microsoft / microsoft/agent-framework
.NET: Python: [Feature]: Authentication support from DevUI to Agents
- Dominant language
- Python
- Stars
- 13.6k
- Forks
- 2.3k
- Avg merge
- 2d 45m
- Merged PRs (30d)
- 358
Description
### Description
DevUI has a [simple kind of authentication mechanism](https://learn.microsoft.com/en-us/agent-framework/devui/security?pivots=programming-language-python) based on a Bearer token to prevent unauthorized people from using it. However, it seems like that authentication is limited to that: allowing people to use DevUI or not.
What I am missing is a possibility of letting DevUI authenticate against the Agents that it calls, so that developers can test their Agents with a user-specific context.
Without this, the following is not possible to be tested by DevUI:
- configuring `WithInMemorySessionStore()` + `UseClaimsBasedSessionIsolation()`
- accessing `httpContextAccessor.HttpContext?.User`, e.g. inside a function tool
Possibly this could be circumvented by abstracting away getting the user information. An alternative is to build a custom agent client app for development.
### Code Sample
```markdown
```
### Language/SDK
Both
Contributor guide
Research direction
Start by tracing DevUI's existing Bearer-token flow and the calls it makes to Agents. Compare this with WithInMemorySessionStore(), UseClaimsBasedSessionIsolation(), and httpContextAccessor.HttpContext?.User; done should allow DevUI to pass user-specific authentication context so these scenarios can be tested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, python
- Domain
- authentication, backend-api-design, developer-experience
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100