Enable MSAL broker on macOS and Linux - #4503
Draft
mdaigle wants to merge 1 commit into
Draft
Conversation
Extends broker support beyond Windows via BrokerOptions.OperatingSystems.Linux
and .OSX, force-enabled for the SqlClient first-party app id to match the
existing Windows behavior. Custom app ids continue to opt in with UseWamBroker.
Redirect URIs are now selected per platform, since the broker forwards the
app-configured URI straight to msalruntime:
Windows ms-appx-web://microsoft.aad.brokerplugin/{clientId}
Linux https://login.microsoftonline.com/common/oauth2/nativeclient
macOS bundled msauth.{CFBundleIdentifier}://auth
macOS non-bundled msauth.com.msauth.unsignedapp://auth
Platform guards:
* macOS bundled apps on the default app id throw, because the derived URI
cannot be registered on the first-party app. Device code flow is exempt as
it never consults the broker.
* Linux is gated on x64, non-musl, and a NativeLibrary.TryLoad probe, so
hosts missing libwebkit2gtk/libsecret/libX11 fall back to the browser
rather than failing with wam_runtime_init_failed.
Detection is lazy so managed identity, workload identity, service principal,
and default credential flows never load the native library.
AuthenticationException's two-arg constructor now chains to the six-parameter
base so Method survives into SqlError.Procedure.
Behavioral changes: bundled macOS GUI apps on the default app id now throw;
macOS terminal apps need MacMainThreadScheduler for ActiveDirectoryInteractive;
unenrolled Macs no longer get a browser fallback for that flow.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Extends ActiveDirectoryAuthenticationProvider brokered authentication beyond Windows to also support macOS and Linux (where MSAL’s native broker runtime is available), including platform-specific redirect URI selection and expanded test coverage.
Changes:
- Added cross-platform broker detection/guardrails (Windows/macOS/Linux) and centralized redirect URI selection via a new broker-specific partial class.
- Introduced macOS bundle identifier detection to compute the broker redirect URI for bundled apps, with documented/validated behavior differences.
- Expanded
WamBrokerTeststo cover platform support detection, redirect URI selection, and anAuthenticationExceptionconstructor regression.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlAuthenticationProviderManager.cs | Updates comments to reflect “brokering where supported” (not Windows-only). |
| src/Microsoft.Data.SqlClient.Extensions/Azure/test/WamBrokerTests.cs | Adds tests for broker OS detection, redirect URI selection, and exception constructor behavior. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/src/Interop/Interop.NSBundle.cs | Adds macOS Objective-C interop to resolve the host bundle identifier. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/src/AuthenticationException.cs | Fixes 2-arg ctor chaining so Method is preserved on the exception object. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.Windows.cs | Updates Windows-specific documentation to reflect cross-platform broker support. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs | Refactors to use centralized redirect URI logic and enables broker across supported OSes. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.Broker.cs | New: broker platform detection, Linux native runtime probe, and redirect URI resolution. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/doc/ActiveDirectoryAuthenticationProviderOptions.xml | Updates docs for broker behavior/redirect URIs and platform requirements. |
| src/Microsoft.Data.SqlClient.Extensions/Azure/doc/ActiveDirectoryAuthenticationProvider.xml | Updates docs for parent window callback behavior with brokers on non-Windows. |
Comment on lines
+254
to
+256
| object?[] arguments = new object?[] { LinuxMsalRuntimeLibraryName, nativeInterop, null, null }; | ||
|
|
||
| return tryLoad.Invoke(null, arguments) is true; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extends the recently added Windows broker support to macOS and Linux via
BrokerOptions.OperatingSystems.Linuxand.OSX. The broker is force-enabled for the SqlClient first-party app id, matching existing Windows behavior. Custom app ids continue to opt in throughUseWamBroker.Redirect URIs
MSAL forwards the app-configured redirect URI straight to msalruntime, so it has to be correct per platform.
WamAdapters.GetExpectedRedirectUriis dead code in 4.84.2 and does not fix this up.ms-appx-web://microsoft.aad.brokerplugin/{clientId}https://login.microsoftonline.com/common/oauth2/nativeclientmsauth.{CFBundleIdentifier}://authmsauth.com.msauth.unsignedapp://authValues come from the macOS and Linux broker docs.
Platform guards
macOS. The broker is enabled for all hosts. A bundled app running on the default app id throws, because its redirect URI derives from the host's bundle identifier and cannot be registered on the first-party app. Device code flow is exempt, since
DeviceCodeRequestnever consults the broker andSilentRequestskips it for accounts sourced from that flow.Linux. Gated on x64, non-musl, plus a
NativeLibrary.TryLoadprobe. Without the probe, hosts missinglibwebkit2gtk,libsecret, orlibX11fail hard withwam_runtime_init_failed, asRuntimeBrokeroffers no browser fallback. With it, they degrade to the browser.Platform detection is lazy, so managed identity, workload identity, service principal, and default credential flows never load the native library.
Behavioral changes
ApplicationClientIdor using device code flow.MacMainThreadSchedulerforActiveDirectoryInteractive; MSAL throwswam_ui_threadoff thread 1. Silent and integrated flows are unaffected.ActiveDirectoryInteractive.Also
AuthenticationException's two-argument constructor now chains to the six-parameter base soMethodsurvives intoSqlError.Procedureinstead of readingNotSpecified.Blocker before merge
The first-party app registration
2fd908ad-0664-4344-b9be-cd3e8b574c38needshttps://login.microsoftonline.com/common/oauth2/nativeclientexplicitly enabled andmsauth.com.msauth.unsignedapp://authadded. Without both, Linux and macOS fail at the broker. This cannot be verified from the repo and needs someone with access to the registration.Testing
WamBrokerTestsexpanded from 18 to 29 tests, passing on net8.0/9.0/10.0. Interop and native-load behavior was verified empirically rather than inferred: bundle-id lookup against a real.appbundle and a loose executable, the reflectiveNativeLibrary.TryLoadpath returning a live handle, andNativeInterop0.20.6 decompiled to confirm the arch-specific library name and that its Linux preload path is unreachable. TheMethodregression test was confirmed to fail against the old constructor.Two
Azure.Testfailures (AADConnectionTest.ADIntegratedUsingSSPI,ActiveDirectoryInteractiveTests.TestConnection) are pre-existing and need a live server or Windows SSPI.