Skip to content

Replacing AuthHandler with AuthHandlerSettings - #633

Open
Rodrigo Brandão (rodrigobr-msft) wants to merge 8 commits into
mainfrom
users/robrandao/auth-handler-settings
Open

Rodrigo Brandão (rodrigobr-msft) wants to merge 8 commits into
mainfrom
users/robrandao/auth-handler-settings

Conversation

@rodrigobr-msft

@rodrigobr-msft Rodrigo Brandão (rodrigobr-msft) commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Introduces AuthHandlerSettings to distinguish OAuth configuration from the authorization handlers that execute authentication flows.

  • Adds a unified settings parameter accepting an AuthHandlerSettings instance or a configuration dictionary across user, agentic, and connector authorization handlers.
  • Treats supplied settings as authoritative: handler-level keyword arguments do not override or supplement them. Settings objects are reused directly; dictionaries are converted to AuthHandlerSettings.
  • Preserves case-insensitive configuration keys, normalizes authorization types, and supports scope strings or lists.
  • Updates Authorization, ApplicationOptions, and the 1.10.0 changelog.

Backward Compatibility

  • Deprecates AuthHandler in favor of AuthHandlerSettings.
  • Deprecates handler constructor parameters auth_handler and auth_handler_settings in favor of settings.
  • Retains legacy keyword arguments and positional AuthHandler usage, with deprecation warnings where applicable.

Tests

Migrates fixtures to settings= and covers configuration aliases, scope parsing and copying, settings-object reuse, ignored handler keyword arguments, and legacy compatibility.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Dictionary-based construction loses configuration, and the sample’s direct entry point cannot start.

2 open issues
What changed in this PR

Introduces AuthHandlerSettings to distinguish OAuth configuration from authorization behavior while retaining deprecated AuthHandler compatibility.

Changes:

  • Adopts and exports the new settings type across core APIs and tests.
  • Preserves constructor extras and updates agentic settings lookup.
  • Adds a BizChat SSO sample with aiohttp hosting.
File Description
tests/​hosting_core/​app/​_oauth/​test_authorization.py Uses the new settings type.
tests/​hosting_core/​app/​_oauth/​test_auth_handler.py Migrates settings tests.
tests/​_common/​testing_objects/​testing_authorization.py Updates fixture annotations.
tests/​_common/​data/​auth_test_data.py Migrates shared test data.
test_samples/​bizchat-sso/​src/​start_server.py Adds aiohttp hosting.
test_samples/​bizchat-sso/​src/​main.py Adds the sample launcher.
test_samples/​bizchat-sso/​src/​agent.py Demonstrates sign-in and sign-out.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​authorization.py Adopts settings in authorization configuration.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​auth_handler.py Introduces settings and deprecated compatibility subclass.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​_handlers/​connector_user_authorization.py Updates settings annotations.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​_handlers/​agentic_user_authorization.py Reads the resolved alternate blueprint setting.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​_handlers/​_authorization_handler.py Constructs the new settings type.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​__init__.py Exports settings from OAuth.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​app_options.py Updates application option typing.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​__init__.py Exports settings from app.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​__init__.py Exports settings from core.

Review effort: Balanced

Comment thread test_samples/bizchat-sso/src/agent.py Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Empty OAuth overrides can restore unwanted configuration, and the sample unnecessarily requires testing dependencies at startup.

1 open issue
2 resolved since last review

Review effort: Balanced

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Empty settings dictionaries are rejected despite an explicit handler ID, unlike equivalent settings objects.

1 open issue
1 previously missed issue

In code that hasn't changed since last review

Medium severity Empty settings dictionary incorrectly treated as missing

libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​oauth/​_handlers/​_authorization_handler.py:59

settings={} is treated as missing: ConnectorUserAuthorization(storage, connections, settings={}, auth_handler_id="connector") raises, while the equivalent settings=AuthHandlerSettings() succeeds. This affects all three handler types and prevents using default settings with an explicit ID through the dictionary API. Check settings is None in this guard and settings is not None when selecting the settings source. Add a regression test comparing both representations with an explicit handler ID.

1 resolved since last review

Review effort: Balanced

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants