@microsoft/agents-hosting 1.6.1 → 1.7.0-beta.5.g67b2005119

package/dist/src/auth/{msalTokenProvider.js → msal/msalTokenProvider.js}

@@ -9,16 +9,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MsalTokenProvider = void 0;
 const msal_node_1 = require("@azure/msal-node");
-const authConfiguration_1 = require("./authConfiguration");
+const authConfiguration_1 = require("../authConfiguration");
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const crypto_1 = require("crypto");
-const MemoryCache_1 = require("./MemoryCache");
+const MemoryCache_1 = require("../MemoryCache");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const fs_1 = __importDefault(require("fs"));
 const crypto_2 = __importDefault(require("crypto"));
-const observability_1 = require("../observability");
+const observability_1 = require("../../observability");
 const agents_activity_1 = require("@microsoft/agents-activity");
-const errorHelper_1 = require("../errorHelper");
+const errorHelper_1 = require("../../errorHelper");
 const audience = 'api://AzureADTokenExchange';
 const logger = (0, agents_telemetry_1.debug)('agents:msal');
 const agenticTokenRequestTimeoutMs = 30000;
@@ -59,9 +59,171 @@ class MsalTokenProvider {
                 piiLoggingEnabled: false
             }
         };
-        this._agenticTokenCache = new MemoryCache_1.MemoryCache();
         this.connectionSettings = connectionSettings;
     }
+    /**
+     * Clears process-wide auth caches.
+     */
+    static clearSharedCaches() {
+        MsalTokenProvider._accessTokenCache.clear();
+        MsalTokenProvider._agenticTokenCache.clear();
+        MsalTokenProvider._confidentialClients.clear();
+    }
+    static cacheKey(...parts) {
+        return JSON.stringify(parts.map(part => part !== null && part !== void 0 ? part : ''));
+    }
+    static digest(value) {
+        return value ? crypto_2.default.createHash('sha256').update(value).digest('base64url') : '';
+    }
+    getOrCreateConfidentialClient(cacheKey, createClient) {
+        const existing = MsalTokenProvider._confidentialClients.get(cacheKey);
+        if (existing) {
+            MsalTokenProvider._confidentialClients.delete(cacheKey);
+            MsalTokenProvider._confidentialClients.set(cacheKey, existing);
+            return existing;
+        }
+        const created = createClient();
+        MsalTokenProvider._confidentialClients.set(cacheKey, created);
+        while (MsalTokenProvider._confidentialClients.size > MsalTokenProvider._maxConfidentialClients) {
+            const oldestKey = MsalTokenProvider._confidentialClients.keys().next().value;
+            if (oldestKey === undefined) {
+                break;
+            }
+            MsalTokenProvider._confidentialClients.delete(oldestKey);
+        }
+        return created;
+    }
+    getFileCacheIdentity(path) {
+        if (!path) {
+            return '';
+        }
+        try {
+            const stat = fs_1.default.statSync(path);
+            return `${path}:${stat.size}:${stat.mtimeMs}`;
+        }
+        catch {
+            return path;
+        }
+    }
+    getAccessTokenCacheKey(authConfig, scope) {
+        var _a, _b, _c, _d, _e;
+        const authType = (0, authConfiguration_1.resolveAuthType)(authConfig);
+        let authority = (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId);
+        let credentialIdentity = '';
+        switch (authType) {
+            case authConfiguration_1.AuthType.ClientSecret:
+                credentialIdentity = MsalTokenProvider.digest(authConfig.clientSecret);
+                break;
+            case authConfiguration_1.AuthType.Certificate:
+            case authConfiguration_1.AuthType.CertificateSubjectName:
+                credentialIdentity = MsalTokenProvider.cacheKey(this.getFileCacheIdentity(authConfig.certPemFile), this.getFileCacheIdentity(authConfig.certKeyFile), authConfig.sendX5C);
+                break;
+            case authConfiguration_1.AuthType.WorkloadIdentity:
+                authority = `https://login.microsoftonline.com/${authConfig.tenantId}`;
+                credentialIdentity = this.getFileCacheIdentity((_b = authConfig.federatedTokenFile) !== null && _b !== void 0 ? _b : authConfig.WIDAssertionFile);
+                break;
+            case authConfiguration_1.AuthType.FederatedCredentials:
+                credentialIdentity = (_d = (_c = authConfig.federatedClientId) !== null && _c !== void 0 ? _c : authConfig.FICClientId) !== null && _d !== void 0 ? _d : '';
+                break;
+            case authConfiguration_1.AuthType.UserManagedIdentity:
+                authority = 'managed-identity';
