AOT 3: Move authentication registration to an AOT-safe Abstractions registry

.github/instructions/architecture.instructions.md

@@ -161,6 +161,16 @@ Located in `ConnectionPool/`:
 - Pool groups manage pools for different connection strings
 
 ### Authentication Providers
+The provider registry, authentication configuration handlers and `SqlAuthenticationInitializer`
+live in `Microsoft.Data.SqlClient.Extensions/Abstractions`, targeting `net462;netstandard2.0;net10.0`.
+The driver forwards their public types and delegates authentication lookup directly.
+Abstractions' cached feature switches and separate capability guards keep explicit registration
+AOT-safe while removing reflective configuration and Azure discovery from trimmed/AOT publishes.
+Abstractions owns its authentication `AzureExtensionLoader`; it does not include sources from
+SqlClient or Azure. The driver independently loads Azure for attestation, without processing
+authentication configuration or consulting authentication discovery switches. Keep the two
+loaders' assembly identity checks consistent.
+
 Located in `SSPI/` and authentication-related files:
 - Windows Authentication (SSPI/Kerberos)
 - SQL Server Authentication

.github/instructions/features.instructions.md

@@ -243,7 +243,8 @@ AppContext switches allow runtime behavior changes without modifying connection
 | Switch Name | Default | Description |
 |-------------|---------|-------------|
 | `Switch.Microsoft.Data.SqlClient.DisableTNIRByDefaultInConnectionString` | `false` | Disables Transparent Network IP Resolution by default |
-| `Switch.Microsoft.Data.SqlClient.EnableAppConfig` | `true` | .NET only. Controls whether SqlClient reads app.config: configurable retry logic, authentication providers and switch overrides. See [Trimming](#trimming) |
+| `Switch.Microsoft.Data.SqlClient.EnableAppConfig` | `true` | Controls authentication configuration in Abstractions and .NET-only driver retry/switch overrides. Trimmed/AOT authentication paths are removed automatically. See [Trimming](#trimming) |
+| `Switch.Microsoft.Data.SqlClient.EnableAzureExtensionDiscovery` | `true` | Controls reflective Azure authentication discovery; trimmed/AOT .NET 10 publishes remove this guarded path |
 | `Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault` | `false` | Sets `MultiSubnetFailover=true` as the default for all connections |
 | `Switch.Microsoft.Data.SqlClient.EnableTransactionIsolationLevelReset` | `false` | Resets a changed session transaction isolation level to `READ COMMITTED` before a pooled connection is reused |
 | `Switch.Microsoft.Data.SqlClient.EnableUserAgent` | varies | Controls sending user agent information to SQL Server |
@@ -270,8 +271,14 @@ configuration, and may register providers in code instead.
 - **Partial configuration:** the driver applies the valid settings and uses defaults for the rest.
 - **Invalid entries:** an invalid `useWamBroker` value is traced and ignored, keeping the default
   and other valid settings. Configuration-reading errors (`ConfigurationErrorsException`) are
-  traced and produce empty settings without trying legacy. Other exception types propagate;
-  initializer and provider validation or activation can still fail.
+  traced and produce empty settings without trying legacy. Other exception types reach registry
+  bootstrap, which traces recoverable failures and continues with enabled Azure discovery.
+- **Activation failures:** recoverable initializer failures are traced without preventing the
+  configured provider list from being applied. Failed provider entries are traced and skipped,
+  and later entries are still attempted. Enabled Azure discovery runs afterward using valid
+  option overrides and fills only unregistered methods. Successful configuration registrations
+  retain precedence. Fatal activation errors propagate. Configuration and discovery are attempted
+  once; restart after correcting configuration to retry failed entries.
 - **Internal handler metadata mismatches:** assert in Debug. In Release, treat the affected
   string setting or provider list as empty while retaining other valid settings.
   Omitting an optional XML attribute uses the handler's default and is not a metadata mismatch.
@@ -284,11 +291,9 @@ configuration, and may register providers in code instead.
 To diagnose unexpected provider selection, turn on `SqlClientEventSource` tracing.
 Skipped or invalid settings are reported there.
 
-These loading policies apply to the new Abstractions loader; the driver continues using its
-existing reader until the registry migration in #4821.
-
-On .NET, `Switch.Microsoft.Data.SqlClient.EnableAppConfig` controls whether configuration
-is read at all. See [Trimming](#trimming).
+These policies apply during registry bootstrap through the Abstractions loader.
+`Switch.Microsoft.Data.SqlClient.EnableAppConfig` gates authentication configuration reading
+on .NET and .NET Framework without changing parsing policy. See [Trimming](#trimming).
 
