Allow passing an external authentication token override instead of using the builtin authentication handler

Relevant area(s)

COM API, WinGet CLI, PowerShell Module

Description of the new feature / enhancement

Summary

Add a command line argument as well as COM API support to supply an external authentication token, overriding the default authentication flow.

Background

The builtin authentication support (AppInstaller::Authentication) currently either supports no authentication or the use of Entra ID authentication via WebAuthenticationCoreManager. This has some shortcomings with unattended deployments:

• WebAuthenticationCoreManager has bugs involving running programs as different users (#6186). This can be worked around when using WebAuthenticationCoreManager directly by delegating the user authentication flow to a helper process, but this is not possible when using WinGet, as its API does not allow passing in an external token but requires using the builtin WebAuthenticationCoreManager flow.
• There is no way to make system-wide unattended installations work without user interaction, as WinGet does not support requesting a machine token. This would also require the device to have a corresponding Entra ID principal via a device attach / join.
• --authentication-mode silent is not useful for unattended deployments as it does not guarantee success - after all, the user must have authenticated themselves at some point. It also requires WinGet to run as the user, not as LocalSystem, which isn't possible with users not having administrator access and the installer requiring elevation.

In our case, a user should be able to order software and have it installed without further interaction via our client management solution, where the software resides in a private WinGet repository protected from unauthorized access via Entra ID authentication - we don't need to authenticate as the user, we need to authenticate as an Entra ID principal we can grant access to, but WinGet doesn't allow for external authentication flows.

Proposed technical implementation details

• Extend AuthenticationAccount with String AuthenticationToken;.
• Extend the CLI interface with --authentication-token akin to --authentication-mode and --authentication-account.
• Pass both values to AppInstaller::Authenticator as part of the AuthenticationArguments.
• Adjust AppInstaller::Authentication::AuthenticateForToken to return the token from the authentication arguments, if present.

Start with AuthenticationAccount in src/Microsoft.Management.Deployment/PackageManager.idl, then trace the CLI options analogous to --authentication-mode and --authentication-account. Follow AuthenticationArguments into AppInstaller::Authenticator and Authentication::AuthenticateForToken. Done means the external token can be supplied through the CLI and COM API and is returned by AuthenticateForToken when present.