+                credentialIdentity = (_e = authConfig.clientId) !== null && _e !== void 0 ? _e : '';
+                break;
+            case authConfiguration_1.AuthType.SystemManagedIdentity:
+                authority = 'managed-identity';
+                credentialIdentity = 'system';
+                break;
+            default:
+                credentialIdentity = 'unknown';
+        }
+        return MsalTokenProvider.cacheKey('access-token', authType, authority, authConfig.clientId, scope, authConfig.azureRegion, credentialIdentity);
+    }
+    cacheAccessToken(cacheKey, token, expiresOn) {
+        const ttlSeconds = this.getTokenCacheTtlSeconds(token, expiresOn);
+        if (ttlSeconds > 0) {
+            MsalTokenProvider._accessTokenCache.set(cacheKey, token, ttlSeconds);
+        }
+    }
+    cacheAgenticToken(cacheKey, token, ttlSeconds) {
+        const safeTtlSeconds = Math.floor(ttlSeconds) - 300;
+        if (safeTtlSeconds > 0) {
+            MsalTokenProvider._agenticTokenCache.set(cacheKey, token, safeTtlSeconds);
+        }
+    }
+    cacheAgenticAuthenticationResult(cacheKey, token) {
+        const ttlSeconds = this.getTokenCacheTtlSeconds(token.accessToken, token.expiresOn);
+        if (ttlSeconds > 0) {
+            MsalTokenProvider._agenticTokenCache.set(cacheKey, token.accessToken, ttlSeconds);
+        }
+    }
+    getAgenticTokenCacheKey(tenantId, clientId, scopes, tokenBodyParameters) {
+        const bodyKey = Object.keys(tokenBodyParameters)
+            .sort()
+            .filter(key => key !== 'user_federated_identity_credential')
+            .map(key => `${key}=${MsalTokenProvider.digest(String(tokenBodyParameters[key]))}`)
+            .join('&');
+        return MsalTokenProvider.cacheKey('agentic-token', this.resolveAuthority(tenantId), clientId, scopes.join(' '), bodyKey);
+    }
+    getTokenCacheTtlSeconds(token, expiresOn) {
+        var _a;
+        const expiresAtMs = (_a = expiresOn === null || expiresOn === void 0 ? void 0 : expiresOn.getTime()) !== null && _a !== void 0 ? _a : this.getJwtExpiresAtMs(token);
+        if (!expiresAtMs) {
+            return 0;
+        }
+        return Math.floor((expiresAtMs - Date.now()) / 1000) - 300;
+    }
+    getJwtExpiresAtMs(token) {
+        const payload = jsonwebtoken_1.default.decode(token);
+        if (!payload || typeof payload === 'string' || typeof payload.exp !== 'number') {
+            return undefined;
+        }
+        return payload.exp * 1000;
+    }
+    getClientSecretClient(authConfig) {
+        var _a;
+        const cacheKey = MsalTokenProvider.cacheKey('confidential-client', authConfiguration_1.AuthType.ClientSecret, authConfig.clientId, (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId), MsalTokenProvider.digest(authConfig.clientSecret));
+        return this.getOrCreateConfidentialClient(cacheKey, () => {
+            var _a;
+            return new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: authConfig.clientId,
+                    authority: (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId),
+                    clientSecret: authConfig.clientSecret
+                },
+                system: this.sysOptions
+            });
+        });
+    }
+    getCertificateClient(authConfig) {
+        var _a, _b;
+        const cacheKey = MsalTokenProvider.cacheKey('confidential-client', (_a = authConfig.authType) !== null && _a !== void 0 ? _a : authConfiguration_1.AuthType.Certificate, authConfig.clientId, (0, authConfiguration_1.resolveAuthority)((_b = authConfig.authorityEndpoint) !== null && _b !== void 0 ? _b : authConfig.authority, authConfig.tenantId), this.getFileCacheIdentity(authConfig.certPemFile), this.getFileCacheIdentity(authConfig.certKeyFile), authConfig.sendX5C);
+        return this.getOrCreateConfidentialClient(cacheKey, () => {
+            var _a;
+            const privateKeySource = fs_1.default.readFileSync(authConfig.certKeyFile);
+            const privateKeyObject = crypto_2.default.createPrivateKey({
+                key: privateKeySource,
+                format: 'pem'
+            });
+            const privateKey = privateKeyObject.export({
+                format: 'pem',
+                type: 'pkcs8'
+            });
+            const pemFile = fs_1.default.readFileSync(authConfig.certPemFile);
+            const pubKeyObject = new crypto_2.default.X509Certificate(pemFile);
+            return new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: authConfig.clientId || '',
+                    authority: (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId),
