[Rodrigo Brandão (rodrigobr-msft)]

Summary

Ports the JWT configuration refactor from users/robrandao/settings:

• Adds ConnectionSettingsBase, JwtConnectionSettings, and TokenValidationConfiguration.
• Updates JwtTokenValidator to bind application configuration while retaining legacy AgentAuthConfiguration support.
• Parses explicit audiences with get_str_list, preserving aliases and empty-value defaults.
• Leaves Connections and ConnectionManager unchanged.

Testing

• Adds regressions for configuration binding, normalization, audience restrictions, issuer validation, tenant binding, routing, and caching.
• Updates aiohttp/FastAPI mock expectations for application-scoped caching.
• Adapter/core authorization suites: 126 passed.
• Latest configuration suite: 38 passed.
• Black and flake8 checks pass.

[Copilot]

🟡 Changes recommended

Aiohttp authorization crashes on unhashable app cache keys, malformed audience settings can broaden inbound trust, and six middleware tests still omit the new cache_key argument.

3 open issues

• Handle unhashable aiohttp apps in validation cache · New
• Reject malformed audience allow-lists instead of widening trust · New
• Update middleware mock assertions for cache_key · New

What changed in this PR

This PR refactors inbound JWT authorization in the Microsoft 365 Agents SDK for Python around dedicated configuration models, while retaining a legacy AgentAuthConfiguration conversion path.

Changes:

• Adds token-validation policy and per-connection JWT settings.
• Updates audience routing and adds application-scoped validator caching to framework middleware.
• Adds tests for configuration binding, authorization, and cache ownership.

File	Description
tests/​hosting_core/​authorization/​test_token_validation_configuration.py	Tests policy binding, audience routing, and issuer validation.
tests/​hosting_core/​authorization/​test_jwt_connection_settings.py	Tests connection settings, issuer defaults, and aliases.
tests/​hosting_core/​authorization/​test_authorize_request.py	Adds root-configuration and validator-cache tests.
libraries/​microsoft-agents-hosting-fastapi/​microsoft_agents/​hosting/​fastapi/​jwt_authorization_middleware.py	Passes the application as the validator cache key.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​jwt/​token_validation_configuration.py	Defines inbound validation policy and connection selection.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​jwt/​jwt_token_validator.py	Uses bound settings with legacy configuration conversion.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​jwt/​jwt_connection_settings.py	Adds JWT-specific connection settings and issuer defaults.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​jwt/​_authorize_request.py	Resolves and caches validators by application owner.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​jwt/​__init__.py	Exports the new configuration models.
libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​connection_settings_base.py	Adds shared configuration binding and provider extras.
libraries/​microsoft-agents-hosting-aiohttp/​microsoft_agents/​hosting/​aiohttp/​jwt_authorization_middleware.py	Passes the application as the validator cache key.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The middleware no longer guards access to the optional ASGI application and its state, causing an AttributeError instead of the intended configuration-not-found response when either is absent.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Restore safe handling for missing optional app state

libraries/​microsoft-agents-hosting-fastapi/​microsoft_agents/​hosting/​fastapi/​jwt_authorization_middleware.py:39

Please retain the previous guard around the optional application and its state. scope["app"] is not required by ASGI, so directly wrapping an ASGI application without this extension now raises AttributeError while evaluating app.state, before _authorize_request can return its configuration-not-found response. Using nested getattr calls preserves the existing error handling for applications without app or state.

3 resolved since last review

• Update middleware mock assertions for cache_key
• Reject malformed audience allow-lists instead of widening trust
• Handle unhashable aiohttp apps in validation cache

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Legacy indexed scope mappings are passed through without conversion to lists, causing ValueError during JwtTokenValidator construction and breaking authorization for existing configurations.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Convert legacy indexed scope mappings to lists before binding

libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​authorization/​connection_settings_base.py:146

The legacy environment loader preserves indexed scopes such as SCOPES__0 as a mapping, which AgentAuthConfiguration.SCOPES retains. Passing that mapping through this binder raises ValueError in Configuration.get_scopes(), so constructing JwtTokenValidator now breaks authorization for existing configurations such as test_samples/entra_sidecar/env.TEMPLATE. Convert legacy scope mappings to lists before binding.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the JWT authorization configuration refactor.

No open issues 🎉

_{Review effort: Balanced}