@microsoft/agents-hosting 1.6.1 → 1.7.0-beta.5.g67b2005119

package/src/auth/{msalTokenProvider.ts → msal/msalTokenProvider.ts}

@@ -3,19 +3,18 @@
  * Licensed under the MIT License.
  */
 
-import { ConfidentialClientApplication, LogLevel, ManagedIdentityApplication, NodeSystemOptions } from '@azure/msal-node'
-import { AuthConfiguration, AuthType, resolveAuthority as resolveAuthorityUtil } from './authConfiguration'
-import { AuthProvider } from './authProvider'
+import { AuthenticationResult, ConfidentialClientApplication, LogLevel, ManagedIdentityApplication, NodeSystemOptions } from '@azure/msal-node'
+import { AuthConfiguration, AuthType, resolveAuthority, resolveAuthority as resolveAuthorityUtil, resolveAuthType } from '../authConfiguration'
+import { AuthProvider } from '../authProvider'
 import { debug, trace } from '@microsoft/agents-telemetry'
 import { randomUUID } from 'crypto'
-import { MemoryCache } from './MemoryCache'
-import jwt from 'jsonwebtoken'
-
+import { MemoryCache } from '../MemoryCache'
+import jwt, { JwtPayload } from 'jsonwebtoken'
 import fs from 'fs'
 import crypto from 'crypto'
-import { AuthenticationTraceDefinitions } from '../observability'
+import { AuthenticationTraceDefinitions } from '../../observability'
 import { ExceptionHelper } from '@microsoft/agents-activity'
-import { Errors } from '../errorHelper'
+import { Errors } from '../../errorHelper'
 
 const audience = 'api://AzureADTokenExchange'
 const logger = debug('agents:msal')
@@ -33,14 +32,237 @@ function createTokenRequestTimeoutError (timeoutMs: number): Error {
  * Provides tokens using MSAL.
  */
 export class MsalTokenProvider implements AuthProvider {
-  private readonly _agenticTokenCache: MemoryCache<string>
+  private static readonly _accessTokenCache = new MemoryCache<string>()
+  private static readonly _agenticTokenCache = new MemoryCache<string>()
+  private static readonly _confidentialClients = new Map<string, ConfidentialClientApplication>()
+  private static readonly _maxConfidentialClients = 100
   public readonly connectionSettings?: AuthConfiguration
 
   constructor (connectionSettings?: AuthConfiguration) {
-    this._agenticTokenCache = new MemoryCache<string>()
     this.connectionSettings = connectionSettings
   }
 
+  /**
+   * Clears process-wide auth caches.
+   */
+  public static clearSharedCaches (): void {
+    MsalTokenProvider._accessTokenCache.clear()
+    MsalTokenProvider._agenticTokenCache.clear()
+    MsalTokenProvider._confidentialClients.clear()
+  }
+
+  private static cacheKey (...parts: Array<string | number | boolean | undefined | null>): string {
+    return JSON.stringify(parts.map(part => part ?? ''))
+  }
+
+  private static digest (value: string | Buffer | undefined): string {
+    return value ? crypto.createHash('sha256').update(value).digest('base64url') : ''
+  }
+
+  private getOrCreateConfidentialClient (
+    cacheKey: string,
+    createClient: () => ConfidentialClientApplication
+  ): ConfidentialClientApplication {
+    const existing = MsalTokenProvider._confidentialClients.get(cacheKey)
+    if (existing) {
+      MsalTokenProvider._confidentialClients.delete(cacheKey)
+      MsalTokenProvider._confidentialClients.set(cacheKey, existing)
+      return existing
+    }
+
+    const created = createClient()
+    MsalTokenProvider._confidentialClients.set(cacheKey, created)
+    while (MsalTokenProvider._confidentialClients.size > MsalTokenProvider._maxConfidentialClients) {
+      const oldestKey = MsalTokenProvider._confidentialClients.keys().next().value
+      if (oldestKey === undefined) {
+        break
+      }
+      MsalTokenProvider._confidentialClients.delete(oldestKey)
+    }
+    return created
+  }
+
+  private getFileCacheIdentity (path?: string): string {
+    if (!path) {
+      return ''
+    }
+
+    try {
+      const stat = fs.statSync(path)
+      return `${path}:${stat.size}:${stat.mtimeMs}`
+    } catch {
+      return path
+    }
+  }
+
+  private getAccessTokenCacheKey (authConfig: AuthConfiguration, scope: string): string {
+    const authType = resolveAuthType(authConfig)
+    let authority = resolveAuthorityUtil(authConfig.authorityEndpoint ?? authConfig.authority, authConfig.tenantId)
+    let credentialIdentity = ''
+
+    switch (authType) {
+      case AuthType.ClientSecret:
+        credentialIdentity = MsalTokenProvider.digest(authConfig.clientSecret)
+        break
+      case AuthType.Certificate:
+      case AuthType.CertificateSubjectName:
+        credentialIdentity = MsalTokenProvider.cacheKey(
+          this.getFileCacheIdentity(authConfig.certPemFile),
+          this.getFileCacheIdentity(authConfig.certKeyFile),
+          authConfig.sendX5C
+        )
+        break
+      case AuthType.WorkloadIdentity:
+        authority = `https://login.microsoftonline.com/${authConfig.tenantId}`
+        credentialIdentity = this.getFileCacheIdentity(authConfig.federatedTokenFile ?? authConfig.WIDAssertionFile)
+        break
+      case AuthType.FederatedCredentials:
+        credentialIdentity = authConfig.federatedClientId ?? authConfig.FICClientId ?? ''
+        break
+      case AuthType.UserManagedIdentity:
+        authority = 'managed-identity'
+        credentialIdentity = authConfig.clientId ?? ''
+        break
+      case AuthType.SystemManagedIdentity:
+        authority = 'managed-identity'
+        credentialIdentity = 'system'
+        break
+      default:
+        credentialIdentity = 'unknown'
+    }
+
+    return MsalTokenProvider.cacheKey(
+      'access-token',
+      authType,
+      authority,
+      authConfig.clientId,
+      scope,
+      authConfig.azureRegion,
+      credentialIdentity
+    )
+  }
+
+  private cacheAccessToken (cacheKey: string, token: string, expiresOn?: Date | null): void {
+    const ttlSeconds = this.getTokenCacheTtlSeconds(token, expiresOn)
+    if (ttlSeconds > 0) {
+      MsalTokenProvider._accessTokenCache.set(cacheKey, token, ttlSeconds)
+    }
+  }
+
+  private cacheAgenticToken (cacheKey: string, token: string, ttlSeconds: number): void {
+    const safeTtlSeconds = Math.floor(ttlSeconds) - 300
+    if (safeTtlSeconds > 0) {
+      MsalTokenProvider._agenticTokenCache.set(cacheKey, token, safeTtlSeconds)
+    }
+  }
+
+  private cacheAgenticAuthenticationResult (cacheKey: string, token: AuthenticationResult): void {
+    const ttlSeconds = this.getTokenCacheTtlSeconds(token.accessToken, token.expiresOn)
+    if (ttlSeconds > 0) {
+      MsalTokenProvider._agenticTokenCache.set(cacheKey, token.accessToken, ttlSeconds)
+    }
+  }
+
+  private getAgenticTokenCacheKey (
+    tenantId: string,
+    clientId: string,
+    scopes: string[],
+    tokenBodyParameters: { [key: string]: any }
+  ): string {
+    const bodyKey = Object.keys(tokenBodyParameters)
+      .sort()
+      .filter(key => key !== 'user_federated_identity_credential')
+      .map(key => `${key}=${MsalTokenProvider.digest(String(tokenBodyParameters[key]))}`)
+      .join('&')
+
+    return MsalTokenProvider.cacheKey(
+      'agentic-token',
+      this.resolveAuthority(tenantId),
+      clientId,
+      scopes.join(' '),
+      bodyKey
+    )
+  }
+
+  private getTokenCacheTtlSeconds (token: string, expiresOn?: Date | null): number {
+    const expiresAtMs = expiresOn?.getTime() ?? this.getJwtExpiresAtMs(token)
+    if (!expiresAtMs) {
+      return 0
+    }
+
+    return Math.floor((expiresAtMs - Date.now()) / 1000) - 300
+  }
+
+  private getJwtExpiresAtMs (token: string): number | undefined {
+    const payload = jwt.decode(token) as JwtPayload | string | null
+    if (!payload || typeof payload === 'string' || typeof payload.exp !== 'number') {
+      return undefined
+    }
+
+    return payload.exp * 1000
+  }
+
+  private getClientSecretClient (authConfig: AuthConfiguration): ConfidentialClientApplication {
+    const cacheKey = MsalTokenProvider.cacheKey(
+      'confidential-client',
+      AuthType.ClientSecret,
+      authConfig.clientId,
+      resolveAuthorityUtil(authConfig.authorityEndpoint ?? authConfig.authority, authConfig.tenantId),
+      MsalTokenProvider.digest(authConfig.clientSecret)
+    )
+
+    return this.getOrCreateConfidentialClient(cacheKey, () => new ConfidentialClientApplication({
+      auth: {
+        clientId: authConfig.clientId as string,
+        authority: resolveAuthorityUtil(authConfig.authorityEndpoint ?? authConfig.authority, authConfig.tenantId),
+        clientSecret: authConfig.clientSecret
+      },
+      system: this.sysOptions
+    }))
+  }
+
+  private getCertificateClient (authConfig: AuthConfiguration): ConfidentialClientApplication {
+    const cacheKey = MsalTokenProvider.cacheKey(
+      'confidential-client',
+      authConfig.authType ?? AuthType.Certificate,
+      authConfig.clientId,
+      resolveAuthorityUtil(authConfig.authorityEndpoint ?? authConfig.authority, authConfig.tenantId),
+      this.getFileCacheIdentity(authConfig.certPemFile),
+      this.getFileCacheIdentity(authConfig.certKeyFile),
+      authConfig.sendX5C
+    )
+
+    return this.getOrCreateConfidentialClient(cacheKey, () => {
+      const privateKeySource = fs.readFileSync(authConfig.certKeyFile as string)
+
+      const privateKeyObject = crypto.createPrivateKey({
+        key: privateKeySource,
+        format: 'pem'
+      })
+
+      const privateKey = privateKeyObject.export({
+        format: 'pem',
+        type: 'pkcs8'
+      })
+
+      const pemFile = fs.readFileSync(authConfig.certPemFile as string)
+      const pubKeyObject = new crypto.X509Certificate(pemFile)
+
+      return new ConfidentialClientApplication({
+        auth: {
+          clientId: authConfig.clientId || '',
+          authority: resolveAuthority(authConfig.authorityEndpoint ?? authConfig.authority, authConfig.tenantId),
+          clientCertificate: {
+            privateKey: privateKey as string,
+            thumbprint: pubKeyObject.fingerprint.replaceAll(':', ''),
+            x5c: pemFile.toString()
+          }
+        },
+        system: this.sysOptions
+      })
+    })
+  }
+
   /**
    * Gets an access token using the auth configuration from the MsalTokenProvider instance and the provided scope.
    * @param scope The scope for the token.
@@ -62,7 +284,7 @@ export class MsalTokenProvider implements AuthProvider {
       if (typeof authConfigOrScope === 'string') {
       // Called as getAccessToken(scope)
         if (!this.connectionSettings) {
-          throw new Error('Connection settings must be provided to constructor when calling getAccessToken(scope)')
+          throw ExceptionHelper.generateException(Error, Errors.ConnectionSettingsRequiredForGetAccessTokenScope)
         }
         authConfig = this.connectionSettings
         actualScope = authConfigOrScope
@@ -79,80 +301,64 @@ export class MsalTokenProvider implements AuthProvider {
         return ''
       }
 