+                    clientCertificate: {
+                        privateKey: privateKey,
+                        thumbprint: pubKeyObject.fingerprint.replaceAll(':', ''),
+                        x5c: pemFile.toString()
+                    }
+                },
+                system: this.sysOptions
+            });
+        });
+    }
     async getAccessToken(authConfigOrScope, scope) {
         return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.getAccessToken, async ({ record }) => {
             var _a;
@@ -70,7 +232,7 @@ class MsalTokenProvider {
             if (typeof authConfigOrScope === 'string') {
                 // Called as getAccessToken(scope)
                 if (!this.connectionSettings) {
-                    throw new Error('Connection settings must be provided to constructor when calling getAccessToken(scope)');
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionSettingsRequiredForGetAccessTokenScope);
                 }
                 authConfig = this.connectionSettings;
                 actualScope = authConfigOrScope;
@@ -85,98 +247,72 @@ class MsalTokenProvider {
                 record({ method: 'unknown' });
                 return '';
             }
+            const accessTokenCacheKey = this.getAccessTokenCacheKey(authConfig, actualScope);
+            const cachedAccessToken = MsalTokenProvider._accessTokenCache.get(accessTokenCacheKey);
+            if (cachedAccessToken) {
+                logger.debug('getAccessToken cache hit clientId=%s scope=%s', authConfig.clientId, actualScope);
+                return cachedAccessToken;
+            }
             let token;
-            if (authConfig.authType) {
-                record({ method: authConfig.authType });
-                logger.debug(`getAccessToken via ${authConfig.authType} clientId=${authConfig.clientId} scope=${actualScope}`);
-                switch (authConfig.authType) {
-                    case authConfiguration_1.AuthType.WorkloadIdentity: {
-                        const tokenFilePath = (_a = authConfig.federatedTokenFile) !== null && _a !== void 0 ? _a : authConfig.WIDAssertionFile;
-                        if (!tokenFilePath) {
-                            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.WorkloadIdentityTokenFileRequired);
-                        }
-                        token = await this.acquireAccessTokenViaWID(authConfig, actualScope);
-                        break;
+            const authType = (0, authConfiguration_1.resolveAuthType)(authConfig);
+            record({ method: authType });
+            logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authType, authConfig.clientId, actualScope);
+            switch (authType) {
+                case authConfiguration_1.AuthType.WorkloadIdentity: {
+                    const tokenFilePath = (_a = authConfig.federatedTokenFile) !== null && _a !== void 0 ? _a : authConfig.WIDAssertionFile;
+                    if (!tokenFilePath) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.WorkloadIdentityTokenFileRequired);
                     }
-                    case authConfiguration_1.AuthType.FederatedCredentials:
-                        if (!authConfig.federatedClientId && !authConfig.FICClientId) {
-                            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FICClientIdRequired);
-                        }
-                        token = await this.acquireAccessTokenViaFIC(authConfig, actualScope);
-                        break;
-                    case authConfiguration_1.AuthType.ClientSecret:
-                        if (!authConfig.clientSecret) {
-                            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientSecretRequired);
-                        }
-                        token = await this.acquireAccessTokenViaSecret(authConfig, actualScope);
-                        break;
-                    case authConfiguration_1.AuthType.Certificate:
-                    case authConfiguration_1.AuthType.CertificateSubjectName:
-                        if (!authConfig.certPemFile || !authConfig.certKeyFile) {
-                            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.CertificateFilesRequired);
-                        }
-                        token = await this.acquireTokenWithCertificate(authConfig, actualScope);
-                        break;
-                    case authConfiguration_1.AuthType.UserManagedIdentity:
-                        if (!authConfig.clientId) {
-                            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientIdRequiredForUserManagedIdentity);
-                        }
-                        token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope);
-                        break;
-                    case authConfiguration_1.AuthType.SystemManagedIdentity:
-                        token = await this.acquireTokenWithSystemAssignedIdentity(authConfig, actualScope);
-                        break;
-                    default:
-                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.UnsupportedAuthType, undefined, { authType: authConfig.authType });
+                    token = await this.acquireAccessTokenViaWID(authConfig, actualScope);
+                    break;
                 }
-            }
-            else if (authConfig.WIDAssertionFile !== undefined) {
-                record({ method: authConfiguration_1.AuthType.WorkloadIdentity });
-                logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authConfiguration_1.AuthType.WorkloadIdentity, authConfig.clientId, actualScope);
-                token = await this.acquireAccessTokenViaWID(authConfig, actualScope);
-            }
-            else if (authConfig.federatedClientId !== undefined || authConfig.FICClientId !== undefined) {
-                record({ method: authConfiguration_1.AuthType.FederatedCredentials });
-                logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authConfiguration_1.AuthType.FederatedCredentials, authConfig.clientId, actualScope);
-                token = await this.acquireAccessTokenViaFIC(authConfig, actualScope);
-            }
-            else if (authConfig.clientSecret !== undefined) {
-                record({ method: authConfiguration_1.AuthType.ClientSecret });
-                logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authConfiguration_1.AuthType.ClientSecret, authConfig.clientId, actualScope);
-                token = await this.acquireAccessTokenViaSecret(authConfig, actualScope);
-            }
-            else if (authConfig.certPemFile !== undefined &&
-                authConfig.certKeyFile !== undefined) {
-                record({ method: authConfiguration_1.AuthType.Certificate });
-                logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authConfiguration_1.AuthType.Certificate, authConfig.clientId, actualScope);
-                token = await this.acquireTokenWithCertificate(authConfig, actualScope);
-            }
-            else if (authConfig.clientSecret === undefined &&
-                authConfig.certPemFile === undefined &&
-                authConfig.certKeyFile === undefined) {
-                record({ method: authConfiguration_1.AuthType.UserManagedIdentity });
-                logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authConfiguration_1.AuthType.UserManagedIdentity, authConfig.clientId, actualScope);
-                token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope);
-            }
-            else {
-                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.InvalidAuthConfig);
+                case authConfiguration_1.AuthType.FederatedCredentials:
+                    if (!authConfig.federatedClientId && !authConfig.FICClientId) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FICClientIdRequired);
+                    }
+                    token = await this.acquireAccessTokenViaFIC(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.ClientSecret:
+                    if (!authConfig.clientSecret) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientSecretRequired);
+                    }
+                    token = await this.acquireAccessTokenViaSecret(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.Certificate:
+                case authConfiguration_1.AuthType.CertificateSubjectName:
+                    if (!authConfig.certPemFile || !authConfig.certKeyFile) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.CertificateFilesRequired);
+                    }
+                    token = await this.acquireTokenWithCertificate(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.UserManagedIdentity:
+                    if (!authConfig.clientId) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientIdRequiredForUserManagedIdentity);
+                    }
+                    token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.SystemManagedIdentity:
+                    token = await this.acquireTokenWithSystemAssignedIdentity(authConfig, actualScope);
+                    break;
+                default:
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.UnsupportedAuthType, undefined, { authType });
             }
             if (token === undefined) {
