[feat/azure-split] Refactors to simplify WAM support diff by mdaigle · Pull Request #3888 · dotnet/SqlClient

mdaigle · 2026-01-13T20:47:59Z

Description

Refactors code in ActiveDirectoryAuthenticationProvider to improve readability and modularity.
Adds a new prompt for doc comment generation and adds doc comments to ActiveDirectoryAuthenticationProvider.
The Integrated auth method is marked as obsolete by MSAL. This PR carries forward that obsolete designation and is a public API change.

A targeted PR for WAM support will build on top of these refactors.

Issues

#3418

Testing

No new logic, only refactors. Existing tests should provide coverage.

…AuthenticationProvider.cs

Copilot

Pull request overview

This PR refactors the ActiveDirectoryAuthenticationProvider class to improve code modularity and readability in preparation for WAM (Windows Authentication Manager) support. The main changes include extracting authentication logic into separate methods, adding comprehensive XML documentation comments, and introducing a new GitHub Copilot prompt for documentation generation.

Changes:

Refactored AcquireTokenAsync to use a switch statement and delegate to specialized methods for each authentication type
Extracted authentication flows into dedicated methods (AcquireTokenIntegratedAsync, AcquireTokenByUsernamePasswordAsync, AcquireTokenInteractiveAsync, AcquireTokenDeviceFlowAsync)
Added comprehensive XML documentation comments to all internal members and helper classes
Fixed a bug in the connection timeout overflow check logic
Added obsolete attribute to ActiveDirectoryIntegrated authentication method
Created a new prompt file for generating documentation comments

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 10 comments.

File	Description
src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs	Major refactoring with extracted methods, added doc comments, and fixed timeout logic bug
src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/SqlAuthenticationMethod.cs	Added obsolete attribute to ActiveDirectoryIntegrated, corrected comment grammar
.github/prompts/doc-comments.prompt.md	New GitHub Copilot prompt for generating XML documentation

Comments suppressed due to low confidence (1)

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs:193

The condition was inverted from the original, which appears to fix a bug. The original code if (int.MaxValue / 1000 > parameters.ConnectionTimeout) would set CancelAfter to int.MaxValue when the timeout was SMALL (safe to multiply), which is backwards. The new code correctly checks if the timeout is too large to safely multiply by 1000 before capping it. This is a beneficial bug fix, but it represents a behavior change that should be noted in testing.

                if (parameters.ConnectionTimeout > int.MaxValue / 1000)
                {
                    cts.CancelAfter(int.MaxValue);
                }
                else
                {
                    cts.CancelAfter(parameters.ConnectionTimeout * 1000);
                }

Copilot · 2026-01-13T20:53:27Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+    /// </summary>
+    /// <param name="publicClientAppKey">The key containing configuration for the application.</param>
+    /// <returns>A new <see cref="IPublicClientApplication"/> instance.</returns>
+    private static IPublicClientApplication CreateClientAppInstance(PublicClientAppKey publicClientAppKey)


The CreateClientAppInstance method was changed from an instance method to a static method, but it attempts to reference _iWin32WindowFunc (an instance field) within the NETFRAMEWORK conditional block. This will cause a compilation error on NETFRAMEWORK builds. The method should either remain an instance method, or _iWin32WindowFunc should be passed as a parameter (e.g., via the PublicClientAppKey).

Suggested change

private static IPublicClientApplication CreateClientAppInstance(PublicClientAppKey publicClientAppKey)

private IPublicClientApplication CreateClientAppInstance(PublicClientAppKey publicClientAppKey)

Copilot · 2026-01-13T20:53:28Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+                default:
+                {
+                    SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | {0} authentication mode not supported by ActiveDirectoryAuthenticationProvider class.", parameters.AuthenticationMethod);
+


Remove trailing whitespace on this line.

Suggested change

Copilot · 2026-01-13T20:53:28Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

-                        .ExecuteAsync(ctsInteractive.Token)
-                        .ConfigureAwait(false);
-                }
+                SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);


There is an extra space before the closing parenthesis in the format string. This appears in the tracing output and should be removed for consistency with other log messages.

Suggested change

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult.ExpiresOn);

Copilot · 2026-01-13T20:53:28Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+        #endif
+        PublicClientAppKey pcaKey =
+        #if NETFRAMEWORK
+            new(parameters.Authority, redirectUri, applicationClientId, _iWin32WindowFunc);


The GetPublicClientAppInstanceAsync method was changed from an instance method to a static method, but it constructs a PublicClientAppKey that references _iWin32WindowFunc, which is an instance field only available on NETFRAMEWORK builds. This will cause a compilation error. The method should either remain an instance method, or _iWin32WindowFunc should be passed as a parameter from the calling context.

