microsoft / microsoft/agent-framework

.NET: Python: [Feature]: Authentication support from DevUI to Agents

Open
#6,561 0 comments 0 reactions 0 assignees View on GitHub
devui python
Dominant language
Python
Stars
13.6k
Forks
2.3k
Avg merge
2d 45m
Merged PRs (30d)
358

Description

### Description

DevUI has a [simple kind of authentication mechanism](https://learn.microsoft.com/en-us/agent-framework/devui/security?pivots=programming-language-python) based on a Bearer token to prevent unauthorized people from using it. However, it seems like that authentication is limited to that: allowing people to use DevUI or not.

What I am missing is a possibility of letting DevUI authenticate against the Agents that it calls, so that developers can test their Agents with a user-specific context.

Without this, the following is not possible to be tested by DevUI:
- configuring `WithInMemorySessionStore()` + `UseClaimsBasedSessionIsolation()`
- accessing `httpContextAccessor.HttpContext?.User`, e.g. inside a function tool

Possibly this could be circumvented by abstracting away getting the user information. An alternative is to build a custom agent client app for development.

### Code Sample

```markdown

```

### Language/SDK

Both

Contributor guide

Open the contributing guide

Research direction

Start by tracing DevUI's existing Bearer-token flow and the calls it makes to Agents. Compare this with WithInMemorySessionStore(), UseClaimsBasedSessionIsolation(), and httpContextAccessor.HttpContext?.User; done should allow DevUI to pass user-specific authentication context so these scenarios can be tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, python
Domain
authentication, backend-api-design, developer-experience
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.