                 throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireToken);
             }
+            this.cacheAccessToken(accessTokenCacheKey, token);
             return token;
         });
     }
     async acquireTokenOnBehalfOf(authConfigOrScopes, scopesOrOboAssertion, oboAssertion) {
         return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.acquireTokenOnBehalfOf, async ({ record }) => {
-            var _a;
             let authConfig;
             let actualScopes;
             let actualOboAssertion;
             if (Array.isArray(authConfigOrScopes)) {
                 // Called as acquireTokenOnBehalfOf(scopes, oboAssertion)
                 if (!this.connectionSettings) {
-                    throw new Error('Connection settings must be provided to constructor when calling acquireTokenOnBehalfOf(scopes, oboAssertion)');
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionSettingsRequiredForAcquireTokenOnBehalfOf);
                 }
                 authConfig = this.connectionSettings;
                 actualScopes = authConfigOrScopes;
@@ -190,20 +326,13 @@ class MsalTokenProvider {
             }
             record({ scopes: actualScopes });
             logger.debug('acquireTokenOnBehalfOf clientId=%s scopes=%o', authConfig.clientId, actualScopes);
-            const cca = new msal_node_1.ConfidentialClientApplication({
-                auth: {
-                    clientId: authConfig.clientId,
-                    authority: `${(_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
-                    clientSecret: authConfig.clientSecret
-                },
-                system: this.sysOptions
-            });
+            const cca = this.getClientSecretClient(authConfig);
             const token = await cca.acquireTokenOnBehalfOf({
                 oboAssertion: actualOboAssertion,
                 scopes: actualScopes
             });
             if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
-                throw new Error('Failed to acquire token on behalf of user');
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireTokenOnBehalfOf);
             }
             return token.accessToken;
         });
@@ -214,7 +343,12 @@ class MsalTokenProvider {
             logger.debug('getAgenticInstanceToken tenantId=%s agentAppInstanceId=%s', tenantId, agentAppInstanceId);
             record({ agenticInstanceId: agentAppInstanceId });
             if (!this.connectionSettings) {
-                throw new Error('Connection settings must be provided when calling getAgenticInstanceToken');
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionSettingsRequiredForGetAgenticInstanceToken);
+            }
+            const instanceTokenCacheKey = MsalTokenProvider.cacheKey('agentic-instance-token', this.resolveAuthority(tenantId), agentAppInstanceId, this.connectionSettings.clientId, this.connectionSettings.azureRegion);
+            const cachedInstanceToken = MsalTokenProvider._agenticTokenCache.get(instanceTokenCacheKey);
+            if (cachedInstanceToken) {
+                return cachedInstanceToken;
             }
             const appToken = await this.getAgenticApplicationToken(tenantId, agentAppInstanceId);
             const cca = new msal_node_1.ConfidentialClientApplication({
@@ -231,8 +365,9 @@ class MsalTokenProvider {
                 azureRegion: (_a = this.connectionSettings) === null || _a === void 0 ? void 0 : _a.azureRegion
             });
             if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
-                throw new Error(`Failed to acquire instance token for agent instance: ${agentAppInstanceId}`);
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireInstanceTokenForAgentInstance, undefined, { agentAppInstanceId });
             }
+            this.cacheAgenticAuthenticationResult(instanceTokenCacheKey, token);
             return token.accessToken;
         });
     }
@@ -271,13 +406,13 @@ class MsalTokenProvider {
      */
     async acquireTokenForAgenticScenarios(tenantId, clientId, clientAssertion, scopes, tokenBodyParameters) {
         if (!this.connectionSettings) {
-            throw new Error('Connection settings must be provided when calling getAgenticInstanceToken');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionSettingsRequiredForGetAgenticInstanceToken);
         }
         logger.debug('acquireTokenForAgenticScenarios clientId=%s tenantId=%s scopes=%o grant_type=%s', clientId, tenantId, scopes, tokenBodyParameters.grant_type);
         // Check cache first
-        const cacheKey = `${clientId}/${Object.keys(tokenBodyParameters).map(key => key !== 'user_federated_identity_credential' ? `${key}=${tokenBodyParameters[key]}` : '').join('&')}/${scopes.join(';')}`;
-        if (this._agenticTokenCache.get(cacheKey)) {
-            return this._agenticTokenCache.get(cacheKey);
+        const cacheKey = this.getAgenticTokenCacheKey(tenantId, clientId, scopes, tokenBodyParameters);
+        if (MsalTokenProvider._agenticTokenCache.get(cacheKey)) {
+            return MsalTokenProvider._agenticTokenCache.get(cacheKey);
         }
         const url = `${this.resolveAuthority(tenantId)}/oauth2/v2.0/token`;
         const data = {
@@ -324,39 +459,48 @@ class MsalTokenProvider {
             clearTimeout(timeoutId);
         });
         // capture token, expire local cache 5 minutes early
-        this._agenticTokenCache.set(cacheKey, token.access_token, token.expires_in - 300);
+        this.cacheAgenticToken(cacheKey, token.access_token, token.expires_in);
         return token.access_token;
     }
     async getAgenticUserToken(tenantId, agentAppInstanceId, agenticUserId, scopes) {
         return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.getAgenticUserToken, async ({ record }) => {
             logger.debug('getAgenticUserToken tenantId=%s agentAppInstanceId=%s scopes=%o', tenantId, agentAppInstanceId, scopes);
             record({ agenticInstanceId: agentAppInstanceId, agenticUserId, scopes });
+            const userTokenParameters = {
+                user_id: agenticUserId,
+                grant_type: 'user_fic',
+            };
+            const userTokenCacheKey = this.getAgenticTokenCacheKey(tenantId, agentAppInstanceId, scopes, userTokenParameters);
+            const cachedUserToken = MsalTokenProvider._agenticTokenCache.get(userTokenCacheKey);
+            if (cachedUserToken) {
+                return cachedUserToken;
+            }
             const agentToken = await this.getAgenticApplicationToken(tenantId, agentAppInstanceId);
             const instanceToken = await this.getAgenticInstanceToken(tenantId, agentAppInstanceId);
             const token = await this.acquireTokenForAgenticScenarios(tenantId, agentAppInstanceId, agentToken, scopes, {
-                user_id: agenticUserId,
+                ...userTokenParameters,
                 user_federated_identity_credential: instanceToken,
-                grant_type: 'user_fic',
             });
             if (!token) {
-                throw new Error(`Failed to acquire instance token for user token: ${agentAppInstanceId}`);
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireInstanceTokenForUserToken, undefined, { agentAppInstanceId });
             }
             return token;
         });
     }
     async getAgenticApplicationToken(tenantId, agentAppInstanceId) {
-        var _a, _b, _c;
+        var _a, _b;
         if (!((_a = this.connectionSettings) === null || _a === void 0 ? void 0 : _a.clientId)) {
-            throw new Error('Connection settings must be provided when calling getAgenticApplicationToken');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionSettingsRequiredForGetAgenticApplicationToken);
         }
         logger.debug('getAgenticApplicationToken clientId=%s tenantId=%s agentAppInstanceId=%s', this.connectionSettings.clientId, tenantId, agentAppInstanceId);
-        if (this.connectionSettings.authType === authConfiguration_1.AuthType.IdentityProxyManager) {
+        const authType = (0, authConfiguration_1.resolveAuthType)(this.connectionSettings);
+        if (authType === authConfiguration_1.AuthType.IdentityProxyManager) {
             let resource;
             if (!this.connectionSettings.idpmResource) {
                 resource = 'api://AzureAdTokenExchange/.default';
             }
             else if (!URL.canParse(this.connectionSettings.idpmResource)) {
-                throw new Error('idpmResource must be a valid absolute URI');
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.IdpmResourceAbsoluteUriRequired);
             }
             else {
                 resource = this.connectionSettings.idpmResource;
@@ -369,54 +513,41 @@ class MsalTokenProvider {
             });
             const tokenResult = await msiApp.acquireToken({ resource });
             if (!(tokenResult === null || tokenResult === void 0 ? void 0 : tokenResult.accessToken)) {
-                throw new Error(`Failed to acquire token via IdentityProxyManager for agent instance: ${agentAppInstanceId}`);
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireTokenViaIdentityProxyManagerForAgentInstance, undefined, { agentAppInstanceId });
             }
