microsoft-agents-authentication-msal 0.4.0.dev18__py3-none-any.whl → 0.5.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- microsoft_agents/authentication/msal/msal_auth.py +72 -47
- microsoft_agents/authentication/msal/msal_connection_manager.py +11 -5
- microsoft_agents_authentication_msal-0.5.0.dist-info/METADATA +166 -0
- microsoft_agents_authentication_msal-0.5.0.dist-info/RECORD +8 -0
- microsoft_agents_authentication_msal-0.5.0.dist-info/licenses/LICENSE +21 -0
- microsoft_agents_authentication_msal-0.4.0.dev18.dist-info/METADATA +0 -15
- microsoft_agents_authentication_msal-0.4.0.dev18.dist-info/RECORD +0 -7
- {microsoft_agents_authentication_msal-0.4.0.dev18.dist-info → microsoft_agents_authentication_msal-0.5.0.dist-info}/WHEEL +0 -0
- {microsoft_agents_authentication_msal-0.4.0.dev18.dist-info → microsoft_agents_authentication_msal-0.5.0.dist-info}/top_level.txt +0 -0
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
|
|
4
4
|
from __future__ import annotations
|
|
5
5
|
|
|
6
|
+
import asyncio
|
|
6
7
|
import logging
|
|
7
8
|
import jwt
|
|
8
9
|
from typing import Optional
|
|
@@ -39,12 +40,29 @@ class _DeferredLogOfBlueprintId:
|
|
|
39
40
|
return f"Agentic blueprint id: {agentic_blueprint_id}"
|
|
40
41
|
|
|
41
42
|
|
|
43
|
+
async def _async_acquire_token_for_client(msal_auth_client, *args, **kwargs):
|
|
44
|
+
"""MSAL in Python does not support async, so we use asyncio.to_thread to run it in
|
|
45
|
+
a separate thread and avoid blocking the event loop
|
|
46
|
+
"""
|
|
47
|
+
return await asyncio.to_thread(
|
|
48
|
+
lambda: msal_auth_client.acquire_token_for_client(*args, **kwargs)
|
|
49
|
+
)
|
|
50
|
+
|
|
51
|
+
|
|
42
52
|
class MsalAuth(AccessTokenProviderBase):
|
|
43
53
|
|
|
44
54
|
_client_credential_cache = None
|
|
45
55
|
|
|
46
56
|
def __init__(self, msal_configuration: AgentAuthConfiguration):
|
|
57
|
+
"""Initializes the MsalAuth class with the given configuration.
|
|
58
|
+
|
|
59
|
+
:param msal_configuration: The MSAL authentication configuration. Assumed to
|
|
60
|
+
not be mutated after being passed in.
|
|
61
|
+
:type msal_configuration: AgentAuthConfiguration
|
|
62
|
+
"""
|
|
63
|
+
|
|
47
64
|
self._msal_configuration = msal_configuration
|
|
65
|
+
self._msal_auth_client = None
|
|
48
66
|
logger.debug(
|
|
49
67
|
f"Initializing MsalAuth with configuration: {self._msal_configuration}"
|
|
50
68
|
)
|
|
@@ -60,17 +78,17 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
60
78
|
raise ValueError("Invalid instance URL")
|
|
61
79
|
|
|
62
80
|
local_scopes = self._resolve_scopes_list(instance_uri, scopes)
|
|
63
|
-
|
|
81
|
+
self._create_client_application()
|
|
64
82
|
|
|
65
|
-
if isinstance(
|
|
83
|
+
if isinstance(self._msal_auth_client, ManagedIdentityClient):
|
|
66
84
|
logger.info("Acquiring token using Managed Identity Client.")
|
|
67
|
-
auth_result_payload =
|
|
68
|
-
resource=resource_url
|
|
85
|
+
auth_result_payload = await _async_acquire_token_for_client(
|
|
86
|
+
self._msal_auth_client, resource=resource_url
|
|
69
87
|
)
|
|
70
|
-
elif isinstance(
|
|
88
|
+
elif isinstance(self._msal_auth_client, ConfidentialClientApplication):
|
|
71
89
|
logger.info("Acquiring token using Confidential Client Application.")
|
|
72
|
-
auth_result_payload =
|
|
73
|
-
scopes=local_scopes
|
|
90
|
+
auth_result_payload = await _async_acquire_token_for_client(
|
|
91
|
+
self._msal_auth_client, scopes=local_scopes
|
|
74
92
|
)
|
|
75
93
|
else:
|
|
76
94
|
auth_result_payload = None
|
|
@@ -79,6 +97,7 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
79
97
|
if not res:
|
|
80
98
|
logger.error("Failed to acquire token for resource %s", auth_result_payload)
|
|
81
99
|
raise ValueError(f"Failed to acquire token. {str(auth_result_payload)}")
|
|
100
|
+
|
|
82
101
|
return res
|
|
83
102
|
|
|
84
103
|
async def acquire_token_on_behalf_of(
|
|
@@ -91,19 +110,23 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
91
110
|
:return: The access token as a string.
|
|
92
111
|
"""
|
|
93
112
|
|
|
94
|
-
|
|
95
|
-
if isinstance(
|
|
113
|
+
self._create_client_application()
|
|
114
|
+
if isinstance(self._msal_auth_client, ManagedIdentityClient):
|
|
96
115
|
logger.error(
|
|
97
116
|
"Attempted on-behalf-of flow with Managed Identity authentication."
|
|
98
117
|
)
|
|
99
118
|
raise NotImplementedError(
|
|
100
119
|
"On-behalf-of flow is not supported with Managed Identity authentication."
|
|
101
120
|
)
|
|
102
|
-
elif isinstance(
|
|
121
|
+
elif isinstance(self._msal_auth_client, ConfidentialClientApplication):
|
|
103
122
|
# TODO: Handling token error / acquisition failed
|
|
104
123
|
|
|
105
|
-
|
|
106
|
-
|
|
124
|
+
# MSAL in Python does not support async, so we use asyncio.to_thread to run it in
|
|
125
|
+
# a separate thread and avoid blocking the event loop
|
|
126
|
+
token = await asyncio.to_thread(
|
|
127
|
+
lambda: self._msal_auth_client.acquire_token_on_behalf_of(
|
|
128
|
+
scopes=scopes, user_assertion=user_assertion
|
|
129
|
+
)
|
|
107
130
|
)
|
|
108
131
|
|
|
109
132
|
if "access_token" not in token:
|
|
@@ -115,19 +138,19 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
115
138
|
return token["access_token"]
|
|
116
139
|
|
|
117
140
|
logger.error(
|
|
118
|
-
f"On-behalf-of flow is not supported with the current authentication type: {
|
|
141
|
+
f"On-behalf-of flow is not supported with the current authentication type: {self._msal_auth_client.__class__.__name__}"
|
|
119
142
|
)
|
|
120
143
|
raise NotImplementedError(
|
|
121
|
-
f"On-behalf-of flow is not supported with the current authentication type: {
|
|
144
|
+
f"On-behalf-of flow is not supported with the current authentication type: {self._msal_auth_client.__class__.__name__}"
|
|
122
145
|
)
|
|
123
146
|
|
|
124
|
-
def _create_client_application(
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
147
|
+
def _create_client_application(self) -> None:
|
|
148
|
+
|
|
149
|
+
if self._msal_auth_client:
|
|
150
|
+
return
|
|
128
151
|
|
|
129
152
|
if self._msal_configuration.AUTH_TYPE == AuthTypes.user_managed_identity:
|
|
130
|
-
|
|
153
|
+
self._msal_auth_client = ManagedIdentityClient(
|
|
131
154
|
UserAssignedManagedIdentity(
|
|
132
155
|
client_id=self._msal_configuration.CLIENT_ID
|
|
133
156
|
),
|
|
@@ -135,7 +158,7 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
135
158
|
)
|
|
136
159
|
|
|
137
160
|
elif self._msal_configuration.AUTH_TYPE == AuthTypes.system_managed_identity:
|
|
138
|
-
|
|
161
|
+
self._msal_auth_client = ManagedIdentityClient(
|
|
139
162
|