 ### Usage Example
 ```csharp
@@ -315,9 +320,17 @@ Setting `EnableAppConfig` to `false` at publish time removes the configuration r
 </ItemGroup>
 ```
 
-Setting it only at run time, with `AppContext.SetSwitch` or `runtimeconfig.json`, stops the reading but leaves the trim warnings. On .NET Framework the switch has no effect, since trimming does not apply there.
+Setting it only at run time, with `AppContext.SetSwitch` or `runtimeconfig.json`, stops the reading but cannot remove code at publish time. On .NET Framework, the switch disables authentication configuration loading in Abstractions; the driver's retry configuration and switch-override readers remain .NET-only. Trimming does not apply to .NET Framework.
 
 ### Guidelines for Adding New Switches
+Authentication gates live in Abstractions' `AuthenticationFeatureSwitches.cs`, separately from
+the driver's `LocalAppContextSwitches.cs`. `EnableAppConfig` and `EnableAzureExtensionDiscovery`
+default to `true` and cache their first value. Separate capability guards remove authentication configuration,
+initializer loading and Azure discovery automatically in trimmed/AOT .NET 10 publishes.
+Explicit provider registration remains available. Authentication's EnableAppConfig gate also
+applies on .NET Framework; the driver's retry/switch-override readers remain .NET-only.
+Runtime AppContext changes do not affect publish-time trimming.
+
 1. Define the switch name constant in `LocalAppContextSwitches.cs`
 2. Add a cached property with lazy evaluation pattern (see existing switches)
 3. Default to `false` — the switch should opt-in to the new behavior

BUILDGUIDE.md

@@ -91,7 +91,8 @@ extend the driver's runtime support below .NET Framework 4.6.2 or .NET 10.
 | Driver reference and unsupported-platform assemblies | `net462;net10.0;netstandard2.0` |
 | Existing dual-target tests, stress projects, and their shared helpers | `net462;net10.0` |
 | Modern-only projects, including performance tests | `net10.0` |
-| AKV Provider, Abstractions, Logging, and standard-only test utilities | `netstandard2.0` only |
+| Abstractions | `net462;netstandard2.0;net10.0` |
+| AKV Provider, Logging, and standard-only test utilities | `netstandard2.0` only |
 | Azure extensions | `net462;netstandard2.0` |
 | Microsoft.SqlServer.Server (independently versioned; unchanged here) | `net46;netstandard2.0` |
 | PackageCompatibility tool and tests (xUnit v3) | `net481;net10.0` |
@@ -196,6 +197,25 @@ PowerShell script tests. The tool test targets use their own runner options rath
 test parameters below; see the [PackageCompatibility](tools/PackageCompatibility/README.md) and
 [PackageValidator](tools/PackageValidator/README.md) guides.
 
+Authentication registry, callback, switch, formatter and exception tests are ordinary xUnit tests
+under `src/Microsoft.Data.SqlClient.Extensions/Abstractions/test`. Run this focused target on Linux:
+
+```bash
+dotnet build build.proj -t:TestAbstractions -p:TestFramework=net10.0 -p:ReferenceType=Project
+```
+
+Signed Abstractions builds use the repository test public key for their `InternalsVisibleTo`
+grant in Package mode. Pass `-p:ReferenceType=Package` together with `SigningKeyPath` and
+`TestSigningKeyPath` to run signed tests. `TestAbstractions` prepares the Logging package unless
+`SkipDependencyPack=true` and forwards the selected reference mode, versions and signing keys.
+The test project still references Abstractions directly; its Logging dependency follows the
+selected reference mode. Signed Project builds intentionally omit test access.
+
+The executable current/legacy app.config compatibility harness is deferred to
+[#4817](https://github.com/dotnet/SqlClient/pull/4817); its scenario project and test target are
+not available in this layer. Executing `net462` tests requires Windows; a Linux cross-build is
+not runtime validation.
+
 > [!TIP]
 > In project-reference mode, test targets automatically build their dependencies. In package mode,
 > prepare the referenced packages first; see [Package Mode Builds](#package-mode-builds).

build.proj

@@ -344,7 +344,7 @@
 
     <!--
       SigningKeyPath
-      Applies to:     Build*, Pack* (driver targets only)
+      Applies to:     Build*, Pack*, TestAbstractions
       Description:    Path to the key to use to strong name sign binaries. If omitted, binaries
                       will not be strong name signed.
                       For Pack* targets, this only applies to a build - ie, if PackBuild is set to
@@ -359,10 +359,11 @@
 
