Harden cross-platform MSAL broker initialization

.github/workflows/Publish-AadAuthenticationFactory.yml

@@ -32,15 +32,16 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
     - uses: actions/checkout@v4
-    - uses: nuget/setup-nuget@v1
+    - name: Set up .NET SDK
+      uses: actions/setup-dotnet@v4
       with:
-        nuget-version: 'latest'
+        dotnet-version: 10.0.x
 
     - name: Setup Packages
       shell: pwsh
       run: |
         "Setting up packages"
-        &"$env:GITHUB_WORKSPACE\Workflow\SetupPackages.ps1" -RootPath "$env:GITHUB_WORKSPACE" -NugetPath $env:nuget
+        &"$env:GITHUB_WORKSPACE\Workflow\SetupPackages.ps1" -RootPath "$env:GITHUB_WORKSPACE"
 
     - name: Build Module
       uses: GreyCorbel/PsModuleActions/build-module@v1

.github/workflows/Test-AadAuthenticationFactory.yml

@@ -0,0 +1,122 @@
+name: Test-AadAuthenticationFactory
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: PowerShell 7 on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - windows-latest
+          - ubuntu-latest
+          - macos-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Install Linux broker runtime dependencies
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends libwebkit2gtk-4.1-0
+
+      - name: Restore module dependencies
+        shell: pwsh
+        run: |
+          $setupPackages = Join-Path $env:GITHUB_WORKSPACE 'Workflow' 'SetupPackages.ps1'
+          & $setupPackages -RootPath $env:GITHUB_WORKSPACE
+
+      - name: Build module
+        shell: pwsh
+        run: |
+          $buildModule = Join-Path $env:GITHUB_WORKSPACE 'Workflow' 'BuildModule.ps1'
+          & $buildModule -RootPath $env:GITHUB_WORKSPACE -ModuleName AadAuthenticationFactory
+
+      - name: Run Pester tests
+        shell: pwsh
+        run: |
+          $runTests = Join-Path $env:GITHUB_WORKSPACE 'Workflow' 'RunTests.ps1'
+          & $runTests -RootPath $env:GITHUB_WORKSPACE -ModuleName AadAuthenticationFactory -ExcludeTag integration -CI
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: pester-results-${{ matrix.os }}
+          path: TestResults.xml
+          if-no-files-found: warn
+
+  confidential-client-integration:
+    name: Confidential client integration
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'push'
+    runs-on: ubuntu-latest
+    environment: confidential-client-integration
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      AAD_TEST_TENANT_ID: ${{ secrets.AAD_TEST_TENANT_ID }}
+      AAD_TEST_SCOPE: ${{ secrets.AAD_TEST_SCOPE }}
+      AAD_TEST_CLIENT_ID: ${{ secrets.AAD_TEST_CLIENT_ID }}
+      AAD_TEST_CLIENT_SECRET: ${{ secrets.AAD_TEST_CLIENT_SECRET }}
+      AAD_TEST_EXPECTED_AUD: ${{ secrets.AAD_TEST_EXPECTED_AUD }}
+      AAD_TEST_OIDC_AUDIENCE: ${{ secrets.AAD_TEST_OIDC_AUDIENCE }}
+      AAD_TEST_OIDC_SUBJECT: ${{ secrets.AAD_TEST_OIDC_SUBJECT }}
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Restore module dependencies
+        shell: pwsh
+        run: |
+          $setupPackages = Join-Path $env:GITHUB_WORKSPACE 'Workflow' 'SetupPackages.ps1'
+          & $setupPackages -RootPath $env:GITHUB_WORKSPACE
+
+      - name: Build module
+        shell: pwsh
+        run: |
+          $buildModule = Join-Path $env:GITHUB_WORKSPACE 'Workflow' 'BuildModule.ps1'
+          & $buildModule -RootPath $env:GITHUB_WORKSPACE -ModuleName AadAuthenticationFactory
+
+      - name: Run confidential client integration test
+        shell: pwsh
+        run: |
+          $runTests = Join-Path $env:GITHUB_WORKSPACE 'Workflow' 'RunTests.ps1'
+          & $runTests `
+            -RootPath $env:GITHUB_WORKSPACE `
+            -ModuleName AadAuthenticationFactory `
+            -Tag integration `
+            -RequireIntegrationConfiguration `
+            -CI
+
+      - name: Upload integration test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: confidential-client-integration-results
+          path: TestResults.xml
+          if-no-files-found: warn