SystemAssignedManagedIdentity(),
|
|
140
163
|
http_client=Session(),
|
|
141
164
|
)
|
|
@@ -176,14 +199,12 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
176
199
|
)
|
|
177
200
|
raise NotImplementedError("Authentication type not supported")
|
|
178
201
|
|
|
179
|
-
|
|
202
|
+
self._msal_auth_client = ConfidentialClientApplication(
|
|
180
203
|
client_id=self._msal_configuration.CLIENT_ID,
|
|
181
204
|
authority=authority,
|
|
182
205
|
client_credential=self._client_credential_cache,
|
|
183
206
|
)
|
|
184
207
|
|
|
185
|
-
return msal_auth_client
|
|
186
|
-
|
|
187
208
|
@staticmethod
|
|
188
209
|
def _uri_validator(url_str: str) -> tuple[bool, Optional[URI]]:
|
|
189
210
|
try:
|
|
@@ -228,12 +249,13 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
228
249
|
"Attempting to get agentic application token from agent_app_instance_id %s",
|
|
229
250
|
agent_app_instance_id,
|
|
230
251
|
)
|
|
231
|
-
|
|
252
|
+
self._create_client_application()
|
|
232
253
|
|
|
233
|
-
if isinstance(
|
|
254
|
+
if isinstance(self._msal_auth_client, ConfidentialClientApplication):
|
|
234
255
|
|
|
235
256
|
# https://github.dev/AzureAD/microsoft-authentication-library-for-dotnet
|
|
236
|
-
auth_result_payload =
|
|
257
|
+
auth_result_payload = await _async_acquire_token_for_client(
|
|
258
|
+
self._msal_auth_client,
|
|
237
259
|
["api://AzureAdTokenExchange/.default"],
|
|
238
260
|
data={"fmi_path": agent_app_instance_id},
|
|
239
261
|
)
|
|
@@ -284,8 +306,8 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
284
306
|
client_credential={"client_assertion": agent_token_result},
|
|
285
307
|
)
|
|
286
308
|
|
|
287
|
-
agentic_instance_token =
|
|
288
|
-
["api://AzureAdTokenExchange/.default"]
|
|
309
|
+
agentic_instance_token = await _async_acquire_token_for_client(
|
|
310
|
+
instance_app, ["api://AzureAdTokenExchange/.default"]
|
|
289
311
|
)
|
|
290
312
|
|
|
291
313
|
if not agentic_instance_token:
|
|
@@ -311,28 +333,28 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
311
333
|
return agentic_instance_token["access_token"], agent_token_result
|
|
312
334
|
|
|
313
335
|
async def get_agentic_user_token(
|
|
314
|
-
self, agent_app_instance_id: str,
|
|
336
|
+
self, agent_app_instance_id: str, agentic_user_id: str, scopes: list[str]
|
|
315
337
|
) -> Optional[str]:
|
|
316
|
-
"""Gets the agentic user token for the given agent application instance ID and user
|
|
338
|
+
"""Gets the agentic user token for the given agent application instance ID and agentic user Id and the scopes.
|
|
317
339
|
|
|
318
340
|
:param agent_app_instance_id: The agent application instance ID.
|
|
319
341
|
:type agent_app_instance_id: str
|
|
320
|
-
:param
|
|
321
|
-
:type
|
|
342
|
+
:param agentic_user_id: The agentic user ID.
|
|
343
|
+
:type agentic_user_id: str
|
|
322
344
|
:param scopes: The scopes to request for the token.
|
|
323
345
|
:type scopes: list[str]
|
|
324
346
|
:return: The agentic user token, or None if not found.
|
|
325
347
|
:rtype: Optional[str]
|
|
326
348
|
"""
|
|
327
|
-
if not agent_app_instance_id or not
|
|
349
|
+
if not agent_app_instance_id or not agentic_user_id:
|
|
328
350
|
raise ValueError(
|
|
329
|
-
"Agent application instance Id and user
|
|
351
|
+
"Agent application instance Id and agentic user Id must be provided."
