstanceId=%s', this.connectionSettings.clientId, tenantId, agentAppInstanceId)
 
+    if (this.connectionSettings.authType === AuthType.IdentityProxyManager) {
+      let resource: string
+      if (!this.connectionSettings.idpmResource) {
+        resource = 'api://AzureAdTokenExchange/.default'
+      } else if (!URL.canParse(this.connectionSettings.idpmResource)) {
+        throw new Error('idpmResource must be a valid absolute URI')
+      } else {
+        resource = this.connectionSettings.idpmResource
+      }
+      const msiApp = new ManagedIdentityApplication({
+        managedIdentityIdParams: {
+          userAssignedClientId: this.connectionSettings.clientId
+        },
+        system: this.sysOptions
+      })
+      const tokenResult = await msiApp.acquireToken({ resource })
+      if (!tokenResult?.accessToken) {
+        throw new Error(`Failed to acquire token via IdentityProxyManager for agent instance: ${agentAppInstanceId}`)
+      }
+      logger.debug('getAgenticApplicationToken via IdentityProxyManager clientId=%s resource=%s', this.connectionSettings.clientId, resource)
+      return tokenResult.accessToken
+    }
+
     let clientAssertion
 
-    if (this.connectionSettings.WIDAssertionFile !== undefined) {
-      clientAssertion = fs.readFileSync(this.connectionSettings.WIDAssertionFile as string, 'utf8')
-    } else if (this.connectionSettings.FICClientId !== undefined) {
-      clientAssertion = await this.fetchExternalToken(this.connectionSettings.FICClientId as string)
+    if (this.connectionSettings.authType) {
+      switch (this.connectionSettings.authType) {
+        case AuthType.WorkloadIdentity: {
+          const tokenFilePath = this.connectionSettings.federatedTokenFile ?? this.connectionSettings.WIDAssertionFile
+          if (tokenFilePath === undefined) {
+            throw ExceptionHelper.generateException(Error, Errors.WorkloadIdentityTokenFileRequired)
+          }
+          clientAssertion = fs.readFileSync(tokenFilePath as string, 'utf8')
+          break
+        }
+        case AuthType.FederatedCredentials:
+          if (!this.connectionSettings.federatedClientId && !this.connectionSettings.FICClientId) {
+            throw ExceptionHelper.generateException(Error, Errors.FICClientIdRequired)
+          }
+          clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId as string || this.connectionSettings.FICClientId as string)
+          break
+        case AuthType.Certificate:
+        case AuthType.CertificateSubjectName:
+          if (!this.connectionSettings.certPemFile || !this.connectionSettings.certKeyFile) {
+            throw ExceptionHelper.generateException(Error, Errors.CertificateFilesRequired)
+          }
+          clientAssertion = this.getAssertionFromCert(this.connectionSettings)
+          break
+      }
+    } else if (this.connectionSettings.WIDAssertionFile !== undefined) {
+      const tokenFilePath = this.connectionSettings.federatedTokenFile ?? this.connectionSettings.WIDAssertionFile
+      clientAssertion = fs.readFileSync(tokenFilePath as string, 'utf8')
+    } else if (this.connectionSettings.federatedClientId !== undefined || this.connectionSettings.FICClientId !== undefined) {
+      clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId as string || this.connectionSettings.FICClientId as string)
     } else if (this.connectionSettings.certPemFile !== undefined &&
       this.connectionSettings.certKeyFile !== undefined) {
       clientAssertion = this.getAssertionFromCert(this.connectionSettings)
@@ -380,7 +501,7 @@ export class MsalTokenProvider implements AuthProvider {
       aud: `${this.resolveAuthority(authConfig.tenantId)}/oauth2/v2.0/token`,
       iss: authConfig.clientId,
       sub: authConfig.clientId,
-      jti: v4(),
+      jti: randomUUID(),
       nbf: now,
       iat: now,
       exp: now + 600, // 10 minutes
@@ -415,6 +536,22 @@ export class MsalTokenProvider implements AuthProvider {
     return token?.accessToken
   }
 
+  /**
+   * Acquires a token using a system-assigned identity.
+   * @param authConfig The authentication configuration.
+   * @param scope The scope for the token.
+   * @returns A promise that resolves to the access token.
+   */
+  private async acquireTokenWithSystemAssignedIdentity (authConfig: AuthConfiguration, scope: string) {
+    const mia = new ManagedIdentityApplication({
+      system: this.sysOptions
+    })
+    const token = await mia.acquireToken({
+      resource: scope
+    })
+    return token?.accessToken
+  }
+
   /**
    * Acquires a token using a certificate.
    * @param authConfig The authentication configuration.
@@ -440,7 +577,7 @@ export class MsalTokenProvider implements AuthProvider {
     const cca = new ConfidentialClientApplication({
       auth: {
         clientId: authConfig.clientId || '',
-        authority: `${authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
+        authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
         clientCertificate: {
           privateKey: privateKey as string,
           thumbprint: pubKeyObject.fingerprint.replaceAll(':', ''),
@@ -451,7 +588,7 @@ export class MsalTokenProvider implements AuthProvider {
     })
     const token = await cca.acquireTokenByClientCredential({
       scopes: [`${scope}/.default`],
-      correlationId: v4(),
+      correlationId: randomUUID(),
       azureRegion: authConfig.azureRegion
     })
     if (!token?.accessToken) {
@@ -470,14 +607,14 @@ export class MsalTokenProvider implements AuthProvider {
     const cca = new ConfidentialClientApplication({
       auth: {
         clientId: authConfig.clientId as string,
-        authority: `${authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
+        authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
         clientSecret: authConfig.clientSecret
       },
       system: this.sysOptions
     })
     const token = await cca.acquireTokenByClientCredential({
       scopes: [`${scope}/.default`],
-      correlationId: v4(),
+      correlationId: randomUUID(),
       azureRegion: authConfig.azureRegion
     })
     if (!token?.accessToken) {
@@ -494,11 +631,11 @@ export class MsalTokenProvider implements AuthProvider {
    */
   private async acquireAccessTokenViaFIC (authConfig: AuthConfiguration, scope: string) : Promise<string> {
     const scopes = [`${scope}/.default`]
-    const clientAssertion = await this.fetchExternalToken(authConfig.FICClientId as string)
+    const clientAssertion = await this.fetchExternalToken(authConfig.federatedClientId as string || authConfig.FICClientId as string)
     const cca = new ConfidentialClientApplication({
       auth: {
         clientId: authConfig.clientId as string,
-        authority: `${authConfig.authority}/${authConfig.tenantId}`,
+        authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId}`,
         clientAssertion
       },
       system: this.sysOptions
@@ -519,7 +656,8 @@ export class MsalTokenProvider implements AuthProvider {
    */
   private async acquireAccessTokenViaWID (authConfig: AuthConfiguration, scope: string) : Promise<string> {
     const scopes = [`${scope}/.default`]
-    const clientAssertion = fs.readFileSync(authConfig.WIDAssertionFile as string, 'utf8')
+    const tokenFilePath = authConfig.federatedTokenFile ?? authConfig.WIDAssertionFile
+    const clientAssertion = fs.readFileSync(tokenFilePath as string, 'utf8')
     const cca = new ConfidentialClientApplication({
       auth: {
         clientId: authConfig.clientId as string,