     <!--
       TestSigningKeyPath
-      Applies to:     TestSqlClientUnit
+      Applies to:     TestSqlClientUnit, TestAbstractions
       Description:    Path to the key used to sign test assemblies. Required in Package mode when
                       SigningKeyPath is set so that InternalsVisibleTo grants from signed driver
-                      assemblies can be fulfilled.
+                      assemblies can be fulfilled. Also used by signed Abstractions tests to match
+                      the friend assembly's public key.
       Default value:  [blank]
       Example:        C:\path\to\sqlclient-test-key.snk
     -->
@@ -865,7 +866,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -894,7 +895,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->
@@ -1094,18 +1095,29 @@
   </Target>
 
   <!-- TestAbstractions: Runs Microsoft.Data.SqlClient.Extensions.Abstractions.Tests -->
-  <Target Name="TestAbstractions">
+  <PropertyGroup>
+    <TestAbstractionsDependsOn Condition="'$(ReferenceType)' == 'package' AND '$(SkipDependencyPack)' != 'true'">PackLogging</TestAbstractionsDependsOn>
+  </PropertyGroup>
+  <Target Name="TestAbstractions" DependsOnTargets="$(TestAbstractionsDependsOn)">
     <PropertyGroup>
-      <!--
-        Note: This test exclusively uses project references, so neither ReferenceType nor any
-        package version arguments are specified in this command.
-      -->
       <LogFilePrefix>AbstractionsTests-$(OS)</LogFilePrefix>
       <LogFilePrefix Condition="'$(TestFramework)' != ''">$(LogFilePrefix)-$(TestFramework)</LogFilePrefix>
 
       <DotnetCommand>
         "$(DotnetPath)dotnet" test "$(AbstractionsTestProjectPath)"
         -p:Configuration=$(Configuration)
+        $(SigningKeyPathArgument)
+        $(TestSigningKeyPathArgument)
+
+        <!-- Versioning arguments -->
+        $(BuildNumberArgument)
+        $(BuildSuffixArgument)
+        $(PackageVersionSqlClientArgument)
+        $(FileVersionSqlClientArgument)
+
+        <!-- Reference Type Arguments -->
+        $(ReferenceTypeArgument)
+
         $(TestBlameArgument)
         $(TestCodeCoverageArgument)
         $(TestFiltersArgument)

eng/pipelines/scripts/tests/Build-Orchestration.Tests.ps1

@@ -213,11 +213,14 @@ Describe 'supported target frameworks' {
                 Frameworks = 'net46;netstandard2.0'
                 Projects = @('src\Microsoft.SqlServer.Server\Microsoft.SqlServer.Server.csproj')
             }
+            @{
+                Frameworks = 'net462;netstandard2.0;net10.0'
+                Projects = @('src\Microsoft.Data.SqlClient.Extensions\Abstractions\src\Abstractions.csproj')
+            }
             @{
                 Frameworks = 'netstandard2.0'
                 Projects = @(
                     'src\Microsoft.Data.SqlClient.Internal\Logging\src\Logging.csproj'
-                    'src\Microsoft.Data.SqlClient.Extensions\Abstractions\src\Abstractions.csproj'
                     'src\Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider\src\Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj'
                     'src\Microsoft.Data.SqlClient\tests\tools\Microsoft.Data.SqlClient.TestUtilities\Microsoft.Data.SqlClient.TestUtilities.csproj'
                     'src\Microsoft.Data.SqlClient\tests\tools\TDS\TDS\TDS.csproj'
@@ -617,6 +620,65 @@ Describe 'build.proj dependency packing' {
     }
 }
 
