Skip to content

Harden cross-platform MSAL broker initialization - #1

Merged
jformacek merged 5 commits into
mainfrom
jformacek-cross-platform-powershell-tests
Sep 4, 2026
Merged

Harden cross-platform MSAL broker initialization#1
jformacek merged 5 commits into
mainfrom
jformacek-cross-platform-powershell-tests

Conversation

@jformacek

Copy link
Copy Markdown
Contributor

MSAL broker initialization previously applied Windows-oriented settings across every platform and could silently select or miss incompatible native runtimes. This change makes broker behavior explicit per operating system and architecture while keeping non-broker authentication usable when a broker runtime is unsupported.

Changes

  • Centralize Windows, Linux, and macOS broker configuration, including RID, native filename, redirect URI, account listing, and parent-window behavior.
  • Load native broker runtimes lazily and require the exact platform asset, with actionable errors for missing files, load failures, and unsupported architectures.
  • Configure only the current operating system in BrokerOptions; use the macOS unsigned-script redirect URI and avoid Windows parent-window handling there.
  • Add a PowerShell 7 GitHub Actions matrix for Windows, Ubuntu, and macOS and make test paths platform-neutral.
  • Document the supported broker OS and architecture combinations.

Validation

  • Pester: 3 passed, 1 integration test skipped because credentials were not configured.
  • Windows x64 broker factory construction and native runtime loading completed successfully.
  • Module manifest validation completed successfully.

Full interactive broker authentication still requires an enrolled, interactive desktop and is outside the scope of hosted CI.

jformacek and others added 5 commits September 4, 2026 13:09
Configure MSAL broker loading per operating system and architecture, fail clearly for unsupported runtimes, and add Windows, Linux, and macOS CI coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Replace Mono-dependent NuGet restore with dotnet restore, validate copied managed and native assets, and exercise broker loading in the OS test matrix.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add WebKitGTK to the Ubuntu test runner so the MSAL native broker runtime can be loaded by the cross-platform smoke test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Run credentialed integration coverage only through a main-restricted GitHub Environment, keep pull request jobs secret-free, and require complete configuration for integration runs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Request a GitHub Actions OIDC token and use it as an MSAL client assertion to acquire an Azure Resource Manager token through the protected integration environment.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@jformacek
jformacek deployed to confidential-client-integration September 4, 2026 12:15 — with GitHub Actions Active
@jformacek
jformacek merged commit 7a2c5a4 into main Sep 4, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant