microsoft-agents-authentication-msal 1.10.0.dev5__tar.gz → 1.10.0.dev6__tar.gz

{microsoft_agents_authentication_msal-1.10.0.dev5/microsoft_agents_authentication_msal.egg-info → microsoft_agents_authentication_msal-1.10.0.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-authentication-msal
-Version: 1.10.0.dev5
+Version: 1.10.0.dev6
 Summary: A msal-based authentication library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-hosting-core==1.10.0.dev5
+Requires-Dist: microsoft-agents-hosting-core==1.10.0.dev6
 Requires-Dist: azure-core
 Requires-Dist: msal>=1.34.0
 Requires-Dist: requests>=2.32.3
@@ -253,6 +253,36 @@ def start_server(
 [...]
 ```
 
+## Typed Connection Settings
+
+`MsalAuth` accepts `Configuration` or `MsalConnectionSettings` as well as the existing
+`AgentAuthConfiguration` input. Use `provider.config` to read bound MSAL settings.
+
+```python
+from microsoft_agents.activity.config import Configuration
+from microsoft_agents.authentication.msal import MsalConnectionManager
+
+connections = MsalConnectionManager(
+    config=Configuration(
+        connections={
+            "SERVICE_CONNECTION": {
+                "settings": {
+                    "auth_type": "ClientSecret",
+                    "client_id": "your-client-id",
+                    "tenant_id": "your-tenant-id",
+                    "client_secret": "your-client-secret",
+                }
+            }
+        }
+    )
+)
+settings = connections.get_default_connection().config
+```
+
+Load credentials from your application's secure configuration rather than hardcoding
+them. Legacy constructor calls and the `provider.configuration` compatibility view
+remain supported. Token credentials reuse the provider's bound settings.
+
 ## Authentication Types
 The M365 Agents SDK in Python supports the following Auth types:
 ```python

microsoft_agents_authentication_msal-1.10.0.dev6/VERSION.txt

@@ -0,0 +1 @@
+1.10.0.dev6

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6}/microsoft_agents/authentication/msal/__init__.py

@@ -4,8 +4,10 @@
 from .msal_auth import MsalAuth
 from .msal_connection_manager import MsalConnectionManager
 from .msal_token_credential import MsalTokenCredential
+from .connection_settings import MsalConnectionSettings
 
 __all__ = [
+    "MsalConnectionSettings",
     "MsalAuth",
     "MsalConnectionManager",
     "MsalTokenCredential",

microsoft_agents_authentication_msal-1.10.0.dev6/microsoft_agents/authentication/msal/connection_settings.py

@@ -0,0 +1,87 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from dataclasses import dataclass, field
+
+from microsoft_agents.activity.config import Configuration, xpath
+from microsoft_agents.hosting.core import (
+    AgentAuthConfiguration,
+    AuthTypes,
+    ConnectionSettingsBase,
+)
+
+
+@dataclass(frozen=True)
+class MsalConnectionSettings(ConnectionSettingsBase):
+    """MSAL-specific settings, bound independently of inbound JWT policy."""
+
+    auth_type: str = AuthTypes.client_secret
+    client_secret: str | None = field(default=None, repr=False)
+    cert_pfx_file: str | None = None
+    send_x5c: bool = False
+    connection_name: str | None = None
+    federated_client_id: str | None = None
+    federated_token_file: str | None = None
+    idpm_resource: str | None = None
+    azure_region: str | None = None
+
+    def __post_init__(self):
+        if self.auth_type == AuthTypes.certificate and not self.cert_pfx_file:
+            raise ValueError(
+                "CERT_PFX_FILE is required for certificate authentication."
+            )
+        if (
+            self.auth_type == AuthTypes.federated_credentials
+            and not self.federated_client_id
+        ):
+            raise ValueError(
+                "FEDERATED_CLIENT_ID is required for federated_credentials authentication."
+            )
+        if (
+            self.auth_type == AuthTypes.workload_identity
+            and not self.federated_token_file
+        ):
+            raise ValueError(
+                "FEDERATED_TOKEN_FILE is required for workload_identity authentication."
+            )
+
+    @classmethod
+    def _get_init_kwargs(cls, config: Configuration) -> dict:
+        base = super()._get_init_kwargs(config)
+        base.update(
+            {
+                "auth_type": config.get_str(
+                    xpath("auth_type"), default=AuthTypes.client_secret
+                ),
+                "client_secret": config.get_strn(xpath("client_secret")),
+                "cert_pfx_file": config.get_strn(xpath("cert_pfx_file")),
+                "send_x5c": config.get_bool(xpath("send_x5c"), default=False),
+                "connection_name": config.get_strn(xpath("connection_name")),
+                "federated_client_id": config.get_strn(xpath("federated_client_id")),
+                "federated_token_file": config.get_strn(xpath("federated_token_file")),
+                "idpm_resource": config.get_strn(xpath("idpm_resource")),
+                "azure_region": config.get_strn(
+                    xpath("azure_region"), xpath("regional_authority")
+                ),
+            }
+        )
+        return base
+
+    def _to_agent_auth_config(self) -> AgentAuthConfiguration:
+        fields = dict(
+            auth_type=self.auth_type,
+            client_id=self.client_id,
+            tenant_id=self.tenant_id,
+            authority=self.authority,
+            client_secret=self.client_secret,
+            cert_pfx_file=self.cert_pfx_file,
+            send_x5c=self.send_x5c,
+            connection_name=self.connection_name,
+            federated_client_id=self.federated_client_id,
+            federated_token_file=self.federated_token_file,
+            ALT_BLUEPRINT_NAME=self.alternate_blueprint_connection_name,
+            idpm_resource=self.idpm_resource,
+            azure_region=self.azure_region,
+            scopes=self.scopes,
+        )
+        return AgentAuthConfiguration(**{**self.extras, **fields})

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6}/microsoft_agents/authentication/msal/msal_auth.py

@@ -8,7 +8,9 @@ import asyncio
 import logging
 import time
 import jwt
-from typing import Optional
+import warnings
+
+from typing import Any
 from urllib.parse import urlparse, ParseResult as URI
 from msal import (
     ConfidentialClientApplication,
@@ -23,6 +25,7 @@ from azure.core.credentials_async import AsyncTokenCredential
 
 from requests import Session
 
+from microsoft_agents.activity.config import Configuration
 from microsoft_agents.activity._utils import _DeferredString
 
 from microsoft_agents.hosting.core import (
@@ -31,7 +34,8 @@ from microsoft_agents.hosting.core import (
     AgentAuthConfiguration,
 )
 from microsoft_agents.hosting.core.authorization.telemetry import spans
-from microsoft_agents.authentication.msal.errors import authentication_errors
+from .connection_settings import MsalConnectionSettings
+from .errors import authentication_errors
 
 logger = logging.getLogger(__name__)
 
@@ -47,29 +51,69 @@ async def _async_acquire_token_for_client(msal_auth_client, *args, **kwargs):
 
 class MsalAuth(AccessTokenProviderBase):
 
-    def __init__(self, msal_configuration: AgentAuthConfiguration):
+    def __init__(
+        self,
+        msal_configuration: (
+            Configuration | MsalConnectionSettings | AgentAuthConfiguration
+        ),
+    ):
         """Initializes the MsalAuth class with the given configuration.
 
-        :param msal_configuration: The MSAL authentication configuration. Assumed to
-            not be mutated after being passed in.
-        :type msal_configuration: :class:`microsoft_agents.hosting.core.authorization.agent_auth_configuration.AgentAuthConfiguration`
+        :param msal_configuration: Raw Configuration or bound MsalConnectionSettings.
+            AgentAuthConfiguration remains accepted for deprecated compatibility.
+            Do not mutate settings or their nested values after passing them in.
+        :type config: Configuration | MsalConnectionSettings | AgentAuthConfiguration
         """
+        config = msal_configuration
+        if isinstance(config, MsalConnectionSettings):
+            self._deprecated_config = None
+            _msal_configuration = config
+        elif isinstance(config, Configuration):
+            self._deprecated_config = None
+            _msal_configuration = MsalConnectionSettings.from_configuration(config)
+        else:
+            warnings.warn(
+                "AgentAuthConfiguration is deprecated and will be removed in future versions. "
+                "Please pass a config of type Mapping instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            self._deprecated_config = config
+            _msal_configuration = MsalConnectionSettings._from_agent_auth_config(config)
 
-        self._msal_configuration = msal_configuration
+        self._msal_configuration = _msal_configuration
         self._msal_auth_client_map: dict[
             str, ConfidentialClientApplication | ManagedIdentityClient
         ] = {}
 
         # TokenCache is thread-safe and async-safe per MSAL documentation
         self._token_cache = TokenCache()
-        logger.debug("Initializing MsalAuth")
+        logger.debug("Initializing MsalAuth provider.")
 
     @property
     def configuration(self) -> AgentAuthConfiguration:
-        """Returns the MSAL authentication configuration.
+        """Return the deprecated AgentAuthConfiguration compatibility view.
+
+        Use :attr:`config` for the bound MsalConnectionSettings instead.
 
-        :return: The MSAL authentication configuration.
-        :rtype: :class:`microsoft_agents.hosting.core.authorization.agent_auth_configuration.AgentAuthConfiguration`
+        :return: The legacy authentication configuration.
+        :rtype: AgentAuthConfiguration
+        """
+        warnings.warn(
+            "Accessing the deprecated configuration. This will be removed in future versions.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        if self._deprecated_config is None:
+            self._deprecated_config = self._msal_configuration._to_agent_auth_config()
+        return self._deprecated_config
+
+    @property
+    def config(self) -> MsalConnectionSettings:
+        """Return the bound MSAL settings; nested mutable values remain mutable.
+
+        :return: The MSAL connection settings.
+        :rtype: MsalConnectionSettings
         """
         return self._msal_configuration
 
@@ -110,12 +154,10 @@ class MsalAuth(AccessTokenProviderBase):
         """
         with spans.GetAccessToken(
             scopes,
-            self._msal_configuration.AUTH_TYPE,
+            self._msal_configuration.auth_type,
         ):
             logger.debug(
-                "Requesting access token for resource: %s, scopes: %s",
-                resource_url,
-                scopes,
+                f"Requesting access token for resource: {resource_url}, scopes: {scopes}"
             )
             valid_uri, instance_uri = self._uri_validator(resource_url)
             if not valid_uri:
@@ -191,7 +233,7 @@ class MsalAuth(AccessTokenProviderBase):
                 )
 
                 if "access_token" not in token:
-                    logger.error("Failed to acquire token on behalf of user.")
+                    logger.error(f"Failed to acquire token on behalf of user.")
                     raise ValueError(
                         authentication_errors.FailedToAcquireToken.format(str(token))
                     )
@@ -199,8 +241,7 @@ class MsalAuth(AccessTokenProviderBase):
                 return token["access_token"]
 
             logger.error(
-                "On-behalf-of flow is not supported with the current authentication type: %s",
-                msal_auth_client.__class__.__name__,
+                f"On-behalf-of flow is not supported with the current authentication type: {msal_auth_client.__class__.__name__}"
             )
             raise NotImplementedError(
                 authentication_errors.OnBehalfOfFlowNotSupportedAuthType.format(
@@ -210,49 +251,49 @@ class MsalAuth(AccessTokenProviderBase):
 
     @staticmethod
     def _resolve_authority(
-        config: AgentAuthConfiguration, tenant_id: str | None = None
+        config: MsalConnectionSettings, tenant_id: str | None = None
     ) -> str:
         tenant_id = MsalAuth._resolve_tenant_id(config, tenant_id)
         if not tenant_id:
             return (
-                config.AUTHORITY
-                or f"https://login.microsoftonline.com/{config.TENANT_ID}"
+                config.authority
+                or f"https://login.microsoftonline.com/{config.tenant_id}"
             )
 
-        if config.AUTHORITY:
+        if config.authority:
             return re.sub(
                 r"/(?:common|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})(?=/|$)",
                 f"/{tenant_id}",
-                config.AUTHORITY,
+                config.authority,
             )
 
         return f"https://login.microsoftonline.com/{tenant_id}"
 
     @staticmethod
-    def _resolve_azure_region(config: AgentAuthConfiguration) -> str | None:
+    def _resolve_azure_region(config: MsalConnectionSettings) -> str | None:
         """Resolves the Azure regional token service (ESTS-R) to use, if configured.
 
-        :param config: The agent authentication configuration.
-        :type config: :class:`microsoft_agents.hosting.core.AgentAuthConfiguration`
+        :param config: The bound MSAL connection settings.
+        :type config: :class:`microsoft_agents.authentication.msal.MsalConnectionSettings`
         :return: The resolved Azure region or None if not configured.
         :rtype: str | None
 
         Returns the configured region only when it is populated and non-whitespace,
         otherwise None so that MSAL falls back to the global token service.
         """
-        azure_region = getattr(config, "AZURE_REGION", None)
+        azure_region = config.azure_region
         if azure_region and azure_region.strip():
             return azure_region
         return None
 
     @staticmethod
-    def _resolve_idpm_resource(config: AgentAuthConfiguration) -> str:
+    def _resolve_idpm_resource(config: MsalConnectionSettings) -> str:
         """Resolves the resource URL for Identity Proxy Manager (IDPM) token acquisition.
 
         When no resource is configured, defaults to the AzureAdTokenExchange resource.
         Otherwise the configured value must be a valid absolute URI.
         """
-        idpm_resource = getattr(config, "IDPM_RESOURCE", None)
+        idpm_resource = config.idpm_resource
         if not idpm_resource:
             return "api://AzureAdTokenExchange/.default"
 
@@ -264,35 +305,35 @@ class MsalAuth(AccessTokenProviderBase):
 
     @staticmethod
     def _resolve_tenant_id(
-        config: AgentAuthConfiguration, tenant_id: str | None = None
+        config: MsalConnectionSettings, tenant_id: str | None = None
     ) -> str:
 
-        if not config.TENANT_ID:
+        if not config.tenant_id:
             if tenant_id:
                 return tenant_id
             raise ValueError("TENANT_ID is not set in the configuration.")
 
-        if tenant_id or config.TENANT_ID.lower() == "common":
+        if tenant_id or config.tenant_id.lower() == "common":
             return tenant_id
 
-        return config.TENANT_ID
+        return config.tenant_id
 
     def _create_client_application(
         self, tenant_id: str | None = None
     ) -> ConfidentialClientApplication | ManagedIdentityClient:
 
-        if self._msal_configuration.AUTH_TYPE in (
+        if self._msal_configuration.auth_type in (
             AuthTypes.user_managed_identity,
             AuthTypes.identity_proxy_manager,
         ):
             return ManagedIdentityClient(
                 UserAssignedManagedIdentity(
-                    client_id=self._msal_configuration.CLIENT_ID
+                    client_id=self._msal_configuration.client_id
                 ),
                 http_client=Session(),
             )
 
-        elif self._msal_configuration.AUTH_TYPE == AuthTypes.system_managed_identity:
+        elif self._msal_configuration.auth_type == AuthTypes.system_managed_identity:
             return ManagedIdentityClient(
                 SystemAssignedManagedIdentity(),
                 http_client=Session(),
@@ -301,18 +342,18 @@ class MsalAuth(AccessTokenProviderBase):
             authority = MsalAuth._resolve_authority(self._msal_configuration, tenant_id)
             client_credential = None
 
-            if self._msal_configuration.AUTH_TYPE == AuthTypes.client_secret:
-                client_credential = self._msal_configuration.CLIENT_SECRET
-            elif self._msal_configuration.AUTH_TYPE == AuthTypes.certificate:
+            if self._msal_configuration.auth_type == AuthTypes.client_secret:
+                client_credential = self._msal_configuration.client_secret
+            elif self._msal_configuration.auth_type == AuthTypes.certificate:
                 client_credential = {
-                    "private_key_pfx_path": self._msal_configuration.CERT_PFX_FILE,
+                    "private_key_pfx_path": self._msal_configuration.cert_pfx_file,
                 }
-                if self._msal_configuration.SEND_X5C:
+                if self._msal_configuration.send_x5c:
                     client_credential["public_certificate"] = True
-            elif self._msal_configuration.AUTH_TYPE == AuthTypes.federated_credentials:
+            elif self._msal_configuration.auth_type == AuthTypes.federated_credentials:
                 mi_client = ManagedIdentityClient(
                     UserAssignedManagedIdentity(
-                        client_id=self._msal_configuration.FEDERATED_CLIENT_ID
+                        client_id=self._msal_configuration.federated_client_id
                     ),
                     http_client=Session(),
                 )
@@ -323,8 +364,7 @@ class MsalAuth(AccessTokenProviderBase):
                     )
                     if "access_token" not in result:
                         logger.error(
-                            "Failed to acquire token for federated credentials: %s",
-                            result,
+                            f"Failed to acquire token for federated credentials: {result}"
                         )
                         raise ValueError(
                             authentication_errors.FailedToAcquireToken.format(
@@ -334,13 +374,13 @@ class MsalAuth(AccessTokenProviderBase):
                     return result["access_token"]
 
                 client_credential = {"client_assertion": get_assertion}
-            elif self._msal_configuration.AUTH_TYPE == AuthTypes.workload_identity:
-                if not self._msal_configuration.FEDERATED_TOKEN_FILE:
+            elif self._msal_configuration.auth_type == AuthTypes.workload_identity:
+                if not self._msal_configuration.federated_token_file:
                     raise ValueError(
                         "FEDERATED_TOKEN_FILE must be set in configuration."
                     )
 
-                federated_token_file = self._msal_configuration.FEDERATED_TOKEN_FILE
+                federated_token_file = self._msal_configuration.federated_token_file
 
                 def get_assertion() -> str:
                     with open(federated_token_file, encoding="utf-8") as f:
@@ -349,15 +389,14 @@ class MsalAuth(AccessTokenProviderBase):
                 client_credential = {"client_assertion": get_assertion}
             else:
                 logger.error(
-                    "Unsupported authentication type: %s",
-                    self._msal_configuration.AUTH_TYPE,
+                    f"Unsupported authentication type: {self._msal_configuration.auth_type}"
                 )
                 raise NotImplementedError(
                     str(authentication_errors.AuthenticationTypeNotSupported)
                 )
 
             return ConfidentialClientApplication(
-                client_id=self._msal_configuration.CLIENT_ID,
+                client_id=self._msal_configuration.client_id,
                 authority=authority,
                 client_credential=client_credential,
                 azure_region=MsalAuth._resolve_azure_region(self._msal_configuration),
@@ -368,7 +407,7 @@ class MsalAuth(AccessTokenProviderBase):
     ) -> str:
         # Create a unique representation for the client based on tenant_id and instance_id
         # instance_id None is for when no agentic instance is associated with the request.
-        tenant_id = tenant_id or self._msal_configuration.TENANT_ID
+        tenant_id = tenant_id or self._msal_configuration.tenant_id
         return f"tenant:{tenant_id}.instance:{instance_id}"
 
     def _get_client(
@@ -388,7 +427,7 @@ class MsalAuth(AccessTokenProviderBase):
             result = urlparse(url_str)
             return all([result.scheme, result.netloc]), result
         except AttributeError:
-            logger.error("URI parsing error for %s", url_str)
+            logger.error(f"URI parsing error for {url_str}")
             return False, None
 
     def _resolve_scopes_list(self, instance_url: URI, scopes=None) -> list[str]:
@@ -396,7 +435,7 @@ class MsalAuth(AccessTokenProviderBase):
             return scopes
 
         temp_list: list[str] = []
-        lst = self._msal_configuration.SCOPES or []
+        lst = self._msal_configuration.scopes or []
         for scope in lst:
             scope_placeholder = scope
             if "{instance}" in scope_placeholder.lower():
@@ -404,7 +443,7 @@ class MsalAuth(AccessTokenProviderBase):
                     "{instance}", f"{instance_url.scheme}://{instance_url.hostname}"
                 )
             temp_list.append(scope_placeholder)
-        logger.debug("Resolved scopes: %s", temp_list)
+        logger.debug(f"Resolved scopes: {temp_list}")
         return temp_list
 
     # the call to MSAL is blocking, but in the future we want to create an asyncio task
@@ -446,7 +485,7 @@ class MsalAuth(AccessTokenProviderBase):
             return None
 
         if (
-            self._msal_configuration.AUTH_TYPE == AuthTypes.identity_proxy_manager
+            self._msal_configuration.auth_type == AuthTypes.identity_proxy_manager
             and isinstance(msal_auth_client, ManagedIdentityClient)
         ):
             resource = MsalAuth._resolve_idpm_resource(self._msal_configuration)

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6}/microsoft_agents/authentication/msal/msal_connection_manager.py

@@ -1,6 +1,7 @@
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
 
+from microsoft_agents.activity.config import Configuration
 from microsoft_agents.hosting.core import (
     AgentAuthConfiguration,
     ConnectionManager,
@@ -23,15 +24,20 @@ class MsalConnectionManager(ConnectionManager):
         self,
         connections_configurations: dict[str, AgentAuthConfiguration] | None = None,
         connections_map: list[dict[str, str]] | None = None,
+        *,
+        config: Configuration | None = None,
         **kwargs,
     ):
         """
         Initialize the MSAL connection manager.
 
-        :param connections_configurations: A dictionary of connection configurations.
+        :param connections_configurations: Deprecated legacy connection configurations.
         :type connections_configurations: dict[str, :class:`microsoft_agents.hosting.core.AgentAuthConfiguration`]
-        :param connections_map: A list of connection mappings.
+        :param connections_map: Deprecated list of connection mappings.
         :type connections_map: list[dict[str, str]]
+        :param config: Application Configuration containing connections and routing.
+            Prefer this over the deprecated positional configuration arguments.
+        :type config: Configuration | None
         :raises ValueError: If no service connection configuration is provided.
         """
 
@@ -39,5 +45,6 @@ class MsalConnectionManager(ConnectionManager):
             provider_factory=MsalAuth,
             connections_configurations=connections_configurations,
             connections_map=connections_map,
+            config=config,
             **kwargs,
         )

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6}/microsoft_agents/authentication/msal/msal_token_credential.py

@@ -8,6 +8,7 @@ from azure.core.credentials_async import AsyncTokenCredential
 
 from microsoft_agents.hosting.core import AgentAuthConfiguration
 
+from .connection_settings import MsalConnectionSettings
 from .msal_auth import MsalAuth
 
 logger = logging.getLogger(__name__)
@@ -28,14 +29,16 @@ class MsalTokenCredential(AsyncTokenCredential):
 
     def __init__(
         self,
-        config: AgentAuthConfiguration,
+        config: MsalConnectionSettings | AgentAuthConfiguration,
         *,
         provider: MsalAuth | None = None,
     ):
         """Initializes the MsalTokenCredential with the given configuration.
 