.gitignore

@@ -50,6 +50,7 @@ Generated\ Files/
 # NUnit
 *.VisualState.xml
 TestResult.xml
+TestResults.xml
 nunit-*.xml
 
 # Build Results of an ATL Project

Commands/Internal/Get-MsalBrokerPlatformConfiguration.ps1

@@ -0,0 +1,80 @@
+function Get-MsalBrokerPlatformConfiguration {
+    $architecture = [System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture.ToString()
+
+    if ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::Windows)) {
+        $runtime = switch ($architecture) {
+            'X64'   { @{ Rid = 'win-x64'; NativeLibrary = 'msalruntime.dll' } }
+            'X86'   { @{ Rid = 'win-x86'; NativeLibrary = 'msalruntime_x86.dll' } }
+            'Arm64' { @{ Rid = 'win-arm64'; NativeLibrary = 'msalruntime_arm64.dll' } }
+            default { $null }
+        }
+
+        if ($null -eq $runtime) {
+            throw [PlatformNotSupportedException]::new(
+                "MSAL broker authentication is not supported on Windows architecture '$architecture'. Supported architectures: X64, X86, Arm64."
+            )
+        }
+
+        return [pscustomobject]@{
+            OperatingSystem = 'Windows'
+            Architecture = $architecture
+            RuntimeIdentifier = $runtime.Rid
+            NativeLibraryFileName = $runtime.NativeLibrary
+            BrokerOperatingSystem = [Microsoft.Identity.Client.BrokerOptions+OperatingSystems]::Windows
+            RedirectUri = $null
+            UseDefaultRedirectUri = $true
+            UseParentWindow = $true
+            ListOperatingSystemAccounts = $true
+        }
+    }
+
+    if ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::Linux)) {
+        if ($architecture -ne 'X64') {
+            throw [PlatformNotSupportedException]::new(
+                "MSAL broker authentication is not supported on Linux architecture '$architecture' because the bundled native runtime only supports X64."
+            )
+        }
+
+        return [pscustomobject]@{
+            OperatingSystem = 'Linux'
+            Architecture = $architecture
+            RuntimeIdentifier = 'linux-x64'
+            NativeLibraryFileName = 'libmsalruntime.so'
+            BrokerOperatingSystem = [Microsoft.Identity.Client.BrokerOptions+OperatingSystems]::Linux
+            RedirectUri = $null
+            UseDefaultRedirectUri = $true
+            UseParentWindow = $false
+            ListOperatingSystemAccounts = $true
+        }
+    }
+
+    if ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::OSX)) {
+        $runtime = switch ($architecture) {
+            'X64'   { @{ Rid = 'osx-x64'; NativeLibrary = 'msalruntime.dylib' } }
+            'Arm64' { @{ Rid = 'osx-arm64'; NativeLibrary = 'msalruntime_arm64.dylib' } }
+            default { $null }
+        }
+
+        if ($null -eq $runtime) {
+            throw [PlatformNotSupportedException]::new(
+                "MSAL broker authentication is not supported on macOS architecture '$architecture'. Supported architectures: X64, Arm64."
+            )
+        }
+
+        return [pscustomobject]@{
+            OperatingSystem = 'macOS'
+            Architecture = $architecture
+            RuntimeIdentifier = $runtime.Rid
+            NativeLibraryFileName = $runtime.NativeLibrary
+            BrokerOperatingSystem = [Microsoft.Identity.Client.BrokerOptions+OperatingSystems]::OSX
+            RedirectUri = 'msauth.com.msauth.unsignedapp://auth'
+            UseDefaultRedirectUri = $false
+            UseParentWindow = $false
+            ListOperatingSystemAccounts = $false
+        }
+    }
+
+    throw [PlatformNotSupportedException]::new(
+        "MSAL broker authentication is not supported on operating system '$([System.Runtime.InteropServices.RuntimeInformation]::OSDescription)'."
+    )
+}