Suggested change

new(parameters.Authority, redirectUri, applicationClientId, _iWin32WindowFunc);

new(parameters.Authority, redirectUri, applicationClientId);

Copilot · 2026-01-13T20:53:29Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+            AuthenticationResult result = await app.AcquireTokenInteractive(scopes)
+                .WithCorrelationId(connectionId)
+                .WithCustomWebUi(customWebUI)


The refactored code now unconditionally calls WithCustomWebUi(customWebUI) even when customWebUI is null, whereas the original code had separate branches that only called WithCustomWebUi when customWebUI was not null. If the MSAL library does not handle null values gracefully for this method, this could cause a runtime error. Consider adding a conditional check: if customWebUI is not null, call WithCustomWebUi(customWebUI) on the builder before calling WithLoginHint.

Suggested change

AuthenticationResult result = await app.AcquireTokenInteractive(scopes)

.WithCorrelationId(connectionId)

.WithCustomWebUi(customWebUI)

var interactiveBuilder = app.AcquireTokenInteractive(scopes)

.WithCorrelationId(connectionId);

if (customWebUI is not null)

{

interactiveBuilder = interactiveBuilder.WithCustomWebUi(customWebUI);

}

AuthenticationResult result = await interactiveBuilder

Copilot · 2026-01-13T20:53:29Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

-                    .WithCorrelationId(connectionId)
-                    .ExecuteAsync(cancellationToken: cts.Token)
-                    .ConfigureAwait(false);
+                SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);


There is an extra space before the closing parenthesis in the format string. This appears in the tracing output and should be removed for consistency with other log messages.

Suggested change

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult.ExpiresOn);

Copilot · 2026-01-13T20:53:29Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+        AuthenticationResult result = await builder
+            .ExecuteAsync(cancellationToken: cts.Token)
+            .ConfigureAwait(false);
+        SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (interactive) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, result.ExpiresOn);


The log message says "Acquired access token (interactive)" but this should say "Acquired access token for Active Directory Integrated auth mode" to match the original log message format for this authentication method.

Suggested change

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (interactive) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, result.ExpiresOn);

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token for Active Directory Integrated auth mode. Expiry Time: {0}", result.ExpiresOn);

Copilot · 2026-01-13T20:53:30Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+
+        try
+        {
+            CancellationTokenSource ctsInteractive = new();


Disposable 'CancellationTokenSource' is created but not disposed.

Suggested change

CancellationTokenSource ctsInteractive = new();

using CancellationTokenSource ctsInteractive = new();

Copilot · 2026-01-13T20:53:30Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+        }
+
+        #pragma warning disable CS0618 // Type or member is obsolete
+        AuthenticationResult result = await app.AcquireTokenByUsernamePassword(scopes, parameters.UserId, parameters.Password)


Call to obsolete method AcquireTokenByUsernamePassword.

Copilot · 2026-01-13T20:53:30Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+        // to acquire tokens for Active Directory Integrated
+        // authentication.
+        #pragma warning disable CS0618 // Type or member is obsolete
+        var builder = app.AcquireTokenByIntegratedWindowsAuth(scopes)


Call to obsolete method AcquireTokenByIntegratedWindowsAuth.

…er team discussion.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

Copilot · 2026-01-13T22:20:24Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

            {
                // Safely convert to milliseconds.
-                if (int.MaxValue / 1000 > parameters.ConnectionTimeout)
+                if (parameters.ConnectionTimeout > int.MaxValue / 1000)


The timeout comparison logic is inverted. This condition checks if the timeout is greater than the safe conversion threshold, but then applies int.MaxValue as the timeout. The original logic int.MaxValue / 1000 > parameters.ConnectionTimeout was correct: it checked if the value was safe to convert, then converted it. The inverted logic will now apply int.MaxValue when the timeout is too large, and attempt to convert potentially unsafe values when the timeout is within range.

Copilot · 2026-01-13T22:20:24Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+                default:
+                {
+                    SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | {0} authentication mode not supported by ActiveDirectoryAuthenticationProvider class.", parameters.AuthenticationMethod);
+


Remove the trailing whitespace on this empty line for consistency with the codebase's formatting standards.

Suggested change

Copilot · 2026-01-13T22:20:24Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

-                        .ExecuteAsync(ctsInteractive.Token)
-                        .ConfigureAwait(false);
-                }
+                SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);


Remove the extra space before .ExpiresOn to maintain consistent spacing in member access.

Suggested change

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult.ExpiresOn);

Copilot · 2026-01-13T22:20:25Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

-                    .WithCorrelationId(connectionId)
-                    .ExecuteAsync(cancellationToken: cts.Token)
-                    .ConfigureAwait(false);
+                SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);


Remove the extra space before .ExpiresOn to maintain consistent spacing in member access.

Suggested change

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);

SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult.ExpiresOn);

Copilot · 2026-01-13T22:20:25Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+        #endif
+        PublicClientAppKey pcaKey =
+        #if NETFRAMEWORK
+            new(parameters.Authority, redirectUri, applicationClientId, _iWin32WindowFunc);


This line references _iWin32WindowFunc which is an instance field, but it's being accessed in a static method. The method GetPublicClientAppInstanceAsync is now static (line 778), so it cannot access the instance field _iWin32WindowFunc. This will cause a compilation error.

Suggested change

new(parameters.Authority, redirectUri, applicationClientId, _iWin32WindowFunc);

new(parameters.Authority, redirectUri, applicationClientId, null);

Copilot · 2026-01-13T22:20:25Z

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs

+                return string.CompareOrdinal(_authority, pcaKey._authority) == 0
                    && string.CompareOrdinal(_redirectUri, pcaKey._redirectUri) == 0
                    && string.CompareOrdinal(_applicationClientId, pcaKey._applicationClientId) == 0
                    #if NETFRAMEWORK
                    && pcaKey._iWin32WindowFunc == _iWin32WindowFunc
                    #endif


The standalone semicolon on line 1088 is unnecessary and reduces readability. Place the semicolon at the end of the last condition on line 1087 (or line 1084 for non-NETFRAMEWORK builds) instead.

mdaigle added 17 commits January 12, 2026 12:14

Mark AzureDirectoryIntegrated as obsolete.

1bffa97

Refactor public client app creation.

0e8d4ac

Refactor null result handling for public client branches.

0739e75

Refactor to switch statement.

122cfdd

Split interactive and device flow cases.

113f5a2

Fix timeout conversion bug.

c62099e

Remove default that can't be hit.

372b00e

Clean up null checks.

d30d1ed

Refactor interactive auth flow to single helper method.

0260668

Clean up interactive helper method.

abdcd3e

Move all code flow logic to helper method. Include trace logging.

d63328c

Move integrated and password to helper methods.

c799a6a

Convert helpers to static methods.

a5b768a

Move authority split to helper method.

8fdfac2

Standardize return types to simplify switch statement.

1eb02e4

Clean up return type name and docs for authority split helper.

c3ea29c

Add doc comments prompt and generate doc comments for ActiveDirectory…

b4be4de

…AuthenticationProvider.cs

Copilot AI review requested due to automatic review settings January 13, 2026 20:48

mdaigle marked this pull request as ready for review January 13, 2026 20:48

mdaigle requested a review from a team as a code owner January 13, 2026 20:48

mdaigle changed the title ~~[azure-split] Refactors to simplify WAM support diff~~ [feat/azure-split] Refactors to simplify WAM support diff Jan 13, 2026

Copilot started reviewing on behalf of mdaigle January 13, 2026 20:48 View session

Copilot AI reviewed Jan 13, 2026

View reviewed changes

mdaigle added 3 commits January 13, 2026 13:03

Update tool names.

9249ab9

Walk back integrated as obsolete. Will do this as standalone work aft…

4cd3488

…er team discussion.

Ignore obsolete warning.

bad2a00

Copilot AI review requested due to automatic review settings January 13, 2026 22:14

Copilot AI reviewed Jan 13, 2026

View reviewed changes

	private static IPublicClientApplication CreateClientAppInstance(PublicClientAppKey publicClientAppKey)
	private IPublicClientApplication CreateClientAppInstance(PublicClientAppKey publicClientAppKey)

	SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync \| Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult .ExpiresOn);
	SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync \| Acquired access token (silent) for {0} auth mode. Expiry Time: {1}", parameters.AuthenticationMethod, cachedResult.ExpiresOn);

	new(parameters.Authority, redirectUri, applicationClientId, _iWin32WindowFunc);
	new(parameters.Authority, redirectUri, applicationClientId);

-            AuthenticationResult result = await app.AcquireTokenInteractive(scopes)
-                .WithCorrelationId(connectionId)
-                .WithCustomWebUi(customWebUI)
+            var interactiveBuilder = app.AcquireTokenInteractive(scopes)
+                .WithCorrelationId(connectionId);
+            if (customWebUI is not null)
+            {
+                interactiveBuilder = interactiveBuilder.WithCustomWebUi(customWebUI);
+            }
+            AuthenticationResult result = await interactiveBuilder

	CancellationTokenSource ctsInteractive = new();
	using CancellationTokenSource ctsInteractive = new();

Conversation

mdaigle commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mdaigle commented Jan 13, 2026 •

edited

Loading