Make ITokenCredentialProvider public - #17387
Merged
Merged
Conversation
Move the ITokenCredentialProvider interface from Aspire.Hosting.Azure.Provisioning.Internal to the public Aspire.Hosting.Azure namespace and change its accessibility to public. This allows integrations and app host code outside of Aspire.Hosting.Azure to resolve the service from DI and obtain the TokenCredential that Aspire uses to authenticate against Azure, configured by Aspire's Azure provisioning options. The DefaultTokenCredentialProvider implementation remains internal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Eric Erhardt (eerhardt)
requested review from
Mitch Denny (mitchdenny) and
Sébastien Ros (sebastienros)
as code owners
May 22, 2026 17:45
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17387Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17387" |
David Fowler (davidfowl)
approved these changes
May 22, 2026
Eric Erhardt (eerhardt)
enabled auto-merge (squash)
May 22, 2026 17:49
Contributor
There was a problem hiding this comment.
Pull request overview
Exposes ITokenCredentialProvider as a public API in Aspire.Hosting.Azure so external integrations and AppHost code can reuse the same cached/configured TokenCredential Aspire uses for Azure provisioning and SDK calls.
Changes:
- Moves
ITokenCredentialProviderout ofAspire.Hosting.Azure.Provisioning.Internaland makes itpublicinAspire.Hosting.Azurewith XML documentation. - Updates internal callers to reference the new public namespace (removes now-unneeded internal
usingdirectives). - Adds new unit tests validating DI registration, singleton behavior, indirect registration via Azure resources, and replacement via custom implementation.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/Aspire.Hosting.Azure.Tests/TokenCredentialProviderTests.cs | Adds tests for DI registration/singleton behavior and custom replacement of ITokenCredentialProvider. |
| src/Aspire.Hosting.Foundry/PromptAgent/AzurePromptAgentResource.cs | Drops the Provisioning.Internal import now that the provider interface is public. |
| src/Aspire.Hosting.Azure/Provisioning/Internal/IProvisioningServices.cs | Removes the internal ITokenCredentialProvider declaration from the internal services file. |
| src/Aspire.Hosting.Azure/ITokenCredentialProvider.cs | Introduces the new public ITokenCredentialProvider API with documentation. |
| src/Aspire.Hosting.Azure.ContainerRegistry/AzureContainerRegistryHelpers.cs | Drops the Provisioning.Internal import now that the provider interface is public. |
Contributor
|
❓ CLI E2E Tests unknown — 96 passed, 0 failed, 5 unknown (commit View all recordings
📹 Recordings uploaded automatically from CI run #26303155864 |
Contributor
|
✅ No documentation update needed. Documentation was authored for |
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When integrations and app host code outside of
Aspire.Hosting.Azureneed to call Azure APIs, they need aTokenCredential. Internally,Aspire.Hosting.Azurealready builds and caches one — configured by the user's Azure provisioning options (tenant id, credential source, etc.) and matched to the run/publish execution context — but the service that exposes it (ITokenCredentialProvider) isinternal, so external callers couldn't reuse it. They had to construct their own credential and risk drifting from the credential Aspire itself uses.This change makes
ITokenCredentialProviderpart of the public surface so external callers can resolve the sameTokenCredentialthat Aspire uses for provisioning and Azure API calls.User-facing usage
Integrations and app host code can resolve the provider from DI in any context that has access to
IServiceProviderand use the credential to talk to Azure:The service is registered as a singleton by
AddAzureProvisioning, which is also called indirectly byAddAzureEnvironmentand the Azure resource extension methods — so anyone using Aspire's Azure hosting integrations already has it registered. Callers can also replace the registration with their own implementation if they want to plug in a custom credential.Implementation notes
ITokenCredentialProviderfromAspire.Hosting.Azure.Provisioning.InternaltoAspire.Hosting.Azureand changed the accessibility topublic. Added<remarks />documentation noting the lifetime, configuration source, and that the concrete credential type is an implementation detail.DefaultTokenCredentialProvider(the implementation) staysinternal.Aspire.Hosting.Azure.Provisioning.Internalremain internal.using Aspire.Hosting.Azure.Provisioning.Internal;directives inAzureContainerRegistryHelpers.csandAzurePromptAgentResource.cs.Validation
TokenCredentialProviderTestswith 4 tests:AddAzureProvisioningregistersITokenCredentialProviderand yields a non-nullTokenCredential.TokenCredential).AddAzureInfrastructure) also registers the provider via the indirectAddAzureProvisioningpath.ITokenCredentialProviderwith a custom implementation.DefaultTokenCredentialProviderTests,DefaultUserPrincipalProviderTests) still pass.Aspire.Hosting.Azure.ContainerRegistry,Aspire.Hosting.Foundry) build cleanly with the moved interface.Fixes # (issue)
Checklist
<remarks />and<code />elements on your triple slash comments?