AOT 6: Validate authentication scenarios and publishing in both reference modes by paulmedynski · Pull Request #4817 · dotnet/SqlClient

paulmedynski · 2026-10-09T18:24:20Z

Description

Integrate authentication compatibility scenarios and trimmed/NativeAOT publishing checks into build orchestration and Linux/Windows CI.

Why?

Authentication behavior must remain consistent across project and package references, supported runtimes, and publishing modes. Executable, isolated consumers verify configuration activation, provider precedence, recovery, and published applications rather than compilation alone.

How

Exercise current/legacy configuration, provider precedence, recoverable invalid-provider/initializer/unsupported-provider entries, one-time failure diagnostics, and disabled switches.
Verify recoverable configuration failures do not prevent enabled Azure discovery or explicit registration, and failed configuration entries are not retried.
Support Project and Package references with local package preparation, distinct family versions, and isolated NuGet caches.
Publish and execute trimmed and NativeAOT Linux consumers with compiler/linker warnings treated as errors, checking that Azure discovery assets are absent and explicit registration succeeds.
Add aggregate scenario and build-only targets, include fixtures in standard test builds, and cover orchestration arguments.
Add independent Linux modern/publishing and Windows .NET Framework CI jobs for both reference modes, and document execution prerequisites.
Keep runtime-family enforcement and its replacement-driver fixture/scenarios out of this PR; they now belong together in final layer AOT 7: Enforce exact loaded authentication family versions #4820.
PR validation: trigger Linux Project/Package scenario, trimmed, and NativeAOT runs.
PR validation: trigger Windows .NET Framework Project/Package scenario runs.

Stack order

AOT 6, after replacement localization PR #4942 and before #4820. This layer is independently valid without runtime family-version enforcement.

The commits and PR bases follow this order in native stack #4943.

Issues

Completes the NativeAOT authentication fix for #4193. Optional runtime-family enforcement follows separately in #4820.

Testing

dotnet build build.proj -t:TestAuthentication -p:ReferenceType=Project -p:Configuration=Release -p:TestFramework=net10.0 -p:AuthenticationPublish=true -v:minimal - passed: six configuration scenarios, trimmed execution, and NativeAOT execution.
NUGET_PACKAGES=<isolated-cache> dotnet build build.proj -t:TestAuthentication -p:ReferenceType=Package -p:Configuration=Release -p:TestFramework=net10.0 -p:AuthenticationPublish=true -p:PackageVersionSqlClient=8.0.0-stack.6pkg -v:minimal - passed: six configuration scenarios, trimmed execution, and NativeAOT execution using locally built packages.
dotnet build build.proj -t:BuildAuthenticationTests -p:ReferenceType=Project -p:Configuration=Debug -p:TestFramework=net462 -v:minimal - passed: .NET Framework fixture compilation; this is not Windows runtime execution.
pwsh -NoProfile -NonInteractive -Command '$r = Invoke-Pester -Path ./eng/pipelines/scripts/tests/Build-Orchestration.Tests.ps1,./eng/pipelines/scripts/tests/Pipeline-Arguments.Tests.ps1 -PassThru; if ($r.FailedCount -gt 0 -or $r.PassedCount -eq 0) { exit 1 }' - passed: 123 tests.
Corrected stale configuration-handler casts, configuration-failure expectations, and the Abstractions target-framework matrix exposed by rebasing onto the current prerequisites.
Package-mode restore reported two credential-provider cache warnings; compilation, scenarios, and both publishes succeeded.
Windows/.NET Framework runtime execution was not run on this Linux host. Full ADO pipeline runs remain pending.

Guidelines

Please review the contribution guidelines before submitting a pull request:

Copilot

🔵 Needs a closer look

Cross-platform pipeline and NativeAOT changes are substantial, while Windows CLR and remote CI execution remain unverified.

0 open findings

What changed in this PR

Adds a dedicated authentication validation harness covering configuration, package/reference modes, runtime mismatches, and trimmed/NativeAOT publishing.

Changes:

Expands fresh-process authentication scenarios and package-source validation.
Adds trim/AOT publishing checks and build orchestration.
Introduces Linux and Windows CI coverage for Project and Package modes.

No actionable defects were identified by inspection. Existing review threads were not provided.

File	Description
`RunAuthenticationTests.ps1`	Orchestrates scenarios, package checks, and publishing.
`AuthenticationTests/README.md`	Documents harness usage and prerequisites.
`PublishTest/PublishTest.csproj`	Configures trim/AOT fixture references.
`PublishTest/Program.cs`	Validates trimmed authentication registration.
`ConfigurationTest/Program.cs`	Expands configuration and failure scenarios.
`ConfigurationTest/ConfigurationTest.csproj`	Adds Azure references.
`bad-unsupported.config`	Adds unsupported-provider scenario.
`bad-provider.config`	Adds missing-provider scenario.
`bad-initializer.config`	Adds missing-initializer scenario.
`Microsoft.Data.SqlClient.slnx`	Includes the publishing fixture.
`Pipeline-Arguments.Tests.ps1`	Checks the authentication CI matrix.
`Build-Orchestration.Tests.ps1`	Verifies harness orchestration and references.
`authentication-validation-stage.yml`	Adds cross-platform authentication jobs.
`dotnet-sqlclient-ci-core.yml`	Integrates the new CI stage.
`BUILDGUIDE.md`	Documents targets and publishing commands.
`build.proj`	Adds complete and build-only authentication targets.
`testing.instructions.md`	Records authentication fixture conventions.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟡 Changes recommended

BuildTests includes authentication fixtures but silently omits their declared net462 target unless explicitly requested.

1 open finding

BuildAuthenticationTests skips net462 when no framework is specified · New

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

The new cross-platform package and NativeAOT CI paths have not yet been compiled or executed remotely, including Windows CLR coverage.

1 open finding

BuildAuthenticationTests skips net462 when no framework is specified

🧠 Review effort: Balanced

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Verified Linux trimmed/NativeAOT and Windows .NET Framework execution results are still needed for both reference modes.

2 open issues

_{Review effort: Balanced}

- Defer executable authentication compatibility tests from #4816 to #4817 - Correct WAM expansion in authentication configuration docs (#4816) - Clarify authentication configuration handlers are infrastructure types

…#4816) * - Expose authentication configuration handlers from Abstractions - Defer executable authentication compatibility tests from #4816 to #4817 - Correct WAM expansion in authentication configuration docs (#4816) - Clarify authentication configuration handlers are infrastructure types * Address authentication configuration review feedback (#4816) Use framework configuration in the net462 Abstractions target. Expose sealed sibling handlers with separate source and XML documentation. Keep driver configuration normalization as a temporary bridge to #4821. Cover real legacy/current configuration activation and preserved reader behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Describe runtime validation in authentication bootstrap documentation - Decouple authentication guidance from consumer version enforcement - Defer the executable runtime-version fixture to #4817

Preserve the final scenario harness, publishing checks, CI wiring and orchestration tests from the original #4817 layer while dropping obsolete intermediate fixture deferrals during restacking. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Relocate runtime-version fixtures and orchestration to the final PR #4820. Align configuration scenarios and framework expectations with the rebased registry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…fixture Keep the independently buildable #4817 fixture compatible with .NET Framework after rebasing the stack. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove the inherited deferral note now that this stack layer supplies the executable scenarios. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Describe runtime validation in authentication bootstrap documentation - Decouple authentication guidance from consumer version enforcement - Defer the executable runtime-version fixture to #4817

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The net462 configuration replacement discards generated assembly-binding redirects, causing provider activation to fail when a dependency needs a redirect rather than testing authentication behavior.

3 open issues

_{Review effort: Balanced}

Build both authentication frameworks by default, normalize cross-platform path assertions, and preserve generated runtime configuration across scenarios. Add regression coverage and update authentication harness documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Pending CI runs leave Windows net462 assembly-binding behavior and Linux trimmed/NativeAOT authentication execution unvalidated in both reference modes.

No open issues 🎉

3 resolved since last review

_{Review effort: Balanced}

github-project-automation Bot added this to SqlClient Board Oct 9, 2026

Copilot AI balanced review requested due to automatic review settings October 9, 2026 18:24

Copilot started reviewing on behalf of paulmedynski October 9, 2026 18:24

View session

paulmedynski added this pull request to stack #4822 October 9, 2026 18:25

Copilot AI reviewed Oct 9, 2026

View reviewed changes

paulmedynski added the Area\Azure Connectivity Use this to tag issues that are related to Azure connectivity. label Oct 13, 2026

paulmedynski added this to the 8.0.0-preview1 milestone Oct 13, 2026

paulmedynski changed the title ~~Validate authentication scenarios and publishing in both reference modes~~ AOT 6: Validate authentication scenarios and publishing in both reference modes Oct 13, 2026

Copilot AI balanced review requested due to automatic review settings October 13, 2026 17:41

Copilot started reviewing on behalf of paulmedynski October 13, 2026 17:42

View session

paulmedynski removed this pull request from stack #4822 October 13, 2026 17:44

paulmedynski added this pull request to stack #4839 October 13, 2026 17:45

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Comment thread build.proj

paulmedynski changed the title ~~AOT 6: Validate authentication scenarios and publishing in both reference modes~~ AOT 7: Validate authentication scenarios and publishing in both reference modes Oct 13, 2026

Copilot AI balanced review requested due to automatic review settings October 14, 2026 11:36

paulmedynski force-pushed the dev/paul/aot/phase-1.6 branch from 7c3e459 to 02d0134 Compare October 14, 2026 11:36

Copilot started reviewing on behalf of paulmedynski October 14, 2026 11:36

View session

paulmedynski removed this pull request from stack #4839 October 14, 2026 11:39

paulmedynski changed the title ~~AOT 7: Validate authentication scenarios and publishing in both reference modes~~ AOT 5: Validate authentication scenarios and publishing in both reference modes Oct 14, 2026

paulmedynski added this pull request to stack #4841 October 14, 2026 11:40

Copilot AI reviewed Oct 14, 2026

View reviewed changes

paulmedynski added a commit that referenced this pull request Oct 14, 2026

Consolidate executable authentication compatibility coverage in #4817

13b25d8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

paulmedynski moved this from To triage to In progress in SqlClient Board Oct 14, 2026

paulmedynski added a commit that referenced this pull request Oct 16, 2026

Defer executable authentication compatibility tests from #4816 to #4817

d68f7c6

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of paulmedynski October 19, 2026 19:08

View session

Copilot AI reviewed Oct 19, 2026

View reviewed changes

paulmedynski linked an issue Oct 20, 2026 that may be closed by this pull request

Entra ID authentication broken under NativeAOT in v7.0 — Extensions.Azure reflection-based discovery is AOT-incompatible #4193

Open

priyankatiwari08 assigned benrr101 and cheenamalhotra Oct 22, 2026

paulmedynski mentioned this pull request Oct 23, 2026

AOT 2: Load and validate authentication configuration in Abstractions #4860

Merged

3 tasks done

paulmedynski and others added 4 commits October 29, 2026 10:25

Reference System.Configuration directly in the net462 authentication …

517c24f

…fixture Keep the independently buildable #4817 fixture compatible with .NET Framework after rebasing the stack. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Document authentication harness availability in #4817

f6637e5

Remove the inherited deferral note now that this stack layer supplies the executable scenarios. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

paulmedynski force-pushed the dev/paul/aot/phase-1.6 branch from b8c7e0c to f6637e5 Compare October 29, 2026 14:02

Base automatically changed from dev/paul/aot/phase-1.5 to main October 29, 2026 14:02

paulmedynski mentioned this pull request Oct 29, 2026

AOT 5: Validate localized authentication resources in Abstractions builds #4942

Draft

1 task done

paulmedynski changed the title ~~AOT 7: Validate authentication scenarios and publishing in both reference modes~~ AOT 6: Validate authentication scenarios and publishing in both reference modes Oct 29, 2026

paulmedynski removed this pull request from stack #4861 October 29, 2026 14:13

paulmedynski changed the base branch from main to dev/paul/aot/phase-1.5 October 29, 2026 14:13

paulmedynski added this pull request to stack #4943 October 29, 2026 14:13

paulmedynski added the Area\Tests Issues that are targeted to tests or test projects label Oct 29, 2026

paulmedynski modified the milestone: 8.0.0-preview1 Oct 29, 2026

Move authentication validation to modern PR pipeline

f359140

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient/tests/AuthenticationTests/RunAuthenticationTests.ps1 Outdated

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Navigation Menu

Repository navigation

AOT 6: Validate authentication scenarios and publishing in both reference modes - #4817

AOT 6: Validate authentication scenarios and publishing in both reference modes#4817
paulmedynski wants to merge 6 commits into
dev/paul/aot/phase-1.5from
dev/paul/aot/phase-1.6

paulmedynski commented Oct 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

paulmedynski commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Why?

How

Stack order

Issues

Testing

Guidelines

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

paulmedynski commented Oct 9, 2026 •

edited

Loading