Commands/Internal/Get-MsalRuntimeRidFolder.ps1

@@ -1,29 +1,3 @@
 function Get-MsalRuntimeRidFolder {
-    # returns one of: win-x64, win-x86, win-arm64, linux-x64, linux-arm64, osx-x64, osx-arm64
-    $arch = [System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture
-
-    if ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::Windows)) {
-        switch ($arch) {
-            'X64'   { return 'win-x64' }
-            'X86'   { return 'win-x86' }
-            'Arm64' { return 'win-arm64' }
-            default { return 'win-x64' }
-        }
-    }
-    elseif ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::Linux)) {
-        switch ($arch) {
-            'X64'   { return 'linux-x64' }
-            'Arm64' { return 'linux-arm64' }
-            default { return 'linux-x64' }
-        }
-    }
-    elseif ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::OSX)) {
-        switch ($arch) {
-            'X64'   { return 'osx-x64' }
-            'Arm64' { return 'osx-arm64' }
-            default { return 'osx-x64' }
-        }
-    }
-
-    return $null
+    (Get-MsalBrokerPlatformConfiguration).RuntimeIdentifier
 }

Commands/Internal/Import-MsalNativeRuntime.ps1

@@ -3,36 +3,52 @@ function Import-MsalNativeRuntime {
         [Parameter(Mandatory)] [string] $ModuleRoot
     )
 
-    $rid = Get-MsalRuntimeRidFolder
-    if ([string]::IsNullOrEmpty($rid)) { return }
-
-    # IMPORTANT: your folder is lowercase "runtimes"
-    $nativeDir = [Path]::Combine($ModuleRoot, 'runtimes', $rid, 'native')
-    if (-not (Test-Path $nativeDir)) { return }
-
-    $candidate = Get-ChildItem -Path $nativeDir -File |
-        Where-Object {
-            $_.Name -match '^msalruntime' -and $_.Extension -in @('.dll','.so','.dylib')
-        } |
-        Select-Object -First 1
+    $platform = Get-MsalBrokerPlatformConfiguration
+    $nativePath = [Path]::Combine(
+        $ModuleRoot,
+        'runtimes',
+        $platform.RuntimeIdentifier,
+        'native',
+        $platform.NativeLibraryFileName
+    )
 
-    if (-not $candidate) {
-        Write-Verbose "MSAL native runtime not found in $nativeDir"
-        return
+    if (-not (Test-Path -LiteralPath $nativePath -PathType Leaf)) {
+        throw [System.IO.FileNotFoundException]::new(
+            "MSAL broker native runtime is missing for OS '$($platform.OperatingSystem)', architecture '$($platform.Architecture)', RID '$($platform.RuntimeIdentifier)'. Expected file: '$nativePath'.",
+            $nativePath
+        )
     }
 
