[paulmedynski]

Description

Add authentication configuration loading and parsing to Extensions.Abstractions, so the registry introduced in #4821 can consume settings without activating initializers or providers during loading. The driver is unchanged in this PR and keeps using its existing configuration reader until #4821 replaces it.

Why?

Separating configuration reading from provider activation lets the registry apply settings in a well-defined order and keeps reflection-dependent loading isolated behind trimming annotations. Landing it separately keeps #4821 focused on registration.

How

• Add internal SqlAuthenticationConfiguration, which reads the modern SqlClientAuthenticationProviders section and consults legacy SqlAuthenticationProviders when modern is absent or its handler is incompatible.
• Keep authentication configuration optional: applications may provide full, partial, or no configuration, and may register providers in code instead.
• Match main's relaxed loading behavior: trace ConfigurationErrorsException and return empty settings without trying legacy after a reading failure; trace and ignore incompatible handlers; and trace and ignore invalid useWamBroker overrides while retaining other valid settings.
• Treat missing or incompatible string-property metadata as a handler/reader programming error: assert in Debug and return an empty string for the affected property while retaining other valid settings in Release. Omitting an optional XML attribute is normal and uses the handler's default.
• Snapshot the client ID, broker preference, initializer type name and provider entries without activating types. Authentication-method validation and provider activation remain the registry's responsibility.
• Use exact handler-type identity checks, matching main and supporting the existing type forwards.
• Provide trimming/AOT annotation polyfills for netstandard2.0 and net462. Match Abstractions.Test internal access to the driver's policy: unsigned builds grant access, signed Package builds grant keyed access, and signed Project builds omit access.
• Keep all new test cases in Abstractions.Test. The driver UnitTests project also receives the Package-mode dependency correction listed below; there are no public API additions.
• Document optional configuration, section precedence, tracing and deferred driver integration.

Package-mode build corrections retained in this PR

These corrections address build failures inherited from main, rather than authentication configuration behavior. They are retained here to validate the PR in Package mode and are listed separately to make them easy to identify or revert:

• eng/pipelines/common/templates/jobs/ci-run-tests-job.yml: download the Azure package artifact alongside the other sibling package artifacts.
• eng/pipelines/common/templates/stages/ci-run-tests-stage.yml and eng/pipelines/dotnet-sqlclient-ci-core.yml: pass the Azure artifact name through to the test jobs.
• src/Microsoft.Data.SqlClient/tests/UnitTests/Microsoft.Data.SqlClient.UnitTests.csproj: reference System.Threading.Channels directly because connection-pool tests use it and the driver package does not provide it transitively.
• src/Microsoft.Data.SqlClient/tests/Common/Microsoft.Data.SqlClient.TestCommon.csproj: reference the current-family Abstractions package only for unpinned Package builds. For the specific 7.1.0-preview1.26124.5 baseline, explicitly use the published Abstractions and Logging 1.0.0 packages. That published SqlClient family release contains incorrect dependency declarations pointing to unpublished prerelease sibling packages. This is a permanent workaround so PerformanceTests can use that release as a baseline; TestCommon needs its own overrides because each project is restored independently.

Public API and behavior

This PR adds no public API surface and does not itself change consumer-visible driver behavior. The loader is internal; it becomes active in the driver when #4821 integrates it. Configuration reading in the driver remains gated by EnableAppConfig.

Scenario	Behavior
Neither authentication section exists	Return empty settings without explicit option overrides.
Optional XML attributes are omitted	Use handler defaults; retain other configured settings and provider entries.
Configuration loading throws ConfigurationErrorsException	Trace and return empty settings; do not try legacy after a reading failure. This also applies when the exception wraps a fatal failure, matching main.
Modern section uses an incompatible handler	Trace and ignore it; consult legacy.
Legacy section uses an incompatible handler, including one owned by another SQL provider	Trace and ignore it.
Missing or incompatible string-property metadata	Trigger a Debug assertion; in Release, treat the affected property as empty while retaining other valid settings.
Missing or incompatible provider-collection metadata	Trigger a Debug assertion; in Release, use an empty provider list while retaining other valid settings.
Invalid non-empty useWamBroker value	Trace and leave the override unset; retain other valid settings and the provider's broker default.
Modern section is declared but has no element	Use its empty/default settings; do not read legacy.
Initializer and provider activation	Loading only snapshots settings and provider entries; method validation and activation are deferred to #4821 and may still fail.
Exceptions other than ConfigurationErrorsException	Propagate unchanged.

Use SqlClientEventSource tracing to diagnose ignored configuration or unexpected provider selection.

Provider construction, bootstrap failure handling and Azure discovery are integrated separately in #4821; this PR does not validate or activate configured types during loading.

Issues

Follow-up registry integration: #4821.

Testing

Configuration tests cover real files for both handlers, absent sections, empty and partial sections, omitted and invalid broker values with retained provider entries, malformed configuration, mismatched handlers, and a declared modern section without an element. Parsing tests cover string-schema recovery in Release.

Remaining validation gaps:

• Abstractions.Test remains independent of the driver. Its real-file tests declare handlers through Microsoft.Data.SqlClient.Extensions.Abstractions. Existing driver unit tests verify declarations naming Microsoft.Data.SqlClient through the existing driver reader. The combined end-to-end scenario is added later in AOT 6: Validate authentication scenarios and publishing in both reference modes #4817 (AOT 7).
• The broker-default assertions verify the loader's unset override against a default configuration. They do not activate providers or verify effective runtime broker behavior; activation is outside this loader's responsibility.

