Repository navigation
Backport AOT-safe auth provider to release/7.0 branch #4349
Description
Summary
Backport the AOT-safe authentication provider work from PR #4348 to the release/7.0 branch for the 7.0.2 milestone.
Parent Issue
Child of #4193
Scope
Cherry-pick or port the following changes from dev/paul/aot → release/7.0:
- Public API:
SqlAuthenticationProviderManager.GetProvider(),SetProvider(),ApplicationClientId - Feature switch:
Microsoft.Data.SqlClient.EnableReflectionBasedAuthenticationProviderDiscovery[FeatureSwitchDefinition]on .NET 9+ILLink.Substitutions.xmlfor .NET 8
- ILLink substitutions split (cross-platform vs Windows-only)
- Ref assembly updates
- Unit tests (
SqlAuthenticationProviderManagerTests,ILLinkSubstitutionsTests) - AotCompatibility test app
Acceptance Criteria
- All changes compile on
release/7.0branch - Unit tests pass
- Native AOT publish succeeds with feature switch disabled
-
LoadAzureExtensionProviderconfirmed trimmed in ILC map - ILLink resources correctly embedded per platform
Notes
- May require adaptation if
release/7.0has diverged from the main development branch - Verify TFM differences (7.0 branch may not target net10.0)
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
github-actions commentedon Jun 9, 2026
🔍 Triage Summary
Area\Azure ConnectivityAnalysis
This is a well-scoped backport task to cherry-pick/port the AOT-safe authentication provider changes from PR #4348 (targeting
main) into therelease/7.0branch for the 7.0.2 hotfix milestone. The underlying regression (#4193) is high severity (P1) — Entra ID authentication silently fails under NativeAOT in v7.0 due to reflection-based provider discovery, breaking Azure SQL connectivity for AOT-published apps. The fix involves makingSqlAuthenticationProviderManagerpublic, adding a trimmer feature switch, splitting ILLink substitution files per platform, updating ref assemblies, and adding AOT compatibility tests.Next Steps
release/7.0againstmain— the 7.0 branch likely targetsnet8.0/net9.0but notnet10.0, so anynet10.0-specific code (e.g.,[FeatureSwitchDefinition]usage gating) may need adjustment.ILLink.Substitutions.Windows.xmlsplit applies cleanly to the 7.0 branch structure.release/7.0after the port and confirm the AotCompatibility test app publishes without errors.main, create a follow-up PR targetingrelease/7.0using branch prefixdev/automation/backport-aot-auth-provider-7.0.