-        :param config: The agent authentication configuration.
-        :type config: :class:`microsoft_agents.hosting.core.AgentAuthConfiguration`
+        :param config: Bound MSAL settings. AgentAuthConfiguration remains accepted
+            for deprecated compatibility.
+        :type config: MsalConnectionSettings | AgentAuthConfiguration
+        :param provider: An existing provider to reuse instead of constructing one.
         """
         self._config = config
         self._provider: MsalAuth | None = provider

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6/microsoft_agents_authentication_msal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-authentication-msal
-Version: 1.10.0.dev5
+Version: 1.10.0.dev6
 Summary: A msal-based authentication library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-hosting-core==1.10.0.dev5
+Requires-Dist: microsoft-agents-hosting-core==1.10.0.dev6
 Requires-Dist: azure-core
 Requires-Dist: msal>=1.34.0
 Requires-Dist: requests>=2.32.3
@@ -253,6 +253,36 @@ def start_server(
 [...]
 ```
 
+## Typed Connection Settings
+
+`MsalAuth` accepts `Configuration` or `MsalConnectionSettings` as well as the existing
+`AgentAuthConfiguration` input. Use `provider.config` to read bound MSAL settings.
+
+```python
+from microsoft_agents.activity.config import Configuration
+from microsoft_agents.authentication.msal import MsalConnectionManager
+
+connections = MsalConnectionManager(
+    config=Configuration(
+        connections={
+            "SERVICE_CONNECTION": {
+                "settings": {
+                    "auth_type": "ClientSecret",
+                    "client_id": "your-client-id",
+                    "tenant_id": "your-tenant-id",
+                    "client_secret": "your-client-secret",
+                }
+            }
+        }
+    )
+)
+settings = connections.get_default_connection().config
+```
+
+Load credentials from your application's secure configuration rather than hardcoding
+them. Legacy constructor calls and the `provider.configuration` compatibility view
+remain supported. Token credentials reuse the provider's bound settings.
+
 ## Authentication Types
 The M365 Agents SDK in Python supports the following Auth types:
 ```python

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6}/microsoft_agents_authentication_msal.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ pyproject.toml
 readme.md
 setup.py
 microsoft_agents/authentication/msal/__init__.py
+microsoft_agents/authentication/msal/connection_settings.py
 microsoft_agents/authentication/msal/msal_auth.py
 microsoft_agents/authentication/msal/msal_connection_manager.py
 microsoft_agents/authentication/msal/msal_token_credential.py

microsoft_agents_authentication_msal-1.10.0.dev6/microsoft_agents_authentication_msal.egg-info/requires.txt

@@ -0,0 +1,4 @@
+microsoft-agents-hosting-core==1.10.0.dev6
+azure-core
+msal>=1.34.0
+requests>=2.32.3

{microsoft_agents_authentication_msal-1.10.0.dev5 → microsoft_agents_authentication_msal-1.10.0.dev6}/readme.md

@@ -229,6 +229,36 @@ def start_server(
 [...]
 ```
 
+## Typed Connection Settings
+
+`MsalAuth` accepts `Configuration` or `MsalConnectionSettings` as well as the existing
+`AgentAuthConfiguration` input. Use `provider.config` to read bound MSAL settings.
+
+```python
+from microsoft_agents.activity.config import Configuration
+from microsoft_agents.authentication.msal import MsalConnectionManager
+
+connections = MsalConnectionManager(
+    config=Configuration(
+        connections={
+            "SERVICE_CONNECTION": {
+                "settings": {
+                    "auth_type": "ClientSecret",
+                    "client_id": "your-client-id",
+                    "tenant_id": "your-tenant-id",
+                    "client_secret": "your-client-secret",
+                }
+            }
+        }
+    )
+)
+settings = connections.get_default_connection().config
+```
+
+Load credentials from your application's secure configuration rather than hardcoding
+them. Legacy constructor calls and the `provider.configuration` compatibility view
+remain supported. Token credentials reuse the provider's bound settings.
+
 ## Authentication Types
 The M365 Agents SDK in Python supports the following Auth types:
 ```python

microsoft_agents_authentication_msal-1.10.0.dev5/VERSION.txt

@@ -1 +0,0 @@
-1.10.0.dev5

microsoft_agents_authentication_msal-1.10.0.dev5/microsoft_agents_authentication_msal.egg-info/requires.txt

@@ -1,4 +0,0 @@
-microsoft-agents-hosting-core==1.10.0.dev5
-azure-core
-msal>=1.34.0
-requests>=2.32.3