|
|
330
352
|
)
|
|
331
353
|
|
|
332
354
|
logger.info(
|
|
333
|
-
"Attempting to get agentic user token from agent_app_instance_id %s and
|
|
355
|
+
"Attempting to get agentic user token from agent_app_instance_id %s and agentic_user_id %s",
|
|
334
356
|
agent_app_instance_id,
|
|
335
|
-
|
|
357
|
+
agentic_user_id,
|
|
336
358
|
)
|
|
337
359
|
instance_token, agent_token = await self.get_agentic_instance_token(
|
|
338
360
|
agent_app_instance_id
|
|
@@ -340,12 +362,12 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
340
362
|
|
|
341
363
|
if not instance_token or not agent_token:
|
|
342
364
|
logger.error(
|
|
343
|
-
"Failed to acquire instance token or agent token for agent_app_instance_id %s and
|
|
365
|
+
"Failed to acquire instance token or agent token for agent_app_instance_id %s and agentic_user_id %s",
|
|
344
366
|
agent_app_instance_id,
|
|
345
|
-
|
|
367
|
+
agentic_user_id,
|
|
346
368
|
)
|
|
347
369
|
raise Exception(
|
|
348
|
-
f"Failed to acquire instance token or agent token for agent_app_instance_id {agent_app_instance_id} and
|
|
370
|
+
f"Failed to acquire instance token or agent token for agent_app_instance_id {agent_app_instance_id} and agentic_user_id {agentic_user_id}"
|
|
349
371
|
)
|
|
350
372
|
|
|
351
373
|
authority = (
|
|
@@ -359,14 +381,17 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
359
381
|
)
|
|
360
382
|
|
|
361
383
|
logger.info(
|
|
362
|
-
"Acquiring agentic user token for agent_app_instance_id %s and
|
|
384
|
+
"Acquiring agentic user token for agent_app_instance_id %s and agentic_user_id %s",
|
|
363
385
|
agent_app_instance_id,
|
|
364
|
-
|
|
386
|
+
agentic_user_id,
|
|
365
387
|
)
|
|
366
|
-
|
|
388
|
+
# MSAL in Python does not support async, so we use asyncio.to_thread to run it in
|
|
389
|
+
# a separate thread and avoid blocking the event loop
|
|
390
|
+
auth_result_payload = await _async_acquire_token_for_client(
|
|
391
|
+
instance_app,
|
|
367
392
|
scopes,
|
|
368
393
|
data={
|
|
369
|
-
"
|
|
394
|
+
"user_id": agentic_user_id,
|
|
370
395
|
"user_federated_identity_credential": instance_token,
|
|
371
396
|
"grant_type": "user_fic",
|
|
372
397
|
},
|
|
@@ -374,9 +399,9 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
374
399
|
|
|
375
400
|
if not auth_result_payload:
|
|
376
401
|
logger.error(
|
|
377
|
-
"Failed to acquire agentic user token for agent_app_instance_id %s and
|
|
402
|
+
"Failed to acquire agentic user token for agent_app_instance_id %s and agentic_user_id %s, %s",
|
|
378
403
|
agent_app_instance_id,
|
|
379
|
-
|
|
404
|
+
agentic_user_id,
|
|
380
405
|
auth_result_payload,
|
|
381
406
|
)
|
|
382
407
|
return None
|
|
@@ -384,9 +409,9 @@ class MsalAuth(AccessTokenProviderBase):
|
|
|
384
409
|
access_token = auth_result_payload.get("access_token")
|
|
385
410
|
if not access_token:
|
|
386
411
|
logger.error(
|
|
387
|
-
"Failed to acquire agentic user token for agent_app_instance_id %s and
|
|
412
|
+
"Failed to acquire agentic user token for agent_app_instance_id %s and agentic_user_id %s, %s",
|
|
388
413
|
agent_app_instance_id,
|
|
389
|
-
|
|
414
|
+
agentic_user_id,
|
|
390
415
|
auth_result_payload,
|
|
391
416
|
)
|
|
392
417
|
return None
|
|
@@ -28,7 +28,7 @@ class MsalConnectionManager(Connections):
|
|
|
28
28
|
Initialize the MSAL connection manager.
|
|
29
29
|
|
|
30
30
|
:arg connections_configurations: A dictionary of connection configurations.
|
|
31
|
-
:type connections_configurations: Dict[str, AgentAuthConfiguration]
|
|
31
|
+
:type connections_configurations: Dict[str, :class:`microsoft_agents.hosting.core.AgentAuthConfiguration`]
|
|
32
32
|
:arg connections_map: A list of connection mappings.
|
|
33
33
|
:type connections_map: List[Dict[str, str]]
|
|
34
34
|
:raises ValueError: If no service connection configuration is provided.
|
|
@@ -64,9 +64,9 @@ class MsalConnectionManager(Connections):
|
|
|
64
64
|
Get the OAuth connection for the agent.
|
|
65
65
|
|
|
66
66
|
:arg connection_name: The name of the connection.
|
|
67
|
-
:type connection_name: str
|
|
67
|
+
:type connection_name: Optional[str]
|
|
68
68
|
:return: The OAuth connection for the agent.
