AOT-safe auth provider with feature switch and trimmer support

[paulmedynski]

Summary

Make SqlAuthenticationProviderManager public with a static GetProvider/SetProvider API and add trimmer/AOT support via a feature switch.

Changes

• Public API: Expose SqlAuthenticationProviderManager.GetProvider(), SetProvider(), and ApplicationClientId as the public surface for authentication provider registration
• Feature switch: Microsoft.Data.SqlClient.EnableReflectionBasedAuthenticationProviderDiscovery
  • Uses [FeatureSwitchDefinition] on .NET 9+ for linker-integrated trimming
  • Uses ILLink.Substitutions.xml for .NET 8 trimmer support
  • When set to false, the reflection-based LoadAzureExtensionProvider() is trimmed away
• ILLink substitutions split into platform-specific files:
  • ILLink.Substitutions.xml — cross-platform (all non-net462 TFMs), contains only the auth provider feature switch
  • ILLink.Substitutions.Windows.xml — Windows-only, contains UseManagedNetworkingOnWindows entries. Prevents a breaking change where Unix consumers setting the switch to false would have UseManagedNetworking incorrectly stubbed
• Ref assembly: Updated without nullable annotations (per existing codebase convention)
• AotCompatibility test app (tools/AotCompatibility/): Validates Native AOT publish succeeds and verifies trimmer removes reflection code when feature switch is disabled
• Unit tests:
  • New tests for the public provider manager API
  • New ILLinkSubstitutionsTests verifying correct embedded resources per platform

Verification

• dotnet build -t:Build succeeds (0 warnings, 0 errors)
• Unit tests pass (782/783 — 1 pre-existing failure unrelated to this PR)
• dotnet publish with Native AOT succeeds for net9.0/net10.0
• ILC map file confirms LoadAzureExtensionProvider is trimmed when feature switch is false
• Unix assembly contains only ILLink.Substitutions.xml
• Windows assembly contains both ILLink.Substitutions.xml and ILLink.Substitutions.Windows.xml

Notes

• The notsupported files need regeneration via GenAPI to pick up the ref assembly changes (not included in this PR to avoid noise)
• Nullable annotations are intentionally omitted from the ref assembly, consistent with existing patterns (e.g., SspiAuthenticationParameters, column encryption providers)

[Copilot]

Pull request overview

This PR exposes an AOT-friendly public authentication provider registration surface (SqlAuthenticationProviderManager) and introduces a feature switch to enable trimming away reflection-based Azure extension provider discovery for NativeAOT/trimming scenarios.

Changes:

• Made SqlAuthenticationProviderManager public with GetProvider/SetProvider APIs and added ApplicationClientId as part of the public surface.
• Added Microsoft.Data.SqlClient.EnableReflectionBasedAuthenticationProviderDiscovery feature switch with trimmer support ([FeatureSwitchDefinition] on .NET 9+ and ILLink.Substitutions.xml for .NET 8).
• Added an tools/AotCompatibility test app plus new/updated unit & functional tests covering the new public API and config behavior.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tools/AotCompatibility/README.md	Documents the AOT compatibility test app and feature switch usage.
tools/AotCompatibility/Program.cs	Implements runtime checks and trimming verification via the ILC map file.
tools/AotCompatibility/Directory.Packages.props	Enables CPM for the tool (project-mode, no package versions).
tools/AotCompatibility/Directory.Build.props	Prevents inheriting repo-wide build props for the tool.
tools/AotCompatibility/AotCompatibility.csproj	Adds the NativeAOT/trimming test app and propagates the feature switch via RuntimeHostConfigurationOption.
src/Microsoft.Data.SqlClient/tests/UnitTests/Microsoft/Data/SqlClient/SqlAuthenticationProviderManagerTests.cs	Adds unit tests for the new public manager API and interop with Abstractions.
src/Microsoft.Data.SqlClient/tests/UnitTests/Microsoft/Data/SqlClient/LocalAppContextSwitchesTest.cs	Extends default-switch tests to cover the new auth discovery switch.
src/Microsoft.Data.SqlClient/tests/FunctionalTests/SqlAuthenticationProviderManagerTests.cs	Adjusts tests (pragma) and adds validation for reading ApplicationClientId from config.
src/Microsoft.Data.SqlClient/tests/FunctionalTests/app.config	Adds applicationClientId attribute to the auth provider config section.
src/Microsoft.Data.SqlClient/tests/FunctionalTests/AADAuthenticationTests.cs	Adds pragma suppression around newly-obsoleted Abstractions API usage.
src/Microsoft.Data.SqlClient/tests/Common/LocalAppContextSwitchesHelper.cs	Adds helper plumbing to reset the new switch in tests.
src/Microsoft.Data.SqlClient/src/Resources/ILLink.Substitutions.xml	Adds substitutions for the new feature switch (and retains UseManagedNetworking stubs).
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlAuthenticationProviderManager.cs	Makes the type public and guards reflection-based discovery behind the new switch; adds AOT/trimming annotations.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/LocalAppContextSwitches.cs	Introduces the new switch property and [FeatureSwitchDefinition] for .NET 9+.
src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.csproj	Embeds ILLink.Substitutions.xml for all non-net462 TFMs.
src/Microsoft.Data.SqlClient/ref/Microsoft.Data.SqlClient.cs	Adds the new public API to the reference assembly (without nullable annotations).
src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/SqlAuthenticationProvider.Internal.cs	Updates reflection binding flags to target public manager methods.
src/Microsoft.Data.SqlClient.Extensions/Abstractions/src/SqlAuthenticationProvider.cs	Marks legacy Abstractions APIs obsolete in favor of the new manager APIs.
doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationProviderManager.xml	Adds public XML doc content for the new manager API.

