Adding agentic auth for Agent Framework by mrunalhirve128 · Pull Request #10 · microsoft/Agent365-python

mrunalhirve128 · 2025-11-03T22:23:16Z

Adding agentic auth for Agent Framework

Copilot

Pull Request Overview

This PR modifies the add_tool_servers_to_agent method to enforce authorization requirements and add token exchange functionality. The changes make authentication mandatory and add automatic token exchange when an auth token is not provided.

Makes auth and turn_context required parameters instead of optional
Adds token exchange logic using auth.exchange_token() when auth_token is not provided
Imports utility functions get_ppapi_token_scope and get_use_environment_id

Comments suppressed due to low confidence (2)

libraries/microsoft-agents-a365-tooling-extensions-agentframework/microsoft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py:1

The copyright header format is incorrect. According to Microsoft's standard format, it should be '# Copyright (c) Microsoft Corporation.' followed by '# Licensed under the MIT License.' on the next line.

# Copyright (c) Microsoft. All rights reserved.

libraries/microsoft-agents-a365-tooling-extensions-agentframework/microsoft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py:20

Import of 'get_use_environment_id' is not used.

from microsoft_agents_a365.tooling.utils.utility import (
    get_ppapi_token_scope,
    get_use_environment_id,
)

...soft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py

mrunalhirve128 · 2025-11-03T22:25:58Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2025-11-03T22:26:07Z

@mrunalhirve128 I've opened a new pull request, #11, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

libraries/microsoft-agents-a365-tooling-extensions-agentframework/microsoft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py:1

The copyright header is missing the MIT License line. It should include both the copyright and license information according to the project standards. The header should be:\npython\n# Copyright (c) Microsoft Corporation.\n# Licensed under the MIT License.\n

# Copyright (c) Microsoft. All rights reserved.

...soft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py

…nto users/mrunalhirve/AFAgenticauth

...soft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py

…nto users/mrunalhirve/AFAgenticauth

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

… asserts, and more - Fix #1: Downgrade sensitive data logging from INFO to DEBUG in agent365_exporter.py - Fix #2: Fix unpaired context.attach() in opentelemetry_scope.py add_baggage() by storing and detaching baggage tokens on scope end - Fix #3: Add bounded OrderedDict caps to unbounded dicts in OpenAI trace_processor.py - Fix #4: Replace 30 assert statements with proper TypeError raises in LangChain utils.py - Fix #5: Log security warning when HTTP domain override is detected - Fix #6: Warn when bearer token sent over non-HTTPS connection - Fix #10: Respect Retry-After header and use exponential backoff in retries - Fix #13: Rename reset() to _reset() in ObservabilityHostingManager - Fix #15: Replace print() with logger.warning() in LangChain tracer_instrumentor.py Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com>

* Initial plan * Replace assert statements with explicit TypeError raises in langchain utils Replace all 30 assert statements in utils.py with equivalent if-not-raise TypeError checks. This ensures type validation is not silently stripped when Python runs with -O (optimized mode). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * security: fix sensitive data logging, context leak, unbounded memory, asserts, and more - Fix #1: Downgrade sensitive data logging from INFO to DEBUG in agent365_exporter.py - Fix #2: Fix unpaired context.attach() in opentelemetry_scope.py add_baggage() by storing and detaching baggage tokens on scope end - Fix #3: Add bounded OrderedDict caps to unbounded dicts in OpenAI trace_processor.py - Fix #4: Replace 30 assert statements with proper TypeError raises in LangChain utils.py - Fix #5: Log security warning when HTTP domain override is detected - Fix #6: Warn when bearer token sent over non-HTTPS connection - Fix #10: Respect Retry-After header and use exponential backoff in retries - Fix #13: Rename reset() to _reset() in ObservabilityHostingManager - Fix #15: Replace print() with logger.warning() in LangChain tracer_instrumentor.py Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Restore agent/tenant IDs and response text in exporter log messages Agent IDs and tenant IDs are not sensitive data and are useful for debugging. Restore them in debug/error log messages. Also restore truncated response text in HTTP error logs to help developers debug failures. Log levels remain at DEBUG (from the prior security fix). Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Remove add_baggage() from OpenTelemetryScope The method had an unpaired context.attach() that leaked context tokens. Users should use BaggageBuilder.build() context manager instead, which properly restores the previous context on exit. Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Security hardening for observability packages Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Fix formatting in test_agent365_exporter.py and replace remaining raise TypeError with isinstance guards in langchain utils.py Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Move _parse_retry_after to exporters/utils.py as standalone parse_retry_after function Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Replace type(e).__name__ with str(e) in exporter error logging per PR review Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * feat: add bounded collections for LangChain tracer and OutputScope - Convert LangChain _spans_by_run from unbounded DictWithLock to bounded OrderedDict with _MAX_TRACKED_RUNS=10000 cap - Add _cap_ordered_dict helper for FIFO eviction (matching OpenAI pattern) - Add thread-safe lock usage for _spans_by_run in error handlers - Add _MAX_OUTPUT_MESSAGES=5000 cap for OutputScope._output_messages - Add unit tests for both bounded collections Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> Co-authored-by: Nikhil Navakiran <nikhil.navakiran@gmail.com>

