Skip to content

Add support for federated identity credentials#389

Merged
heyitsaamir merged 6 commits into
aamirj/addMsalfrom
aamirj/FIC
Nov 11, 2025
Merged

Add support for federated identity credentials#389
heyitsaamir merged 6 commits into
aamirj/addMsalfrom
aamirj/FIC

Conversation

@heyitsaamir

@heyitsaamir heyitsaamir commented Nov 7, 2025

Copy link
Copy Markdown
Collaborator

Adds native support for Federated Identity Credentials (User and System) via MSAL.

CLIENT_ID CLIENT_SECRET MANAGED_IDENTITY_CLIENT_ID Output
not_set No-Auth
set set SecretsAuth
set not_set User Managed Identity Auth
set not_set set (same as CLIENT_ID) User Managed Identity Auth
set not_set set (diff from CLIENT_ID) FIC (user managed identity)
set not_set "system" FIC (system identity)

PR Dependency Tree

This tree was auto-generated by Charcoal

Comment thread packages/apps/src/app.ts
/**
* client id - Your application's client identifier
* Uses environment variable CLIENT_ID if not explicitly provided
* If not available, uses

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing MI part in latter statement

Base automatically changed from aamirj/UMI to aamirj/addMsal November 11, 2025 20:30
@heyitsaamir
heyitsaamir merged commit db8807e into aamirj/addMsal Nov 11, 2025
1 of 5 checks passed
@heyitsaamir
heyitsaamir deleted the aamirj/FIC branch November 11, 2025 20:30
heyitsaamir added a commit that referenced this pull request Nov 12, 2025
This PR introduces MSAL as a dependency and switches our supported bot
authentication to use it. It also includes support for User Managed
Identity support and FIC such that we don't need to provide custom code
to do that anymore as we had previously suggested. Instead, we can do
that simply by the environment variables.

| CLIENT_ID | CLIENT_SECRET | MANAGED_IDENTITY_CLIENT_ID | Output |
|-|-|-|-|
| not_set | | | No-Auth |
| set | set | | SecretsAuth |
| set | not_set | | User Managed Identity Auth |
| set | not_set | set (same as CLIENT_ID) | User Managed Identity Auth |
| set | not_set | set (diff from CLIENT_ID) | FIC (user managed
identity) |
| set | not_set | "system" | FIC (system identity) |

Changes to note:
1. We are now no longer _proactively_ refreshing tokens. Instead, we put
the token fetcher inside the token resolver logic for the client. This
ends up being a call to `tokenManager.getBotToken`.
2. This fixes a bug where proactive scenarios were going to fail because
we weren't refreshing the token for them. For reactive scenarios, we
refresh the token when the request comes in, so it was fine.
3. We are deprecating the `id` and `name` fields because those used to
depend on the token being present. Now that we are not proactively
fetching the token, those are not as useful (or reliable). For now, I
have chosen to simply use the value from the manifest to populate them.
I don't think these fields were that useful anyway, so opting to
deprecate.
4. Removes graphToken from being injected into plugins. Plugins weren't
using it, and we want to remove tight dependency on graph package.
















#### PR Dependency Tree


* **PR #387** 👈
* Merged #388, #389, #392

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants