AuthConfiguration interface

The connection registry: a map of connection name to that connection's settings.

connections?: Map<string, AuthConfiguration>

Property Value

Remarks

Each value is the ConnectionSettings for one connection (typed as AuthConfiguration for backward compatibility; only the connection-settings subset is consumed). An AuthProvider is created per entry by AuthProviderFactory, dispatched by authType.

A list of connection map items to map service URLs to connection names.

connectionsMap?: ConnectionMapItem[]

Property Value

An optional alternative blueprint Connection name used when constructing a connector client.

altBlueprintConnectionName?: string

Property Value

Remarks

Equivalent to the .NET AlternateBlueprintConnectionName connection setting. alternateBlueprintConnectionName is an alias of this property that matches the .NET name exactly; when both are provided this property takes precedence.

Inherited From ConnectionSettings.altBlueprintConnectionName

Alias of altBlueprintConnectionName named to match the .NET AlternateBlueprintConnectionName connection setting exactly.

alternateBlueprintConnectionName?: string

Property Value

Remarks

Provided for stricter .NET parity. The two properties are kept in sync during configuration normalization; altBlueprintConnectionName takes precedence when both are set.

Inherited From ConnectionSettings.alternateBlueprintConnectionName

authority?: string

Property Value

Remarks

If not populated the Entra Public Cloud endpoint is assumed. This example of Public Cloud Endpoint is https://login.microsoftonline.com see also https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud

Inherited From ConnectionSettings.authority

Entra Authentication Endpoint to use.

authorityEndpoint?: string

Property Value

Remarks

If not populated the Entra Public Cloud endpoint is assumed. This example of Public Cloud Endpoint is https://login.microsoftonline.com see also https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud

Inherited From ConnectionSettings.authorityEndpoint

The authentication type for the connection.

authType?: string

Property Value

Inherited From ConnectionSettings.authType

The Azure region for ESTS-R regional token acquisition (e.g. 'westus', 'eastus'). When set, MSAL routes token requests to the specified regional endpoint. See https://learn.microsoft.com/en-us/entra/msal/javascript/node/regional-authorities for details.

azureRegion?: string

Property Value

Inherited From ConnectionSettings.azureRegion

The sidecar downstream API name used to acquire the Blueprint (agent application) token for the agentic FIC chain.

blueprintServiceName?: string

Property Value

Remarks

Only used when authType is 'EntraAuthSideCar'. Defaults to 'agenticblueprint'. This downstream API must be configured app-only with the api://AzureAdTokenExchange/.default scope.

Inherited From ConnectionSettings.blueprintServiceName

When true, disables the loopback/private-address safety check on the resolved sidecar base URL.

bypassLocalNetworkRestriction?: boolean

Property Value

Remarks

UNSAFE. Leave this false in all normal deployments. Only enable it for a carefully validated private-network configuration where the sidecar is reachable at a non-private address that the operator explicitly trusts. Only used when authType is 'EntraAuthSideCar'.

Inherited From ConnectionSettings.bypassLocalNetworkRestriction

The path to the certificate key file.

certKeyFile?: string

Property Value

Inherited From ConnectionSettings.certKeyFile

The path to the certificate PEM file.

certPemFile?: string

Property Value

Inherited From ConnectionSettings.certPemFile

The client ID for the authentication configuration. Required in production.

clientId?: string

Property Value

Inherited From ConnectionSettings.clientId

The client secret for the authentication configuration.

clientSecret?: string

Property Value

Inherited From ConnectionSettings.clientSecret

The connection name for the authentication configuration.

connectionName?: string

Property Value

Inherited From ConnectionSettings.connectionName

The federated client ID for the authentication configuration, used for workload identity federation scenarios.

federatedClientId?: string

Property Value

Inherited From ConnectionSettings.federatedClientId

The path to the federated token file used for Workload Identity authentication.

federatedTokenFile?: string

Property Value

Inherited From ConnectionSettings.federatedTokenFile

FICClientId?: string

Property Value

Inherited From ConnectionSettings.FICClientId

Sets the resource URL for Identity Proxy Manager (IDPM).

idpmResource?: string

Property Value

Remarks

Set this to the appropriate resource identifier when the application is running in an environment, such as a Foundry container, that exposes Managed Identity through a container-specific IMDS endpoint. This setting is only meaningful when using Identity Proxy Manager (AuthType.IdentityProxyManager) for authentication.

Inherited From ConnectionSettings.idpmResource

A list of valid issuers for the authentication configuration.

issuers?: string[]

Property Value

Inherited From ConnectionSettings.issuers

Maximum number of retries for an MSAL HTTP request that returns status 408.

msalRetryCount?: number

Property Value

Remarks

The initial request is not included in this count. Set to 0 to disable retries. Defaults to 2.

Inherited From ConnectionSettings.msalRetryCount

HTTP request timeout (in milliseconds) for sidecar calls.

requestTimeout?: number

Property Value

Remarks

Only used when authType is 'EntraAuthSideCar'. Defaults to 30000 (30 seconds).

Inherited From ConnectionSettings.requestTimeout

Number of retry attempts for transient sidecar failures (5xx, 408, 429, network/timeout).

retryCount?: number

Property Value

Remarks

Only used when authType is 'EntraAuthSideCar'. Defaults to 3.

Inherited From ConnectionSettings.retryCount

scope?: string

Property Value

Inherited From ConnectionSettings.scope

The scopes for the authentication configuration.

scopes?: string[]

Property Value

Inherited From ConnectionSettings.scopes

Indicates whether to send the X5C param or not (for SNI authentication).

sendX5C?: boolean

Property Value

Inherited From ConnectionSettings.sendX5C

The configured downstream API service name in the sidecar's DownstreamApis configuration.

serviceName?: string

Property Value

Remarks

Only used when authType is 'EntraAuthSideCar'. Defaults to 'default'.

Inherited From ConnectionSettings.serviceName

Optional base URL of the Entra Agent ID sidecar (agent container).

sidecarBaseUrl?: string

Property Value

Remarks

Only used when authType is 'EntraAuthSideCar'. Resolution order: SIDECAR_URL environment variable > this setting > http://localhost:5178. Regardless of how it is resolved, the host must be a loopback/private address unless bypassLocalNetworkRestriction is set.

Inherited From ConnectionSettings.sidecarBaseUrl

The tenant ID for the authentication configuration.

tenantId?: string

Property Value

Inherited From ConnectionSettings.tenantId

Whether to validate the token issuer against issuers.

validateIssuer?: boolean

Property Value

Remarks

Disabled by default for backward compatibility. Tenant-to-issuer binding is always applied independently when both claims contain comparable tenant GUIDs.

Inherited From ConnectionSettings.validateIssuer

WIDAssertionFile?: string

Property Value

Inherited From ConnectionSettings.WIDAssertionFile