Local validation for commit 31870dca93a1eea172e86f0a93c5c57cbf52903f:

• dotnet restore src/Microsoft.Data.SqlClient/tests/PerformanceTests/Microsoft.Data.SqlClient.PerformanceTests.csproj -p:ReferenceType=Package -p:MdsPackageVersion=7.1.0-preview1.26124.5 --verbosity minimal - passed with no warning suppression. The initial condition-only fix exposed NU1603; the final baseline overrides resolve it.
• dotnet test src/Microsoft.Data.SqlClient.Extensions/Abstractions/test/Abstractions.Test.csproj --framework net10.0 --configuration Release --no-restore --verbosity minimal - passed: 100 tests, none skipped.
• dotnet build src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/Abstractions.csproj --framework net462 --configuration Release --no-restore --verbosity minimal - passed with zero warnings and errors.
• dotnet build src/Microsoft.Data.SqlClient/tests/Common/Microsoft.Data.SqlClient.TestCommon.csproj --framework net10.0 --configuration Release -p:ReferenceType=Project --verbosity minimal - passed with zero warnings and errors.
• dotnet build src/Microsoft.Data.SqlClient/tests/Common/Microsoft.Data.SqlClient.TestCommon.csproj --framework net10.0 --configuration Release -p:ReferenceType=Package --verbosity minimal - restore passed, compilation failed because the local cached 8.0.0-preview1-dev driver package contains net8.0/net9.0 DLLs but no required net10.0 DLL. The shared cache was not overwritten.
• MSBuild evaluation matrix - 24 checks passed across target frameworks, reference modes, signing-key/test-key presence, and baseline selection. This checks evaluated dependencies and IVT metadata, not actual signed execution.
• git diff --check - passed before committing.

The following CI runs were queued for commit 31870dca93a1eea172e86f0a93c5c57cbf52903f. Checkboxes remain unchecked pending successful completion.

Pipeline runs:

• sqlclient-non-official-github 26300.2
• CI-SqlClient-Project 30016
• CI-SqlClient-Package 30016

[Copilot]

🔵 Needs a closer look

Successful CI validation of the reviewed head is not yet established.

No open issues 🎉

What changed in this PR

Adds internal authentication configuration loading to Abstractions ahead of the registry migration in #4821. The driver remains unchanged.

Changes:

• Loads modern or legacy configuration and validates metadata without activating providers.
• Adds fatal-exception detection and trimming/AOT annotation polyfills.
• Adds parsing, loading, and exception tests, including signed-build access.

File	Description
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​test/​ExceptionHelpersTest.cs	Tests fatal-exception detection across exception trees.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​test/​AuthenticationConfigurationParsingTest.cs	Tests metadata parsing and snapshot behavior.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​test/​AuthenticationConfigurationLoadingTest.cs	Tests section selection, fallback, and failures.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​test/​Abstractions.Test.csproj	Enables test-assembly signing.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​src/​TrimmingAttributes.cs	Supplies .NET Standard annotation polyfills.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​src/​SqlAuthenticationConfiguration.cs	Loads and validates authentication settings.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​src/​ExceptionHelpers.cs	Classifies nested fatal exceptions.
src/​Microsoft.Data.SqlClient.Extensions/​Abstractions/​src/​Abstractions.csproj	Grants internal test access in signed builds.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Successful current-head CI, including signed-build and cross-target validation, remains unconfirmed.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Successful current-head CI, including signed-build and cross-target validation, remains unconfirmed.

No open issues 🎉

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.60%. Comparing base (7b1184b) to head (31870dc).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4860      +/-   ##
==========================================
- Coverage   67.94%   66.60%   -1.35%     
==========================================
  Files         311      311              
  Lines       45399    68770   +23371     
==========================================
+ Hits        30845    45802   +14957     
- Misses      14554    22968    +8414     

Flag	Coverage Δ
CI-SqlClient	67.73% <ø> (-0.21%)	⬇️
PR-SqlClient-Project	66.17% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

Successful current-head signed-build and cross-target validation remains unconfirmed.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Current-head cross-target and package-reference validation remains unconfirmed for the signing, dependency, and CI artifact changes.

No open issues 🎉

1 resolved since last review

• Make Abstractions dependency baseline-aware to prevent package downgrade

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The supplied validation leaves Package-mode dependency, signed test access, and CI artifact changes insufficiently verified for automated approval.

No open issues 🎉

_{Review effort: Balanced}

[priyankatiwari08]

No new defects in the loader. One build issue remains (inline).

[cheenamalhotra]

Re-reviewed at 8429420. My earlier concerns are fixed and the loader now matches main:

• A broken app.config is traced and treated as empty.
• A wrong section handler is traced and ignored.
• An invalid useWamBroker value is traced and ignored.
• Schema mismatches assert and continue.

Required before approval

1. Fix the perf-baseline restore (NU1605) in TestCommon.csproj. See my reply on the existing thread. It's a small change; please don't defer it.

Non-blocking
2. The Package-mode CI fixes (Azure artifact download in ci-run-tests-job.yml/ci-run-tests-stage.yml/dotnet-sqlclient-ci-core.yml, and System.Threading.Channels in UnitTests) aren't related to auth config. A separate PR is preferred. If you keep them here, list them in the PR description so they're easy to find and revert.
3. Confirm the test signing key question inline on Abstractions.csproj.

I'll approve once item 1 is in and CI is green.

[priyankatiwari08]

Looks good — no concerns.

[Copilot]

🔵 Needs a closer look

A maintainer must verify the applicable review requirements because required supplemental policies were not supplied from a protected source or immutable base SHA.

No open issues 🎉

_{Review effort: Balanced}

[paulmedynski]

I added a section to the PR description explaining why the unrelated CI pipeline changes are incluced in this PR. Without them, the CI pipelines would not run, and I wouldn't have been able to validate the PR. Separating into another PR and waiting for reviews and then rebasing again would have delayed things unnecessarily.