|
|
69
|
-
:rtype: AccessTokenProviderBase
|
|
69
|
+
:rtype: :class:`microsoft_agents.hosting.core.AccessTokenProviderBase`
|
|
70
70
|
"""
|
|
71
71
|
# should never be None
|
|
72
72
|
return self._connections.get(connection_name, None)
|
|
@@ -74,6 +74,9 @@ class MsalConnectionManager(Connections):
|
|
|
74
74
|
def get_default_connection(self) -> AccessTokenProviderBase:
|
|
75
75
|
"""
|
|
76
76
|
Get the default OAuth connection for the agent.
|
|
77
|
+
|
|
78
|
+
:return: The default OAuth connection for the agent.
|
|
79
|
+
:rtype: :class:`microsoft_agents.hosting.core.AccessTokenProviderBase`
|
|
77
80
|
"""
|
|
78
81
|
# should never be None
|
|
79
82
|
return self._connections.get("SERVICE_CONNECTION", None)
|
|
@@ -85,11 +88,11 @@ class MsalConnectionManager(Connections):
|
|
|
85
88
|
Get the OAuth token provider for the agent.
|
|
86
89
|
|
|
87
90
|
:arg claims_identity: The claims identity of the bot.
|
|
88
|
-
:type claims_identity: ClaimsIdentity
|
|
91
|
+
:type claims_identity: :class:`microsoft_agents.hosting.core.ClaimsIdentity`
|
|
89
92
|
:arg service_url: The service URL of the bot.
|
|
90
93
|
:type service_url: str
|
|
91
94
|
:return: The OAuth token provider for the agent.
|
|
92
|
-
:rtype: AccessTokenProviderBase
|
|
95
|
+
:rtype: :class:`microsoft_agents.hosting.core.AccessTokenProviderBase`
|
|
93
96
|
:raises ValueError: If no connection is found for the given audience and service URL.
|
|
94
97
|
"""
|
|
95
98
|
if not claims_identity or not service_url:
|
|
@@ -130,5 +133,8 @@ class MsalConnectionManager(Connections):
|
|
|
130
133
|
def get_default_connection_configuration(self) -> AgentAuthConfiguration:
|
|
131
134
|
"""
|
|
132
135
|
Get the default connection configuration for the agent.
|
|
136
|
+
|
|
137
|
+
:return: The default connection configuration for the agent.
|
|
138
|
+
:rtype: :class:`microsoft_agents.hosting.core.AgentAuthConfiguration`
|
|
133
139
|
"""
|
|
134
140
|
return self._service_connection_configuration
|
|
@@ -0,0 +1,166 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: microsoft-agents-authentication-msal
|
|
3
|
+
Version: 0.5.0
|
|
4
|
+
Summary: A msal-based authentication library for Microsoft Agents
|
|
5
|
+
Author: Microsoft Corporation
|
|
6
|
+
License-Expression: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/microsoft/Agents
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
10
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
11
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
12
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
13
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
14
|
+
Classifier: Operating System :: OS Independent
|
|
15
|
+
Requires-Python: >=3.10
|
|
16
|
+
Description-Content-Type: text/markdown
|
|
17
|
+
License-File: LICENSE
|
|
18
|
+
Requires-Dist: microsoft-agents-hosting-core==0.5.0
|
|
19
|
+
Requires-Dist: msal>=1.31.1
|
|
20
|
+
Requires-Dist: requests>=2.32.3
|
|
21
|
+
Requires-Dist: cryptography>=44.0.0
|
|
22
|
+
Dynamic: license-file
|
|
23
|
+
Dynamic: requires-dist
|
|
24
|
+
|
|
25
|
+
# Microsoft Agents MSAL Authentication
|
|
26
|
+
|
|
27
|
+
[](https://pypi.org/project/microsoft-agents-authentication-msal/)
|
|
28
|
+
|
|
29
|
+
Provides secure authentication for your agents using Microsoft Authentication Library (MSAL). It handles getting tokens from Azure AD so your agent can securely communicate with Microsoft services like Teams, Graph API, and other Azure resources.
|
|
30
|
+
|
|
31
|
+
# What is this?
|
|
32
|
+
|
|
33
|
+
This library is part of the **Microsoft 365 Agents SDK for Python** - a comprehensive framework for building enterprise-grade conversational AI agents. The SDK enables developers to create intelligent agents that work across multiple platforms including Microsoft Teams, M365 Copilot, Copilot Studio, and web chat, with support for third-party integrations like Slack, Facebook Messenger, and Twilio.
|
|
34
|
+
|
|
35
|
+
## Release Notes
|
|
36
|
+
<table style="width:100%">
|
|
37
|
+
<tr>
|
|
38
|
+
<th style="width:20%">Version</th>
|
|
39
|
+
<th style="width:20%">Date</th>
|
|
40
|
+
<th style="width:60%">Release Notes</th>
|
|
41
|
+
</tr>
|
|
42
|
+
<tr>
|
|
43
|
+
<td>0.5.0</td>
|
|
44
|
+
<td>2025-10-22</td>
|
|
45
|
+
<td>
|
|
46
|
+
<a href="https://github.com/microsoft/Agents-for-python/blob/main/changelog.md">
|
|
47
|
+
0.5.0 Release Notes
|
|
48
|
+
</a>
|
|
49
|
+
</td>
|
|
50
|
+
</tr>
|
|
51
|
+
</table>
|
|
52
|
+
|
|
53
|
+
## Packages Overview
|
|
54
|
+
|
|
55
|
+
We offer the following PyPI packages to create conversational experiences based on Agents:
|
|
56
|
+
|
|
57
|
+
| Package Name | PyPI Version | Description |
|
|
58
|
+
|--------------|-------------|-------------|
|
|
59
|
+
| `microsoft-agents-activity` | [](https://pypi.org/project/microsoft-agents-activity/) | Types and validators implementing the Activity protocol spec. |
|
|
60
|
+
| `microsoft-agents-hosting-core` | [](https://pypi.org/project/microsoft-agents-hosting-core/) | Core library for Microsoft Agents hosting. |
|
|
61
|
+
| `microsoft-agents-hosting-aiohttp` | [](https://pypi.org/project/microsoft-agents-hosting-aiohttp/) | Configures aiohttp to run the Agent. |
|
|
62
|
+
| `microsoft-agents-hosting-teams` | [](https://pypi.org/project/microsoft-agents-hosting-teams/) | Provides classes to host an Agent for Teams. |
|
|
63
|
+
| `microsoft-agents-storage-blob` | [](https://pypi.org/project/microsoft-agents-storage-blob/) | Extension to use Azure Blob as storage. |
|
|
64
|
+
| `microsoft-agents-storage-cosmos` | [](https://pypi.org/project/microsoft-agents-storage-cosmos/) | Extension to use CosmosDB as storage. |
|
|
65
|
+
| `microsoft-agents-authentication-msal` | [](https://pypi.org/project/microsoft-agents-authentication-msal/) | MSAL-based authentication for Microsoft Agents. |
|
|
66
|
+
|
|
67
|
+
Additionally we provide a Copilot Studio Client, to interact with Agents created in CopilotStudio:
|
|
68
|
+
|
|
69
|
+
| Package Name | PyPI Version | Description |
|
|
70
|
+
|--------------|-------------|-------------|
|
|
71
|
+
| `microsoft-agents-copilotstudio-client` | [](https://pypi.org/project/microsoft-agents-copilotstudio-client/) | Direct to Engine client to interact with Agents created in CopilotStudio |
|
|
72
|
+
|
|
73
|
+
## Installation
|
|
74
|
+
|
|
75
|
+
```bash
|
|
76
|
+
pip install microsoft-agents-authentication-msal
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
## Quick Start
|
|
80
|
+
|
|
81
|
+
### Basic Setup with Client Secret
|
|
82
|
+
|
|
83
|
+
Define your client secrets in the ENV file
|
|
84
|
+
```python
|
|
85
|
+
CONNECTIONS__SERVICE_CONNECTION__SETTINGS__CLIENTID=client-id
|
|
86
|
+
CONNECTIONS__SERVICE_CONNECTION__SETTINGS__CLIENTSECRET=client-secret
|
|
87
|
+
CONNECTIONS__SERVICE_CONNECTION__SETTINGS__TENANTID=tenant-id
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
Load the Configuration (Code from [main.py Quickstart Sample](https://github.com/microsoft/Agents/blob/main/samples/python/quickstart/src/main.py))
|
|
91
|
+
|
|
92
|
+
```python
|
|
93
|
+
from .start_server import start_server
|
|
94
|
+
|
|
95
|
+
start_server(
|
|
96
|
+
agent_application=AGENT_APP,
|
|
97
|
+
auth_configuration=CONNECTION_MANAGER.get_default_connection_configuration(),
|
|
98
|
+
)
|
|
99
|
+
```
|
|
100
|
+
Then start the Agent (code snipped from (start_server.py Quickstart Sample](https://github.com/microsoft/Agents/blob/main/samples/python/quickstart/src/start_server.py)):
|
|
101
|
+
|
|
102
|
+
```python
|
|
103
|
+
def start_server(
|
|
104
|
+
agent_application: AgentApplication, auth_configuration: AgentAuthConfiguration
|
|
105
|
+
):
|
|
106
|
+
async def entry_point(req: Request) -> Response:
|
|
107
|
+
agent: AgentApplication = req.app["agent_app"]
|
|
108
|
+
adapter: CloudAdapter = req.app["adapter"]
|
|
109
|
+
return await start_agent_process(
|
|
110
|
+
req,
|
|
111
|
+
agent,
|
|
112
|
+
adapter,
|
|
113
|
+
)
|
|
114
|
+
[...]
