Introduce new authentication provider `Unauthenticated` #3075

Copilot · 2026-01-21T17:00:23Z

Why make this change?

New authentication provider where all operations run as anonymous. Useful when DAB is behind an app gateway or APIM where authentication is handled externally.

What is this change?

Core Implementation:

Added IsUnauthenticatedAuthenticationProvider() to AuthenticationOptions.cs
Created UnauthenticatedAuthenticationHandler in UnauthenticatedAuthentication folder (follows Simulator pattern, returns unauthenticated ClaimsPrincipal)
Updated Startup.cs to register the provider in both ConfigureAuthentication() and ConfigureAuthenticationV2()
Added explicit mapping in ClientRoleHeaderAuthenticationMiddleware.ResolveConfiguredAuthNScheme() for proper scheme selection at request time

CLI & Validation:

Updated Utils.ValidateAudienceAndIssuerForJwtProvider() to accept Unauthenticated without JWT
Added single general warning in ConfigGenerator.IsConfigValid() when used with authenticated/custom roles (not an error)

Schema:

Added Unauthenticated to dab.draft.schema.json provider enum

Key behaviors:

Allowed in production mode (unlike Simulator)
Allowed with authenticated/custom role permissions (warning emitted)
No JWT configuration required

How was this tested?

Integration Tests
Unit Tests
- ValidateUnauthenticatedProviderIdentification test in AuthenticationConfigValidatorUnitTests.cs
- Unauthenticated test cases in TestValidateAudienceAndIssuerForAuthenticationProvider (UtilsTests.cs)
- Unauthenticated test case in TestBaseRouteIsConfigurableForSWA (EndToEndTests.cs)
- Unauthenticated test case in TestUpdateAuthenticationProviderHostSettings (ConfigureOptionsTests.cs)
- Snapshot test for config generation with Unauthenticated provider

Sample Request(s)

dab init --database-type mssql --connection-string "..." --auth.provider Unauthenticated

dab configure --runtime.host.authentication.provider Unauthenticated

Config snippet:

{
  "runtime": {
    "host": {
      "authentication": {
        "provider": "Unauthenticated"
      }
    }
  }
}

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

…and JSON schema Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Copilot

Pull request overview

Introduces a new Unauthenticated authentication provider intended to treat all requests as anonymous without requiring JWT configuration.

Changes:

Added an Unauthenticated ASP.NET Core auth handler/scheme and wired it into Startup auth registration paths.
Updated CLI validation and config validation logic to allow Unauthenticated without JWT (with warnings for non-anonymous role permissions).
Extended schema and CLI tests/snapshots to include the new provider.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/Service/Startup.cs	Registers the Unauthenticated auth scheme in both auth configuration paths.
src/Core/AuthenticationHelpers/UnauthenticatedAuthenticationHandler/UnauthenticatedAuthenticationHandler.cs	New auth handler that yields an anonymous principal.
src/Core/AuthenticationHelpers/UnauthenticatedAuthenticationHandler/UnauthenticatedAuthenticationDefaults.cs	Defines the scheme name constants for the new provider.
src/Core/AuthenticationHelpers/UnauthenticatedAuthenticationHandler/UnauthenticatedAuthenticationBuilderExtensions.cs	Adds an `AuthenticationBuilder` extension to register the new scheme.
src/Core/AuthenticationHelpers/SupportedAuthNProviders.cs	Adds `Unauthenticated` to the supported provider constants.
src/Config/ObjectModel/AuthenticationOptions.cs	Adds provider detection helper and updates JWT-required determination logic.
src/Cli/Utils.cs	Allows Unauthenticated to omit JWT audience/issuer and updates messaging.
src/Cli/ConfigGenerator.cs	Emits a warning when Unauthenticated is used with non-anonymous permissions.
src/Cli.Tests/ValidateConfigTests.cs	Adds unit tests for Unauthenticated provider helper methods.
src/Cli.Tests/Snapshots/InitTests.EnsureCorrectConfigGenerationWithDifferentAuthenticationProviders_47836da0dfbdc458.verified.txt	Updates snapshot for config generation using Unauthenticated.
src/Cli.Tests/InitTests.cs	Adds Unauthenticated as a test case for init/config generation.
schemas/dab.draft.schema.json	Adds `Unauthenticated` to the provider enum and documents it.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/Service/Startup.cs

src/Cli/Utils.cs

src/Cli/ConfigGenerator.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

JerryNixon · 2026-01-22T16:39:35Z

@copilot apply changes based on the comments in this thread

…xplicit Where() filtering, add unit tests Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Copilot · 2026-01-22T16:44:35Z

@copilot apply changes based on the comments in this thread

Applied all changes from the review thread in e3fb034:

Added Unauthenticated mapping in ResolveConfiguredAuthNScheme()
Refactored foreach loops to use explicit .Where() filtering
Added unit test for non-anonymous role detection

RubenCerna2079 · 2026-01-22T20:43:02Z

/azp run

azure-pipelines · 2026-01-22T20:43:32Z

Azure Pipelines successfully started running 6 pipeline(s).

JerryNixon · 2026-01-22T22:51:34Z

@RubenCerna2079 you will need to help here and resolve the integration test errs for me.

RubenCerna2079 · 2026-01-22T23:18:28Z

src/Cli/ConfigGenerator.cs

+                    {
+                        foreach (KeyValuePair<string, Entity> entity in config.Entities.Where(e => e.Value.Permissions is not null))
+                        {
+                            foreach (EntityPermission permission in entity.Value.Permissions!.Where(p => !p.Role.Equals("anonymous", StringComparison.OrdinalIgnoreCase)))


Isn't this foreach redundant? Since all of the entities would be unauthenticated, wouldn't it be better to only give a general warning?

Simplified in f0b25d0. Changed to emit a single general warning instead of per-entity warnings when non-anonymous roles are detected.

RubenCerna2079 · 2026-01-23T20:05:17Z

src/Config/ObjectModel/AuthenticationOptions.cs

+    /// <summary>
+    /// Returns whether the configured Provider value matches the unauthenticated authentication type.
+    /// </summary>
+    /// <returns>True when all operations run as anonymous.</returns>


Suggested change

/// <returns>True when all operations run as anonymous.</returns>

/// <returns>True if Provider is Unauthenticated type.</returns>

Fixed in f0b25d0.

RubenCerna2079 · 2026-01-23T20:05:29Z

src/Config/ObjectModel/AuthenticationOptions.cs

+    public const string UNAUTHENTICATED_AUTHENTICATION = "Unauthenticated";
+
+    /// <summary>
+    /// Returns whether the configured Provider value matches the unauthenticated authentication type.


Suggested change

/// Returns whether the configured Provider value matches the unauthenticated authentication type.

/// Returns whether the configured Provider value matches the Unauthenticated authentication type.

Fixed in f0b25d0.

RubenCerna2079 · 2026-01-23T20:44:27Z

src/Core/AuthenticationHelpers/ClientRoleHeaderAuthenticationMiddleware.cs

        {
            return SimulatorAuthenticationDefaults.AUTHENTICATIONSCHEME;
        }
+        else if (string.Equals(configuredProviderName, SupportedAuthNProviders.UNAUTHENTICATED, StringComparison.OrdinalIgnoreCase))


Wonder if this need more testing

Added test case ValidateUnauthenticatedProviderIdentification in AuthenticationConfigValidatorUnitTests.cs to validate the Unauthenticated provider detection. Additional coverage is provided through the existing tests that now include Unauthenticated: TestValidateAudienceAndIssuerForAuthenticationProvider, TestBaseRouteIsConfigurableForSWA, and TestUpdateAuthenticationProviderHostSettings.

RubenCerna2079 · 2026-01-27T21:40:25Z

...ticationHelpers/UnauthenticatedAuthenticationHandler/UnauthenticatedAuthenticationHandler.cs

+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace Azure.DataApiBuilder.Core.AuthenticationHelpers.UnauthenticatedAuthenticationHandler;


Change the name of the folder in which this file resides to UnauthenticatedAuthentication

Done in f0b25d0. Renamed folder to UnauthenticatedAuthentication and updated all namespace references.

RubenCerna2079 · 2026-01-27T21:44:34Z

.../AuthenticationHelpers/UnauthenticatedAuthentication/UnauthenticatedAuthenticationHandler.cs

+/// <summary>
+/// This class is used to best integrate with ASP.NET Core AuthenticationHandler base class.
+/// When "Unauthenticated" is configured, this handler authenticates the user as anonymous,
+/// without reading any HTTP authentication headers.


Suggested change

/// <summary>

/// This class is used to best integrate with ASP.NET Core AuthenticationHandler base class.

/// When "Unauthenticated" is configured, this handler authenticates the user as anonymous,

/// without reading any HTTP authentication headers.

/// <summary>

/// This class is used to best integrate with ASP.NET Core AuthenticationHandler base class.

/// Ref: https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Core/src/AuthenticationHandler.cs

/// When "Unauthenticated" is configured, this handler authenticates the user as anonymous,

/// without reading any HTTP authentication headers.

Fixed in f0b25d0. Added reference to ASP.NET Core AuthenticationHandler.