+      const accessTokenCacheKey = this.getAccessTokenCacheKey(authConfig, actualScope)
+      const cachedAccessToken = MsalTokenProvider._accessTokenCache.get(accessTokenCacheKey)
+      if (cachedAccessToken) {
+        logger.debug('getAccessToken cache hit clientId=%s scope=%s', authConfig.clientId, actualScope)
+        return cachedAccessToken
+      }
+
       let token
-      if (authConfig.authType) {
-        record({ method: authConfig.authType })
-        logger.debug(`getAccessToken via ${authConfig.authType} clientId=${authConfig.clientId} scope=${actualScope}`)
-        switch (authConfig.authType) {
-          case AuthType.WorkloadIdentity: {
-            const tokenFilePath = authConfig.federatedTokenFile ?? authConfig.WIDAssertionFile
-            if (!tokenFilePath) {
-              throw ExceptionHelper.generateException(Error, Errors.WorkloadIdentityTokenFileRequired)
-            }
-            token = await this.acquireAccessTokenViaWID(authConfig, actualScope)
-            break
+      const authType = resolveAuthType(authConfig)
+      record({ method: authType })
+      logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authType, authConfig.clientId, actualScope)
+
+      switch (authType) {
+        case AuthType.WorkloadIdentity: {
+          const tokenFilePath = authConfig.federatedTokenFile ?? authConfig.WIDAssertionFile
+          if (!tokenFilePath) {
+            throw ExceptionHelper.generateException(Error, Errors.WorkloadIdentityTokenFileRequired)
           }
-          case AuthType.FederatedCredentials:
-            if (!authConfig.federatedClientId && !authConfig.FICClientId) {
-              throw ExceptionHelper.generateException(Error, Errors.FICClientIdRequired)
-            }
-            token = await this.acquireAccessTokenViaFIC(authConfig, actualScope)
-            break
-          case AuthType.ClientSecret:
-            if (!authConfig.clientSecret) {
-              throw ExceptionHelper.generateException(Error, Errors.ClientSecretRequired)
-            }
-            token = await this.acquireAccessTokenViaSecret(authConfig, actualScope)
-            break
-          case AuthType.Certificate:
-          case AuthType.CertificateSubjectName:
-            if (!authConfig.certPemFile || !authConfig.certKeyFile) {
-              throw ExceptionHelper.generateException(Error, Errors.CertificateFilesRequired)
-            }
-            token = await this.acquireTokenWithCertificate(authConfig, actualScope)
-            break
-          case AuthType.UserManagedIdentity:
-            if (!authConfig.clientId) {
-              throw ExceptionHelper.generateException(Error, Errors.ClientIdRequiredForUserManagedIdentity)
-            }
-            token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope)
-            break
-          case AuthType.SystemManagedIdentity:
-            token = await this.acquireTokenWithSystemAssignedIdentity(authConfig, actualScope)
-            break
-          default:
-            throw ExceptionHelper.generateException(Error, Errors.UnsupportedAuthType, undefined, { authType: authConfig.authType })
+          token = await this.acquireAccessTokenViaWID(authConfig, actualScope)
+          break
         }
-      } else if (authConfig.WIDAssertionFile !== undefined) {
-        record({ method: AuthType.WorkloadIdentity })
-        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.WorkloadIdentity, authConfig.clientId, actualScope)
-        token = await this.acquireAccessTokenViaWID(authConfig, actualScope)
-      } else if (authConfig.federatedClientId !== undefined || authConfig.FICClientId !== undefined) {
-        record({ method: AuthType.FederatedCredentials })
-        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.FederatedCredentials, authConfig.clientId, actualScope)
-        token = await this.acquireAccessTokenViaFIC(authConfig, actualScope)
-      } else if (authConfig.clientSecret !== undefined) {
-        record({ method: AuthType.ClientSecret })
-        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.ClientSecret, authConfig.clientId, actualScope)
-        token = await this.acquireAccessTokenViaSecret(authConfig, actualScope)
-      } else if (authConfig.certPemFile !== undefined &&
-          authConfig.certKeyFile !== undefined) {
-        record({ method: AuthType.Certificate })
-        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.Certificate, authConfig.clientId, actualScope)
-        token = await this.acquireTokenWithCertificate(authConfig, actualScope)
-      } else if (authConfig.clientSecret === undefined &&
-          authConfig.certPemFile === undefined &&
-          authConfig.certKeyFile === undefined) {
-        record({ method: AuthType.UserManagedIdentity })
-        logger.debug('getAccessToken via method=%s clientId=%s scope=%s', AuthType.UserManagedIdentity, authConfig.clientId, actualScope)
-        token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope)
-      } else {
-        throw ExceptionHelper.generateException(Error, Errors.InvalidAuthConfig)
+        case AuthType.FederatedCredentials:
+          if (!authConfig.federatedClientId && !authConfig.FICClientId) {
+            throw ExceptionHelper.generateException(Error, Errors.FICClientIdRequired)
+          }
+          token = await this.acquireAccessTokenViaFIC(authConfig, actualScope)
+          break
+        case AuthType.ClientSecret:
+          if (!authConfig.clientSecret) {
+            throw ExceptionHelper.generateException(Error, Errors.ClientSecretRequired)
+          }
+          token = await this.acquireAccessTokenViaSecret(authConfig, actualScope)
+          break
+        case AuthType.Certificate:
+        case AuthType.CertificateSubjectName:
+          if (!authConfig.certPemFile || !authConfig.certKeyFile) {
+            throw ExceptionHelper.generateException(Error, Errors.CertificateFilesRequired)
+          }
+          token = await this.acquireTokenWithCertificate(authConfig, actualScope)
+          break
+        case AuthType.UserManagedIdentity:
+          if (!authConfig.clientId) {
+            throw ExceptionHelper.generateException(Error, Errors.ClientIdRequiredForUserManagedIdentity)
+          }
+          token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope)
+          break
+        case AuthType.SystemManagedIdentity:
+          token = await this.acquireTokenWithSystemAssignedIdentity(authConfig, actualScope)
+          break
+        default:
+          throw ExceptionHelper.generateException(Error, Errors.UnsupportedAuthType, undefined, { authType })
       }
+
       if (token === undefined) {
         throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireToken)
       }
 
