microsoft-agents-authentication-msal 1.1.0.dev0__tar.gz → 1.1.0.dev7__tar.gz

{microsoft_agents_authentication_msal-1.1.0.dev0/microsoft_agents_authentication_msal.egg-info → microsoft_agents_authentication_msal-1.1.0.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-authentication-msal
-Version: 1.1.0.dev0
+Version: 1.1.0.dev7
 Summary: A msal-based authentication library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-hosting-core==1.1.0.dev0
+Requires-Dist: microsoft-agents-hosting-core==1.1.0.dev7
 Requires-Dist: msal>=1.34.0
 Requires-Dist: requests>=2.32.3
 Dynamic: license-file

microsoft_agents_authentication_msal-1.1.0.dev7/VERSION.txt

@@ -0,0 +1 @@
+1.1.0.dev7

{microsoft_agents_authentication_msal-1.1.0.dev0 → microsoft_agents_authentication_msal-1.1.0.dev7}/microsoft_agents/authentication/msal/msal_auth.py

@@ -175,6 +175,35 @@ class MsalAuth(AccessTokenProviderBase):
 
         return f"https://login.microsoftonline.com/{tenant_id}"
 
+    @staticmethod
+    def _resolve_azure_region(config: AgentAuthConfiguration) -> str | None:
+        """Resolves the Azure regional token service (ESTS-R) to use, if configured.
+
+        Returns the configured region only when it is populated and non-whitespace,
+        otherwise None so that MSAL falls back to the global token service.
+        """
+        azure_region = getattr(config, "AZURE_REGION", None)
+        if azure_region and azure_region.strip():
+            return azure_region
+        return None
+
+    @staticmethod
+    def _resolve_idpm_resource(config: AgentAuthConfiguration) -> str:
+        """Resolves the resource URL for Identity Proxy Manager (IDPM) token acquisition.
+
+        When no resource is configured, defaults to the AzureAdTokenExchange resource.
+        Otherwise the configured value must be a valid absolute URI.
+        """
+        idpm_resource = getattr(config, "IDPM_RESOURCE", None)
+        if not idpm_resource:
+            return "api://AzureAdTokenExchange/.default"
+
+        valid_uri, _ = MsalAuth._uri_validator(idpm_resource)
+        if not valid_uri:
+            raise ValueError("IDPM_RESOURCE must be a valid absolute URI")
+
+        return idpm_resource
+
     @staticmethod
     def _resolve_tenant_id(
         config: AgentAuthConfiguration, tenant_id: str | None = None
@@ -194,7 +223,10 @@ class MsalAuth(AccessTokenProviderBase):
         self, tenant_id: str | None = None
     ) -> ConfidentialClientApplication | ManagedIdentityClient:
 
-        if self._msal_configuration.AUTH_TYPE == AuthTypes.user_managed_identity:
+        if self._msal_configuration.AUTH_TYPE in (
+            AuthTypes.user_managed_identity,
+            AuthTypes.identity_proxy_manager,
+        ):
             return ManagedIdentityClient(
                 UserAssignedManagedIdentity(
                     client_id=self._msal_configuration.CLIENT_ID
@@ -253,6 +285,7 @@ class MsalAuth(AccessTokenProviderBase):
                 client_id=self._msal_configuration.CLIENT_ID,
                 authority=authority,
                 client_credential=client_credential,
+                azure_region=MsalAuth._resolve_azure_region(self._msal_configuration),
             )
 
     def _client_rep(
@@ -335,7 +368,29 @@ class MsalAuth(AccessTokenProviderBase):
             if auth_result_payload:
                 return auth_result_payload.get("access_token")
 
-        return None
+            return None
+
+        if (
+            self._msal_configuration.AUTH_TYPE == AuthTypes.identity_proxy_manager
+            and isinstance(msal_auth_client, ManagedIdentityClient)
+        ):
+            resource = MsalAuth._resolve_idpm_resource(self._msal_configuration)
+            logger.info(
+                "Acquiring agentic application token using Identity Proxy Manager for resource %s",
+                resource,
+            )
+            auth_result_payload = await _async_acquire_token_for_client(
+                msal_auth_client, resource=resource
+            )
+
+            if auth_result_payload:
+                return auth_result_payload.get("access_token")
+
+            return None
+
+        raise RuntimeError(
+            "Agentic token acquisition supports ConfidentialClientApplication, or ManagedIdentityClient when AUTH_TYPE is AuthTypes.identity_proxy_manager."
+        )
 
     async def get_agentic_instance_token(
         self, tenant_id: str, agent_app_instance_id: str
@@ -379,6 +434,7 @@ class MsalAuth(AccessTokenProviderBase):
                 client_id=agent_app_instance_id,
                 authority=authority,
                 client_credential={"client_assertion": agent_token_result},
+                azure_region=MsalAuth._resolve_azure_region(self._msal_configuration),
                 # token_cache=self._token_cache,
             )
 
@@ -474,6 +530,7 @@ class MsalAuth(AccessTokenProviderBase):
                 client_id=agent_app_instance_id,
                 authority=authority,
                 client_credential={"client_assertion": agent_token},
+                azure_region=MsalAuth._resolve_azure_region(self._msal_configuration),
                 # token_cache=self._token_cache,
             )
 

{microsoft_agents_authentication_msal-1.1.0.dev0 → microsoft_agents_authentication_msal-1.1.0.dev7/microsoft_agents_authentication_msal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-authentication-msal
-Version: 1.1.0.dev0
+Version: 1.1.0.dev7
 Summary: A msal-based authentication library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-hosting-core==1.1.0.dev0
+Requires-Dist: microsoft-agents-hosting-core==1.1.0.dev7
 Requires-Dist: msal>=1.34.0
 Requires-Dist: requests>=2.32.3
 Dynamic: license-file

microsoft_agents_authentication_msal-1.1.0.dev7/microsoft_agents_authentication_msal.egg-info/requires.txt

@@ -0,0 +1,3 @@
+microsoft-agents-hosting-core==1.1.0.dev7
+msal>=1.34.0
+requests>=2.32.3

microsoft_agents_authentication_msal-1.1.0.dev0/VERSION.txt

@@ -1 +0,0 @@
-1.1.0.dev0

microsoft_agents_authentication_msal-1.1.0.dev0/microsoft_agents_authentication_msal.egg-info/requires.txt

@@ -1,3 +0,0 @@
-microsoft-agents-hosting-core==1.1.0.dev0
-msal>=1.34.0
-requests>=2.32.3