* Initial plan * Replace assert statements with explicit TypeError raises in langchain utils Replace all 30 assert statements in utils.py with equivalent if-not-raise TypeError checks. This ensures type validation is not silently stripped when Python runs with -O (optimized mode). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * security: fix sensitive data logging, context leak, unbounded memory, asserts, and more - Fix microsoft#1: Downgrade sensitive data logging from INFO to DEBUG in agent365_exporter.py - Fix microsoft#2: Fix unpaired context.attach() in opentelemetry_scope.py add_baggage() by storing and detaching baggage tokens on scope end - Fix microsoft#3: Add bounded OrderedDict caps to unbounded dicts in OpenAI trace_processor.py - Fix microsoft#4: Replace 30 assert statements with proper TypeError raises in LangChain utils.py - Fix microsoft#5: Log security warning when HTTP domain override is detected - Fix microsoft#6: Warn when bearer token sent over non-HTTPS connection - Fix microsoft#10: Respect Retry-After header and use exponential backoff in retries - Fix microsoft#13: Rename reset() to _reset() in ObservabilityHostingManager - Fix microsoft#15: Replace print() with logger.warning() in LangChain tracer_instrumentor.py Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Restore agent/tenant IDs and response text in exporter log messages Agent IDs and tenant IDs are not sensitive data and are useful for debugging. Restore them in debug/error log messages. Also restore truncated response text in HTTP error logs to help developers debug failures. Log levels remain at DEBUG (from the prior security fix). Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Remove add_baggage() from OpenTelemetryScope The method had an unpaired context.attach() that leaked context tokens. Users should use BaggageBuilder.build() context manager instead, which properly restores the previous context on exit. Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Security hardening for observability packages Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Fix formatting in test_agent365_exporter.py and replace remaining raise TypeError with isinstance guards in langchain utils.py Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Move _parse_retry_after to exporters/utils.py as standalone parse_retry_after function Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * Replace type(e).__name__ with str(e) in exporter error logging per PR review Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> * feat: add bounded collections for LangChain tracer and OutputScope - Convert LangChain _spans_by_run from unbounded DictWithLock to bounded OrderedDict with _MAX_TRACKED_RUNS=10000 cap - Add _cap_ordered_dict helper for FIFO eviction (matching OpenAI pattern) - Add thread-safe lock usage for _spans_by_run in error handlers - Add _MAX_OUTPUT_MESSAGES=5000 cap for OutputScope._output_messages - Add unit tests for both bounded collections Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: nikhilNava <211831449+nikhilNava@users.noreply.github.com> Co-authored-by: Nikhil Navakiran <nikhil.navakiran@gmail.com>

Add agentic auth for AF

5d811a1

mrunalhirve128 requested a review from rahuldevikar761 as a code owner November 3, 2025 22:23

Copilot AI review requested due to automatic review settings November 3, 2025 22:23

mrunalhirve128 requested review from juliomenendez, nikhilNava and pontemonti as code owners November 3, 2025 22:23

Copilot AI reviewed Nov 3, 2025

View reviewed changes

...soft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py Show resolved Hide resolved

Copilot AI mentioned this pull request Nov 3, 2025

[WIP] Add agentic authentication for Agent Framework #11

Closed

mrunalhirve128 added 2 commits November 3, 2025 14:44

fix

3978d56

format

75a12a8

Copilot AI review requested due to automatic review settings November 3, 2025 22:47

Copilot AI reviewed Nov 3, 2025

View reviewed changes

...soft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py Show resolved Hide resolved

mrunalhirve128 added 2 commits November 3, 2025 15:42

Merge branch 'main' of https://github.com/microsoft/Agent365-python i…

03f49fe

…nto users/mrunalhirve/AFAgenticauth

add env changes

2b421e4

pontemonti reviewed Nov 4, 2025

View reviewed changes

...soft_agents_a365/tooling/extensions/agentframework/services/mcp_tool_registration_service.py Outdated Show resolved Hide resolved

pontemonti previously approved these changes Nov 4, 2025

View reviewed changes

mrunalhirve128 added 2 commits November 4, 2025 10:18

Merge branch 'main' of https://github.com/microsoft/Agent365-python i…

47f6e1a

…nto users/mrunalhirve/AFAgenticauth

PR comments

6739f20

Copilot AI review requested due to automatic review settings November 4, 2025 18:22

mrunalhirve128 dismissed pontemonti’s stale review via 6739f20 November 4, 2025 18:22

pontemonti approved these changes Nov 4, 2025

View reviewed changes

Copilot AI reviewed Nov 4, 2025

View reviewed changes

mrunalhirve128 merged commit 6678329 into main Nov 4, 2025
14 checks passed

pontemonti deleted the users/mrunalhirve/AFAgenticauth branch December 5, 2025 17:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding agentic auth for Agent Framework#10

Adding agentic auth for Agent Framework#10
mrunalhirve128 merged 7 commits intomainfrom
users/mrunalhirve/AFAgenticauth

mrunalhirve128 commented Nov 3, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

mrunalhirve128 commented Nov 3, 2025

Uh oh!

Copilot AI commented Nov 3, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

mrunalhirve128 commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

mrunalhirve128 commented Nov 3, 2025

Uh oh!

Copilot AI commented Nov 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mrunalhirve128 commented Nov 3, 2025 •

edited

Loading