+      this.cacheAccessToken(accessTokenCacheKey, token)
       return token
     })
   }
@@ -172,7 +378,7 @@ export class MsalTokenProvider implements AuthProvider {
       if (Array.isArray(authConfigOrScopes)) {
       // Called as acquireTokenOnBehalfOf(scopes, oboAssertion)
         if (!this.connectionSettings) {
-          throw new Error('Connection settings must be provided to constructor when calling acquireTokenOnBehalfOf(scopes, oboAssertion)')
+          throw ExceptionHelper.generateException(Error, Errors.ConnectionSettingsRequiredForAcquireTokenOnBehalfOf)
         }
         authConfig = this.connectionSettings
         actualScopes = authConfigOrScopes
@@ -187,20 +393,13 @@ export class MsalTokenProvider implements AuthProvider {
       record({ scopes: actualScopes })
       logger.debug('acquireTokenOnBehalfOf clientId=%s scopes=%o', authConfig.clientId, actualScopes)
 
-      const cca = new ConfidentialClientApplication({
-        auth: {
-          clientId: authConfig.clientId as string,
-          authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
-          clientSecret: authConfig.clientSecret
-        },
-        system: this.sysOptions
-      })
+      const cca = this.getClientSecretClient(authConfig)
       const token = await cca.acquireTokenOnBehalfOf({
         oboAssertion: actualOboAssertion,
         scopes: actualScopes
       })
       if (!token?.accessToken) {
-        throw new Error('Failed to acquire token on behalf of user')
+        throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireTokenOnBehalfOf)
       }
 
       return token.accessToken
@@ -213,8 +412,21 @@ export class MsalTokenProvider implements AuthProvider {
       record({ agenticInstanceId: agentAppInstanceId })
 
       if (!this.connectionSettings) {
-        throw new Error('Connection settings must be provided when calling getAgenticInstanceToken')
+        throw ExceptionHelper.generateException(Error, Errors.ConnectionSettingsRequiredForGetAgenticInstanceToken)
       }
+
+      const instanceTokenCacheKey = MsalTokenProvider.cacheKey(
+        'agentic-instance-token',
+        this.resolveAuthority(tenantId),
+        agentAppInstanceId,
+        this.connectionSettings.clientId,
+        this.connectionSettings.azureRegion
+      )
+      const cachedInstanceToken = MsalTokenProvider._agenticTokenCache.get(instanceTokenCacheKey)
+      if (cachedInstanceToken) {
+        return cachedInstanceToken
+      }
+
       const appToken = await this.getAgenticApplicationToken(tenantId, agentAppInstanceId)
       const cca = new ConfidentialClientApplication({
         auth: {
@@ -232,9 +444,10 @@ export class MsalTokenProvider implements AuthProvider {
       })
 
       if (!token?.accessToken) {
-        throw new Error(`Failed to acquire instance token for agent instance: ${agentAppInstanceId}`)
+        throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireInstanceTokenForAgentInstance, undefined, { agentAppInstanceId })
       }
 