+Describe 'Abstractions test orchestration' {
+    It 'forwards Package mode, versions and signing keys to the test command' {
+        $arguments = Get-ChildArguments 'TestAbstractions' @(
+            '-p:ReferenceType=Package',
+            '-p:PackageVersionSqlClient=8.1.2-review',
+            '-p:FileVersionSqlClient=8.1.2.42',
+            '-p:BuildNumber=42',
+            '-p:BuildSuffix=ci',
+            '-p:SigningKeyPath=driver-key.snk',
+            '-p:TestSigningKeyPath=test-key.snk'
+        )
+        $testStart = [Array]::IndexOf($arguments, 'test')
+        $testStart | Should -BeGreaterOrEqual 0
+        $testArguments = $arguments[$testStart..($arguments.Count - 1)]
+
+        $testArguments | Should -Contain '-p:ReferenceType=Package'
+        $testArguments | Should -Contain '-p:SqlClientPackageVersion=8.1.2-review'
+        $testArguments | Should -Contain '-p:SqlClientFileVersion=8.1.2.42'
+        $testArguments | Should -Contain '-p:BuildNumber=42'
+        $testArguments | Should -Contain '-p:BuildSuffix=ci'
+        $testArguments | Should -Contain '-p:SigningKeyPath=driver-key.snk'
+        $testArguments | Should -Contain '-p:TestSigningKeyPath=test-key.snk'
+    }
+
+    It 'packs Logging before testing in Package mode with the same version and signing key' {
+        $arguments = Get-ChildArguments 'TestAbstractions' @(
+            '-p:ReferenceType=Package',
+            '-p:PackageVersionSqlClient=8.1.2-review',
+            '-p:SigningKeyPath=driver-key.snk'
+        )
+        $packStart = [Array]::IndexOf($arguments, 'pack')
+        $testStart = [Array]::IndexOf($arguments, 'test')
+        $packStart | Should -BeGreaterOrEqual 0
+        $testStart | Should -BeGreaterThan $packStart
+        $packArguments = $arguments[$packStart..($testStart - 1)]
+
+        (Split-Path $packArguments[1] -Leaf) | Should -Be 'Logging.csproj'
+        $packArguments | Should -Contain '-p:SqlClientPackageVersion=8.1.2-review'
+        $packArguments | Should -Contain '-p:SigningKeyPath=driver-key.snk'
+    }
+
+    It 'does not pack Logging with <Property>' -ForEach @(
+        @{ Property = '-p:ReferenceType=Project' }
+        @{ Property = '-p:SkipDependencyPack=true' }
+    ) {
+        $properties = @($Property)
+        if ($Property -eq '-p:SkipDependencyPack=true') {
+            $properties += '-p:ReferenceType=Package'
+        }
+        $arguments = Get-ChildArguments 'TestAbstractions' $properties
+
+        $arguments | Should -Contain 'test'
+        $arguments | Should -Not -Contain 'pack'
+        if ($Property -eq '-p:SkipDependencyPack=true') {
+            $arguments | Should -Contain '-p:ReferenceType=Package'
+        }
+    }
+}
+
 Describe 'test project family versions' {
     It 'uses the forwarded family version for central dependencies in <Target>' -ForEach @(
         @{ Target = 'BuildSqlClientTestsFunctional' }

src/Microsoft.Data.SqlClient.Extensions/Abstractions/doc/SqlAuthenticationInitializer.xml

@@ -0,0 +1,37 @@
+<!--
+Licensed to the .NET Foundation under one or more agreements.
+The .NET Foundation licenses this file to you under the MIT license.
+See the LICENSE file in the project root for more information.
+-->
+<docs>
+  <members name="SqlAuthenticationInitializer">
+    <SqlAuthenticationInitializer>
+      <summary>Initializes authentication providers configured in app.config.</summary>
+      <remarks>
+        Configured initializers run synchronously during registry bootstrap while the registry lock
+        is held. Calls to <see cref="SqlAuthenticationProvider.GetProvider"/> and
+        <see cref="SqlAuthenticationProvider.SetProvider"/> on the current thread are supported.
+        Do not synchronously wait for another thread that calls either method: that thread blocks
+        on the registry lock, causing a deadlock.
+        Recoverable initialization or registration failures stop this initializer and are traced,
+        but later configured providers and enabled Azure discovery are still attempted.
+        Fatal failures propagate. Earlier registrations and initializer side effects are not
+        rolled back. Enable tracing before the first registry access to capture these failures;
+        failed initialization is not retried until the application restarts.
+      </remarks>
+    </SqlAuthenticationInitializer>
+    <ctor>
+      <summary>Creates an authentication initializer.</summary>
+    </ctor>
+    <Initialize>
+      <summary>Registers application-configured authentication providers.</summary>
+      <remarks>
+        When invoked by registry bootstrap, this method executes while the registry lock is held.
+        Calls to <see cref="SqlAuthenticationProvider.GetProvider"/> and
+        <see cref="SqlAuthenticationProvider.SetProvider"/> on the current thread are supported.
+        Do not synchronously wait for another thread that calls either method. The other thread
+        blocks on the registry lock, causing a deadlock.
+      </remarks>
+    </Initialize>
+  </members>
+</docs>