-    if ($PSEdition -eq 'Core') {
-        [System.Runtime.InteropServices.NativeLibrary]::Load($candidate.FullName) | Out-Null
+    if ($script:MsalNativeRuntimePath -eq $nativePath -and $script:MsalNativeRuntimeHandle -ne [IntPtr]::Zero) {
+        return $platform
     }
-    else {
-        # Windows PowerShell 5.1 is Windows-only; LoadLibrary is fine
-        if ($null -eq ('Kernel32' -as [type])) {
-            $helperPath = [Path]::Combine($ModuleRoot, 'Helpers', 'Kernel32.cs')
-            $helperDefinition = Get-Content $helperPath -Raw
-            Add-Type -TypeDefinition $helperDefinition -ReferencedAssemblies @('System.Runtime.InteropServices') -WarningAction SilentlyContinue -IgnoreWarnings
+
+    try {
+        if ($PSEdition -eq 'Core') {
+            $nativeHandle = [System.Runtime.InteropServices.NativeLibrary]::Load($nativePath)
+        }
+        else {
+            if ($null -eq ('Kernel32' -as [type])) {
+                $helperPath = [Path]::Combine($ModuleRoot, 'Helpers', 'Kernel32.cs')
+                $helperDefinition = Get-Content $helperPath -Raw
+                Add-Type -TypeDefinition $helperDefinition -ReferencedAssemblies @('System.Runtime.InteropServices') -WarningAction SilentlyContinue -IgnoreWarnings
+            }
+
+            $nativeHandle = [Kernel32]::LoadLibrary($nativePath)
+            if ($nativeHandle -eq [IntPtr]::Zero) {
+                $errorCode = [Kernel32]::GetLastError()
+                throw [System.ComponentModel.Win32Exception]::new([int]$errorCode)
+            }
         }
-        [Kernel32]::LoadLibrary($candidate.FullName) | Out-Null
     }
+    catch {
+        $message = "Failed to load MSAL broker native runtime for OS '$($platform.OperatingSystem)', architecture '$($platform.Architecture)', RID '$($platform.RuntimeIdentifier)' from '$nativePath'. $($_.Exception.Message)"
+        throw [System.DllNotFoundException]::new($message, $_.Exception)
+    }
+
+    $script:MsalNativeRuntimePath = $nativePath
+    $script:MsalNativeRuntimeHandle = $nativeHandle
+    Write-Information "Loaded MSAL native runtime: $nativePath"
 
-    Write-Information "Loaded MSAL native runtime: $($candidate.FullName)"
+    return $platform
 }

Commands/Internal/Init.ps1

@@ -18,6 +18,8 @@ function Init {
         if ($null -eq $script:AadAuthenticationFactories -or -not ($script:AadAuthenticationFactories -is [hashtable])) {
             $script:AadAuthenticationFactories = @{}
         }
+        $script:MsalNativeRuntimePath = $null
+        $script:MsalNativeRuntimeHandle = [IntPtr]::Zero
 
         # Determine whether MSAL is already loaded
         $msalAlreadyLoaded = $false
@@ -111,7 +113,8 @@ function Init {
         }
 
         # --------------------------------------------------------
-        # Load Broker (if not loaded) + native runtime (cross-platform)
+        # Load the managed broker assembly. Its platform runtime is loaded lazily
+        # when a broker factory is requested so other authentication modes remain usable.
         # --------------------------------------------------------
         $brokerTypePresent = ($null -ne ('Microsoft.Identity.Client.Broker.BrokerExtension' -as [type]))
         if (-not $brokerTypePresent) {
@@ -121,15 +124,12 @@ function Init {
                 Write-Warning ("MSAL version in session is {0} but module broker is {1}. Skipping broker load to avoid version conflicts. Broker-based auth may be unavailable; browser/device-code fallback still works." -f $msalLoadedVersion, $brokerVersion)
             }
             else {
-                # Load broker extension assembly
                 if (-not (Test-Path $brokerDll)) {
                     Write-Warning "Broker DLL not found at $brokerDll. Broker-based auth will be unavailable."
                 }
                 else {
                     Add-Type -Path $brokerDll -ErrorAction Stop | Out-Null
 
-                    # Load native runtime for broker (Windows/Linux/macOS)
-                    Import-MsalNativeRuntime -ModuleRoot $moduleRoot
                 }
             }
         }