+      this.cacheAgenticAuthenticationResult(instanceTokenCacheKey, token)
       return token.accessToken
     })
   }
@@ -281,14 +494,14 @@ export class MsalTokenProvider implements AuthProvider {
    */
   private async acquireTokenForAgenticScenarios (tenantId: string, clientId: string, clientAssertion: string | undefined, scopes: string[], tokenBodyParameters: { [key: string]: any }): Promise<string | null> {
     if (!this.connectionSettings) {
-      throw new Error('Connection settings must be provided when calling getAgenticInstanceToken')
+      throw ExceptionHelper.generateException(Error, Errors.ConnectionSettingsRequiredForGetAgenticInstanceToken)
     }
 
     logger.debug('acquireTokenForAgenticScenarios clientId=%s tenantId=%s scopes=%o grant_type=%s', clientId, tenantId, scopes, tokenBodyParameters.grant_type)
     // Check cache first
-    const cacheKey = `${clientId}/${Object.keys(tokenBodyParameters).map(key => key !== 'user_federated_identity_credential' ? `${key}=${tokenBodyParameters[key]}` : '').join('&')}/${scopes.join(';')}`
-    if (this._agenticTokenCache.get(cacheKey)) {
-      return this._agenticTokenCache.get(cacheKey) as string
+    const cacheKey = this.getAgenticTokenCacheKey(tenantId, clientId, scopes, tokenBodyParameters)
+    if (MsalTokenProvider._agenticTokenCache.get(cacheKey)) {
+      return MsalTokenProvider._agenticTokenCache.get(cacheKey) as string
     }
 
     const url = `${this.resolveAuthority(tenantId)}/oauth2/v2.0/token`
@@ -344,7 +557,7 @@ export class MsalTokenProvider implements AuthProvider {
     })
 
     // capture token, expire local cache 5 minutes early
-    this._agenticTokenCache.set(cacheKey, token.access_token, token.expires_in - 300)
+    this.cacheAgenticToken(cacheKey, token.access_token, token.expires_in)
     return token.access_token
   }
 
@@ -353,17 +566,26 @@ export class MsalTokenProvider implements AuthProvider {
       logger.debug('getAgenticUserToken tenantId=%s agentAppInstanceId=%s scopes=%o', tenantId, agentAppInstanceId, scopes)
       record({ agenticInstanceId: agentAppInstanceId, agenticUserId, scopes })
 
+      const userTokenParameters = {
+        user_id: agenticUserId,
+        grant_type: 'user_fic',
+      }
+      const userTokenCacheKey = this.getAgenticTokenCacheKey(tenantId, agentAppInstanceId, scopes, userTokenParameters)
+      const cachedUserToken = MsalTokenProvider._agenticTokenCache.get(userTokenCacheKey)
+      if (cachedUserToken) {
+        return cachedUserToken
+      }
+
       const agentToken = await this.getAgenticApplicationToken(tenantId, agentAppInstanceId)
       const instanceToken = await this.getAgenticInstanceToken(tenantId, agentAppInstanceId)
 
       const token = await this.acquireTokenForAgenticScenarios(tenantId, agentAppInstanceId, agentToken, scopes, {
-        user_id: agenticUserId,
+        ...userTokenParameters,
         user_federated_identity_credential: instanceToken,
-        grant_type: 'user_fic',
       })
 
       if (!token) {
-        throw new Error(`Failed to acquire instance token for user token: ${agentAppInstanceId}`)
+        throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireInstanceTokenForUserToken, undefined, { agentAppInstanceId })
       }
 
       return token
@@ -372,16 +594,18 @@ export class MsalTokenProvider implements AuthProvider {
 
   public async getAgenticApplicationToken (tenantId: string, agentAppInstanceId: string): Promise<string> {
     if (!this.connectionSettings?.clientId) {
-      throw new Error('Connection settings must be provided when calling getAgenticApplicationToken')
+      throw ExceptionHelper.generateException(Error, Errors.ConnectionSettingsRequiredForGetAgenticApplicationToken)
     }
     logger.debug('getAgenticApplicationToken clientId=%s tenantId=%s agentAppInstanceId=%s', this.connectionSettings.clientId, tenantId, agentAppInstanceId)
 
-    if (this.connectionSettings.authType === AuthType.IdentityProxyManager) {
+    const authType = resolveAuthType(this.connectionSettings)
+
+    if (authType === AuthType.IdentityProxyManager) {
       let resource: string
       if (!this.connectionSettings.idpmResource) {
         resource = 'api://AzureAdTokenExchange/.default'
       } else if (!URL.canParse(this.connectionSettings.idpmResource)) {
-        throw new Error('idpmResource must be a valid absolute URI')
+        throw ExceptionHelper.generateException(Error, Errors.IdpmResourceAbsoluteUriRequired)
       } else {
         resource = this.connectionSettings.idpmResource
       }
@@ -393,7 +617,7 @@ export class MsalTokenProvider implements AuthProvider {
       })
       const tokenResult = await msiApp.acquireToken({ resource })
       if (!tokenResult?.accessToken) {
-        throw new Error(`Failed to acquire token via IdentityProxyManager for agent instance: ${agentAppInstanceId}`)
+        throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireTokenViaIdentityProxyManagerForAgentInstance, undefined, { agentAppInstanceId })
       }
       logger.debug('getAgenticApplicationToken via IdentityProxyManager clientId=%s resource=%s', this.connectionSettings.clientId, resource)
       return tokenResult.accessToken
@@ -401,38 +625,28 @@ export class MsalTokenProvider implements AuthProvider {
 
     let clientAssertion
 
-    if (this.connectionSettings.authType) {
-      switch (this.connectionSettings.authType) {
-        case AuthType.WorkloadIdentity: {
-          const tokenFilePath = this.connectionSettings.federatedTokenFile ?? this.connectionSettings.WIDAssertionFile
-          if (tokenFilePath === undefined) {
-            throw ExceptionHelper.generateException(Error, Errors.WorkloadIdentityTokenFileRequired)
-          }
-          clientAssertion = fs.readFileSync(tokenFilePath as string, 'utf8')
-          break
+    switch (authType) {
+      case AuthType.WorkloadIdentity: {
+        const tokenFilePath = this.connectionSettings.federatedTokenFile ?? this.connectionSettings.WIDAssertionFile
+        if (tokenFilePath === undefined) {
+          throw ExceptionHelper.generateException(Error, Errors.WorkloadIdentityTokenFileRequired)
         }
-        case AuthType.FederatedCredentials:
-          if (!this.connectionSettings.federatedClientId && !this.connectionSettings.FICClientId) {
-            throw ExceptionHelper.generateException(Error, Errors.FICClientIdRequired)
-          }
-          clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId as string || this.connectionSettings.FICClientId as string)
-          break
-        case AuthType.Certificate:
-        case AuthType.CertificateSubjectName:
-          if (!this.connectionSettings.certPemFile || !this.connectionSettings.certKeyFile) {
-            throw ExceptionHelper.generateException(Error, Errors.CertificateFilesRequired)
-          }
-          clientAssertion = this.getAssertionFromCert(this.connectionSettings)
-          break
+        clientAssertion = fs.readFileSync(tokenFilePath as string, 'utf8')
+        break
       }
-    } else if (this.connectionSettings.WIDAssertionFile !== undefined) {
-      const tokenFilePath = this.connectionSettings.federatedTokenFile ?? this.connectionSettings.WIDAssertionFile
-      clientAssertion = fs.readFileSync(tokenFilePath as string, 'utf8')
-    } else if (this.connectionSettings.federatedClientId !== undefined || this.connectionSettings.FICClientId !== undefined) {
-      clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId as string || this.connectionSettings.FICClientId as string)
-    } else if (this.connectionSettings.certPemFile !== undefined &&
-      this.connectionSettings.certKeyFile !== undefined) {
-      clientAssertion = this.getAssertionFromCert(this.connectionSettings)
+      case AuthType.FederatedCredentials:
+        if (!this.connectionSettings.federatedClientId && !this.connectionSettings.FICClientId) {
+          throw ExceptionHelper.generateException(Error, Errors.FICClientIdRequired)
+        }
+        clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId as string || this.connectionSettings.FICClientId as string)
+        break
+      case AuthType.Certificate:
+      case AuthType.CertificateSubjectName:
+        if (!this.connectionSettings.certPemFile || !this.connectionSettings.certKeyFile) {
+          throw ExceptionHelper.generateException(Error, Errors.CertificateFilesRequired)
+        }
+        clientAssertion = this.getAssertionFromCert(this.connectionSettings)
+        break
     }
 