             logger.debug('getAgenticApplicationToken via IdentityProxyManager clientId=%s resource=%s', this.connectionSettings.clientId, resource);
             return tokenResult.accessToken;
         }
         let clientAssertion;
-        if (this.connectionSettings.authType) {
-            switch (this.connectionSettings.authType) {
-                case authConfiguration_1.AuthType.WorkloadIdentity: {
-                    const tokenFilePath = (_b = this.connectionSettings.federatedTokenFile) !== null && _b !== void 0 ? _b : this.connectionSettings.WIDAssertionFile;
-                    if (tokenFilePath === undefined) {
-                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.WorkloadIdentityTokenFileRequired);
-                    }
-                    clientAssertion = fs_1.default.readFileSync(tokenFilePath, 'utf8');
-                    break;
+        switch (authType) {
+            case authConfiguration_1.AuthType.WorkloadIdentity: {
+                const tokenFilePath = (_b = this.connectionSettings.federatedTokenFile) !== null && _b !== void 0 ? _b : this.connectionSettings.WIDAssertionFile;
+                if (tokenFilePath === undefined) {
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.WorkloadIdentityTokenFileRequired);
                 }
-                case authConfiguration_1.AuthType.FederatedCredentials:
-                    if (!this.connectionSettings.federatedClientId && !this.connectionSettings.FICClientId) {
-                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FICClientIdRequired);
-                    }
-                    clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId || this.connectionSettings.FICClientId);
-                    break;
-                case authConfiguration_1.AuthType.Certificate:
-                case authConfiguration_1.AuthType.CertificateSubjectName:
-                    if (!this.connectionSettings.certPemFile || !this.connectionSettings.certKeyFile) {
-                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.CertificateFilesRequired);
-                    }
-                    clientAssertion = this.getAssertionFromCert(this.connectionSettings);
-                    break;
+                clientAssertion = fs_1.default.readFileSync(tokenFilePath, 'utf8');
+                break;
             }
-        }
-        else if (this.connectionSettings.WIDAssertionFile !== undefined) {
-            const tokenFilePath = (_c = this.connectionSettings.federatedTokenFile) !== null && _c !== void 0 ? _c : this.connectionSettings.WIDAssertionFile;
-            clientAssertion = fs_1.default.readFileSync(tokenFilePath, 'utf8');
-        }
-        else if (this.connectionSettings.federatedClientId !== undefined || this.connectionSettings.FICClientId !== undefined) {
-            clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId || this.connectionSettings.FICClientId);
-        }
-        else if (this.connectionSettings.certPemFile !== undefined &&
-            this.connectionSettings.certKeyFile !== undefined) {
-            clientAssertion = this.getAssertionFromCert(this.connectionSettings);
+            case authConfiguration_1.AuthType.FederatedCredentials:
+                if (!this.connectionSettings.federatedClientId && !this.connectionSettings.FICClientId) {
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FICClientIdRequired);
+                }
+                clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId || this.connectionSettings.FICClientId);
+                break;
+            case authConfiguration_1.AuthType.Certificate:
+            case authConfiguration_1.AuthType.CertificateSubjectName:
+                if (!this.connectionSettings.certPemFile || !this.connectionSettings.certKeyFile) {
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.CertificateFilesRequired);
+                }
+                clientAssertion = this.getAssertionFromCert(this.connectionSettings);
+                break;
         }
         const token = await this.acquireTokenForAgenticScenarios(tenantId, this.connectionSettings.clientId, clientAssertion, ['api://AzureAdTokenExchange/.default'], {
             grant_type: 'client_credentials',
             fmi_path: agentAppInstanceId,
         });
         if (!token) {
-            throw new Error(`Failed to acquire token for agent instance: ${agentAppInstanceId}`);
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireInstanceTokenForAgentInstance, undefined, { agentAppInstanceId });
         }
         return token;
     }
@@ -491,37 +622,14 @@ class MsalTokenProvider {
      * @returns A promise that resolves to the access token.