Comments suppressed due to low confidence (1)

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlAuthenticationProviderManager.cs:346

• SetProvider is now a public API but does not validate the provider argument; passing null currently results in a NullReferenceException. Public APIs should throw ArgumentNullException for null arguments.

        /// <include file='../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationProviderManager.xml' path='docs/members[@name="SqlAuthenticationProviderManager"]/SetProvider/*'/>
        public static bool SetProvider(SqlAuthenticationMethod authenticationMethod, SqlAuthenticationProvider provider)
        {
            if (!provider.IsSupported(authenticationMethod))
            {
                throw SQL.UnsupportedAuthenticationByProvider(authenticationMethod.ToString(), provider.GetType().Name);

[paulmedynski]

I decided against the obsoletion.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 6 comments.

[paulmedynski]

Addressed all actionable review feedback in 11d75ab:

1. Unused using on net462 (comment): Wrapped using System.Diagnostics.CodeAnalysis; in #if NET since the attributes are only referenced inside that conditional.

2. Missing using for SqlConnection (comment): No change needed — SqlConnection resolves via parent namespace (Microsoft.Data.SqlClient.UnitTests → Microsoft.Data.SqlClient). Build confirms clean with no CS0246.

3. Cross-platform substitution assertion on net462 (comment): Added #if NETFRAMEWORK branch with negative assertion (DoesNotContain) confirming the resource is correctly excluded, matching the csproj condition.

4. Windows substitution assertion on net462 (comment): Same approach — net462 now asserts DoesNotContain("ILLink.Substitutions.Windows.xml").

5. "on all TFMs" wording (comment): Reworded to "on .NET 8+" to accurately reflect that net462 has no trimmer support.

6. Publish commands missing -f/-r (comment): Added explicit -f net9.0 -r linux-x64 (and -r win-x64 for Windows) so the commands match the documented output paths.

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.19%. Comparing base (5ac26c9) to head (6038cb0).
⚠️ Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
...icrosoft/Data/SqlClient/LocalAppContextSwitches.cs	63.63%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4348      +/-   ##
==========================================
- Coverage   66.50%   64.19%   -2.32%     
==========================================
  Files         285      280       -5     
  Lines       43311    66184   +22873     
==========================================
+ Hits        28806    42485   +13679     
- Misses      14505    23699    +9194     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	64.19% <77.77%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.

[cheenamalhotra]

This shouldn't be public, it's an optional and in absence driver's own will be picked automatically.

[paulmedynski]

The docs explain why it is public - for AOT apps that want to continue using our Provider, but need a custom app ID that only the Manager knows (i.e. read from config). In the automatic-registration-reflection flow, the Manager supplies it to the Provider's constructor. In the (new) manual-registration flow, the app would have to read it from the same config if this wasn't public. That's an additional burden that we didn't want to impose.

[github-actions]

@paulmedynski This pull request has been marked as Author attention needed.

When you have addressed the reviewer feedback and are ready for another review, please post a comment with /ready to remove the label and re-engage reviewers.