     const token = await this.acquireTokenForAgenticScenarios(tenantId, this.connectionSettings.clientId, clientAssertion, ['api://AzureAdTokenExchange/.default'], {
@@ -441,7 +655,7 @@ export class MsalTokenProvider implements AuthProvider {
     })
 
     if (!token) {
-      throw new Error(`Failed to acquire token for agent instance: ${agentAppInstanceId}`)
+      throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireInstanceTokenForAgentInstance, undefined, { agentAppInstanceId })
     }
 
     return token
@@ -559,40 +773,14 @@ export class MsalTokenProvider implements AuthProvider {
    * @returns A promise that resolves to the access token.
    */
   private async acquireTokenWithCertificate (authConfig: AuthConfiguration, scope: string) {
-    const privateKeySource = fs.readFileSync(authConfig.certKeyFile as string)
-
-    const privateKeyObject = crypto.createPrivateKey({
-      key: privateKeySource,
-      format: 'pem'
-    })
-
-    const privateKey = privateKeyObject.export({
-      format: 'pem',
-      type: 'pkcs8'
-    })
-
-    const pemFile = fs.readFileSync(authConfig.certPemFile as string)
-    const pubKeyObject = new crypto.X509Certificate(pemFile)
-
-    const cca = new ConfidentialClientApplication({
-      auth: {
-        clientId: authConfig.clientId || '',
-        authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
-        clientCertificate: {
-          privateKey: privateKey as string,
-          thumbprint: pubKeyObject.fingerprint.replaceAll(':', ''),
-          x5c: pemFile.toString()
-        }
-      },
-      system: this.sysOptions
-    })
+    const cca = this.getCertificateClient(authConfig)
     const token = await cca.acquireTokenByClientCredential({
       scopes: [`${scope}/.default`],
       correlationId: randomUUID(),
       azureRegion: authConfig.azureRegion
     })
     if (!token?.accessToken) {
-      throw new Error('Failed to acquire token using certificate')
+      throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireTokenUsingCertificate)
     }
     return token.accessToken
   }
@@ -604,21 +792,14 @@ export class MsalTokenProvider implements AuthProvider {
    * @returns A promise that resolves to the access token.
    */
   private async acquireAccessTokenViaSecret (authConfig: AuthConfiguration, scope: string) {
-    const cca = new ConfidentialClientApplication({
-      auth: {
-        clientId: authConfig.clientId as string,
-        authority: `${authConfig.authorityEndpoint ?? authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
-        clientSecret: authConfig.clientSecret
-      },
-      system: this.sysOptions
-    })
+    const cca = this.getClientSecretClient(authConfig)
     const token = await cca.acquireTokenByClientCredential({
       scopes: [`${scope}/.default`],
       correlationId: randomUUID(),
       azureRegion: authConfig.azureRegion
     })
     if (!token?.accessToken) {
-      throw new Error('Failed to acquire token using client secret')
+      throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireTokenUsingClientSecret)
     }
     return token.accessToken
   }
@@ -643,7 +824,7 @@ export class MsalTokenProvider implements AuthProvider {
     const token = await cca.acquireTokenByClientCredential({ scopes, azureRegion: authConfig.azureRegion })
     logger.debug('got token using FIC client assertion')
     if (!token?.accessToken) {
-      throw new Error('Failed to acquire token using FIC client assertion')
+      throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireTokenUsingFICClientAssertion)
     }
     return token.accessToken
   }
@@ -669,7 +850,7 @@ export class MsalTokenProvider implements AuthProvider {
     const token = await cca.acquireTokenByClientCredential({ scopes, azureRegion: authConfig.azureRegion })
     logger.debug('got token using WID client assertion')
     if (!token?.accessToken) {
-      throw new Error('Failed to acquire token using WID client assertion')
+      throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireTokenUsingWIDClientAssertion)
     }
     return token.accessToken
   }
@@ -693,7 +874,7 @@ export class MsalTokenProvider implements AuthProvider {
     })
     logger.debug('got token for FIC')
     if (!response?.accessToken) {
-      throw new Error('Failed to acquire external token for FIC client assertion')
+      throw ExceptionHelper.generateException(Error, Errors.FailedToAcquireExternalTokenForFICClientAssertion)
     }
     return response.accessToken
   }