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
## Authentication Types
|
|
118
|
+
The M365 Agents SDK in Python supports the following Auth types:
|
|
119
|
+
```python
|
|
120
|
+
class AuthTypes(str, Enum):
|
|
121
|
+
certificate = "certificate"
|
|
122
|
+
certificate_subject_name = "CertificateSubjectName"
|
|
123
|
+
client_secret = "ClientSecret"
|
|
124
|
+
user_managed_identity = "UserManagedIdentity"
|
|
125
|
+
system_managed_identity = "SystemManagedIdentity"
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
## Key Classes
|
|
129
|
+
|
|
130
|
+
- **`MsalAuth`** - Core authentication provider using MSAL
|
|
131
|
+
- **`MsalConnectionManager`** - Manages multiple authentication connections
|
|
132
|
+
|
|
133
|
+
## Features
|
|
134
|
+
|
|
135
|
+
✅ **Multiple auth types** - Client secret, certificate, managed identity
|
|
136
|
+
✅ **Token caching** - Automatic token refresh and caching
|
|
137
|
+
✅ **Multi-tenant** - Support for different Azure AD tenants
|
|
138
|
+
✅ **Agent-to-agent** - Secure communication between agents
|
|
139
|
+
✅ **On-behalf-of** - Act on behalf of users
|
|
140
|
+
|
|
141
|
+
# Security Best Practices
|
|
142
|
+
|
|
143
|
+
- Store secrets in Azure Key Vault or environment variables
|
|
144
|
+
- Use managed identities when possible (no secrets to manage)
|
|
145
|
+
- Regularly rotate client secrets and certificates
|
|
146
|
+
- Use least-privilege principle for scopes and permissions
|
|
147
|
+
|
|
148
|
+
# Quick Links
|
|
149
|
+
|
|
150
|
+
- 📦 [All SDK Packages on PyPI](https://pypi.org/search/?q=microsoft-agents)
|
|
151
|
+
- 📖 [Complete Documentation](https://aka.ms/agents)
|
|
152
|
+
- 💡 [Python Samples Repository](https://github.com/microsoft/Agents/tree/main/samples/python)
|
|
153
|
+
- 🐛 [Report Issues](https://github.com/microsoft/Agents-for-python/issues)
|
|
154
|
+
|
|
155
|
+
# Sample Applications
|
|
156
|
+
Explore working examples in the [Python samples repository](https://github.com/microsoft/Agents/tree/main/samples/python):
|
|
157
|
+
|
|
158
|
+
|Name|Description|README|
|
|
159
|
+
|----|----|----|
|
|
160
|
+
|Quickstart|Simplest agent|[Quickstart](https://github.com/microsoft/Agents/blob/main/samples/python/quickstart/README.md)|
|
|
161
|
+
|Auto Sign In|Simple OAuth agent using Graph and GitHub|[auto-signin](https://github.com/microsoft/Agents/blob/main/samples/python/auto-signin/README.md)|
|
|
162
|
+
|OBO Authorization|OBO flow to access a Copilot Studio Agent|[obo-authorization](https://github.com/microsoft/Agents/blob/main/samples/python/obo-authorization/README.md)|
|
|
163
|
+
|Semantic Kernel Integration|A weather agent built with Semantic Kernel|[semantic-kernel-multiturn](https://github.com/microsoft/Agents/blob/main/samples/python/semantic-kernel-multiturn/README.md)|
|
|
164
|
+
|Streaming Agent|Streams OpenAI responses|[azure-ai-streaming](https://github.com/microsoft/Agents/blob/main/samples/python/azureai-streaming/README.md)|
|
|
165
|
+
|Copilot Studio Client|Console app to consume a Copilot Studio Agent|[copilotstudio-client](https://github.com/microsoft/Agents/blob/main/samples/python/copilotstudio-client/README.md)|
|
|
166
|
+
|Cards Agent|Agent that uses rich cards to enhance conversation design |[cards](https://github.com/microsoft/Agents/blob/main/samples/python/cards/README.md)|
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
microsoft_agents/authentication/msal/__init__.py,sha256=hjPpakL4zyqeCTEBOUCcHaRnSpG80q-L0csG5HMalYI,151
|
|
2
|
+
microsoft_agents/authentication/msal/msal_auth.py,sha256=6SHaLgq8yEK9sLY8ab5qmgowjcUpI_AGkS5uuDnEb-Q,16642
|
|
3
|
+
microsoft_agents/authentication/msal/msal_connection_manager.py,sha256=v7o0ONzjId1G6Ta7IjHc1NtSeM3NWH4t7YilrwJzvYg,5713
|
|
4
|
+
microsoft_agents_authentication_msal-0.5.0.dist-info/licenses/LICENSE,sha256=ws_MuBL-SCEBqPBFl9_FqZkaaydIJmxHrJG2parhU4M,1141
|
|
5
|
+
microsoft_agents_authentication_msal-0.5.0.dist-info/METADATA,sha256=bq6ceWaqEil0Ex7UmfLQP706hhTfkvD9zvW95H5RQrc,8363
|
|
6
|
+
microsoft_agents_authentication_msal-0.5.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
|
|
7
|
+
microsoft_agents_authentication_msal-0.5.0.dist-info/top_level.txt,sha256=lWKcT4v6fTA_NgsuHdNvuMjSrkiBMXohn64ApY7Xi8A,17
|
|
8
|
+
microsoft_agents_authentication_msal-0.5.0.dist-info/RECORD,,
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) Microsoft Corporation.
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
Metadata-Version: 2.4
|
|
2
|
-
Name: microsoft-agents-authentication-msal
|
|
3
|
-
Version: 0.4.0.dev18
|
|
4
|
-
Summary: A msal-based authentication library for Microsoft Agents
|
|
5
|
-
Author: Microsoft Corporation
|
|
6
|
-
Project-URL: Homepage, https://github.com/microsoft/Agents
|
|
7
|
-
Classifier: Programming Language :: Python :: 3
|
|
8
|
-
Classifier: License :: OSI Approved :: MIT License
|
|
9
|
-
Classifier: Operating System :: OS Independent
|
|
10
|
-
Requires-Python: >=3.9
|
|
11
|
-
Requires-Dist: microsoft-agents-hosting-core==0.4.0.dev18
|
|
12
|
-
Requires-Dist: msal>=1.31.1
|
|
13
|
-
Requires-Dist: requests>=2.32.3
|
|
14
|
-
Requires-Dist: cryptography>=44.0.0
|
|
15
|
-
Dynamic: requires-dist
|
|
@@ -1,7 +0,0 @@
|
|
|
1
|
-
microsoft_agents/authentication/msal/__init__.py,sha256=hjPpakL4zyqeCTEBOUCcHaRnSpG80q-L0csG5HMalYI,151
|
|
2
|
-
microsoft_agents/authentication/msal/msal_auth.py,sha256=A5CuO-JY7g03tzuuLPeKzUUQ-fsg9PLMwNe_2k7U_pY,15337
|
|
3
|
-
microsoft_agents/authentication/msal/msal_connection_manager.py,sha256=4aRJPi0uZMMnRsyewJMte5mbHiWpjnHTtHSiVr8-cyY,5258
|
|
4
|
-
microsoft_agents_authentication_msal-0.4.0.dev18.dist-info/METADATA,sha256=TdYhC7OIGGutyvGtl3y8gebi5VbAsIzl2bx2dSSSzRI,587
|
|
5
|
-
microsoft_agents_authentication_msal-0.4.0.dev18.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
|
|
6
|
-
microsoft_agents_authentication_msal-0.4.0.dev18.dist-info/top_level.txt,sha256=lWKcT4v6fTA_NgsuHdNvuMjSrkiBMXohn64ApY7Xi8A,17
|
|
7
|
-
microsoft_agents_authentication_msal-0.4.0.dev18.dist-info/RECORD,,
|
|
File without changes
|