      */
     async acquireTokenWithCertificate(authConfig, scope) {
-        var _a;
-        const privateKeySource = fs_1.default.readFileSync(authConfig.certKeyFile);
-        const privateKeyObject = crypto_2.default.createPrivateKey({
-            key: privateKeySource,
-            format: 'pem'
-        });
-        const privateKey = privateKeyObject.export({
-            format: 'pem',
-            type: 'pkcs8'
-        });
-        const pemFile = fs_1.default.readFileSync(authConfig.certPemFile);
-        const pubKeyObject = new crypto_2.default.X509Certificate(pemFile);
-        const cca = new msal_node_1.ConfidentialClientApplication({
-            auth: {
-                clientId: authConfig.clientId || '',
-                authority: `${(_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
-                clientCertificate: {
-                    privateKey: privateKey,
-                    thumbprint: pubKeyObject.fingerprint.replaceAll(':', ''),
-                    x5c: pemFile.toString()
-                }
-            },
-            system: this.sysOptions
-        });
+        const cca = this.getCertificateClient(authConfig);
         const token = await cca.acquireTokenByClientCredential({
             scopes: [`${scope}/.default`],
             correlationId: (0, crypto_1.randomUUID)(),
             azureRegion: authConfig.azureRegion
         });
         if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
-            throw new Error('Failed to acquire token using certificate');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireTokenUsingCertificate);
         }
         return token.accessToken;
     }
@@ -532,22 +640,14 @@ class MsalTokenProvider {
      * @returns A promise that resolves to the access token.
      */
     async acquireAccessTokenViaSecret(authConfig, scope) {
-        var _a;
-        const cca = new msal_node_1.ConfidentialClientApplication({
-            auth: {
-                clientId: authConfig.clientId,
-                authority: `${(_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority}/${authConfig.tenantId || 'botframework.com'}`,
-                clientSecret: authConfig.clientSecret
-            },
-            system: this.sysOptions
-        });
+        const cca = this.getClientSecretClient(authConfig);
         const token = await cca.acquireTokenByClientCredential({
             scopes: [`${scope}/.default`],
             correlationId: (0, crypto_1.randomUUID)(),
             azureRegion: authConfig.azureRegion
         });
         if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
-            throw new Error('Failed to acquire token using client secret');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireTokenUsingClientSecret);
         }
         return token.accessToken;
     }
@@ -572,7 +672,7 @@ class MsalTokenProvider {
         const token = await cca.acquireTokenByClientCredential({ scopes, azureRegion: authConfig.azureRegion });
         logger.debug('got token using FIC client assertion');
         if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
-            throw new Error('Failed to acquire token using FIC client assertion');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireTokenUsingFICClientAssertion);
         }
         return token.accessToken;
     }
@@ -598,7 +698,7 @@ class MsalTokenProvider {
         const token = await cca.acquireTokenByClientCredential({ scopes, azureRegion: authConfig.azureRegion });
         logger.debug('got token using WID client assertion');
         if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
-            throw new Error('Failed to acquire token using WID client assertion');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireTokenUsingWIDClientAssertion);
         }
         return token.accessToken;
     }
@@ -620,10 +720,14 @@ class MsalTokenProvider {
         });
         logger.debug('got token for FIC');
         if (!(response === null || response === void 0 ? void 0 : response.accessToken)) {
-            throw new Error('Failed to acquire external token for FIC client assertion');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireExternalTokenForFICClientAssertion);
         }
         return response.accessToken;
     }
 }
 exports.MsalTokenProvider = MsalTokenProvider;
+MsalTokenProvider._accessTokenCache = new MemoryCache_1.MemoryCache();
+MsalTokenProvider._agenticTokenCache = new MemoryCache_1.MemoryCache();
+MsalTokenProvider._confidentialClients = new Map();
+MsalTokenProvider._maxConfidentialClients = 100;
 //# sourceMappingURL=msalTokenProvider.js.map