RubenCerna2079 · 2026-01-27T21:58:59Z

.../AuthenticationHelpers/UnauthenticatedAuthentication/UnauthenticatedAuthenticationHandler.cs

+        ClaimsIdentity identity = new();
+        ClaimsPrincipal claimsPrincipal = new(identity);
+
+        AuthenticationTicket ticket = new(claimsPrincipal, UnauthenticatedAuthenticationDefaults.AUTHENTICATIONSCHEME);


Why do we need to add UnauthenticatedAuthenticationDefaults.AUTHENTICATIONSCHEME for the AuthenticationTicket if the in the ClaimsIdentity we don't use it since it is an unauthenticated user?

The AuthenticationTicket requires a scheme name as part of the ASP.NET Core authentication infrastructure. While the ClaimsIdentity has no authenticationType (making it unauthenticated), the ticket still needs to identify which authentication handler processed the request. This follows the same pattern as SimulatorAuthenticationHandler.

RubenCerna2079

Missing tests for the following test methods

TestValidateAudienceAndIssuerForAuthenticationProvider in UtilTests.cs
TestBaseRouteIsConfigurableForSWA in EndToEndTests.cs
TestUpdateAuthenticationProviderHostSettings in ConfigureOptionsTests.cs

RubenCerna2079 · 2026-01-28T00:14:12Z

src/Cli.Tests/ValidateConfigTests.cs

+    /// Test that the Unauthenticated provider is correctly identified by the IsUnauthenticatedAuthenticationProvider method.
+    /// </summary>
+    [TestMethod]
+    public void TestIsUnauthenticatedAuthenticationProviderMethod()


This tests should be in AuthenticationConfigValidatorUnitTests.cs

Moved in f0b25d0. Test ValidateUnauthenticatedProviderIdentification now in AuthenticationConfigValidatorUnitTests.cs.

RubenCerna2079 · 2026-01-28T00:15:02Z

src/Cli.Tests/ValidateConfigTests.cs

+    /// Test that Unauthenticated provider does not require JWT configuration.
+    /// </summary>
+    [TestMethod]
+    public void TestUnauthenticatedProviderDoesNotRequireJwt()


This test should not exist

Removed in f0b25d0.

RubenCerna2079 · 2026-01-28T00:20:04Z

/azp run

azure-pipelines · 2026-01-28T00:20:28Z

Azure Pipelines successfully started running 6 pipeline(s).

…ing, add tests Co-authored-by: RubenCerna2079 <32799214+RubenCerna2079@users.noreply.github.com>

Copilot · 2026-01-28T00:27:22Z

Missing tests for the following test methods

TestValidateAudienceAndIssuerForAuthenticationProvider in UtilTests.cs

TestBaseRouteIsConfigurableForSWA in EndToEndTests.cs
...

Added in f0b25d0:

TestValidateAudienceAndIssuerForAuthenticationProvider: Added 4 test cases for Unauthenticated provider
TestBaseRouteIsConfigurableForSWA: Added Unauthenticated test case
TestUpdateAuthenticationProviderHostSettings: Added Unauthenticated test case

Initial plan

4618b06

Copilot AI assigned Copilot and JerryNixon Jan 21, 2026

Copilot started work on behalf of JerryNixon January 21, 2026 17:00 View session

Copilot AI and others added 3 commits January 21, 2026 17:07

Updated plan with new requirements

e4c09d2

Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Add Unauthenticated authentication provider with CLI support, tests, …

f63c338

…and JSON schema Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Fix typo in UnauthenticatedAuthenticationBuilderExtensions comment

1a2f633

Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add new authentication provider 'Unauthenticated'~~ Introduce new authentication provider Unauthenticated Jan 21, 2026

Copilot AI requested a review from JerryNixon January 21, 2026 17:30

Copilot finished work on behalf of JerryNixon January 21, 2026 17:30

JerryNixon approved these changes Jan 21, 2026

View reviewed changes

JerryNixon assigned Copilot and unassigned Copilot Jan 21, 2026

JerryNixon marked this pull request as ready for review January 21, 2026 21:35

JerryNixon requested a review from Aniruddh25 as a code owner January 21, 2026 21:35

Copilot AI review requested due to automatic review settings January 21, 2026 21:35

JerryNixon requested review from Alekhya-Polavarapu, RubenCerna2079, aaronburtle, anushakolan, neeraj-sharma2592, rusamant, sourabh1007, souvikghosh04 and vadeveka as code owners January 21, 2026 21:35

Copilot started reviewing on behalf of JerryNixon January 21, 2026 21:36 View session

JerryNixon approved these changes Jan 21, 2026

View reviewed changes

Copilot AI reviewed Jan 21, 2026

View reviewed changes

src/Service/Startup.cs Show resolved Hide resolved

src/Cli/Utils.cs Outdated Show resolved Hide resolved

src/Cli/ConfigGenerator.cs Show resolved Hide resolved

src/Cli/ConfigGenerator.cs Outdated Show resolved Hide resolved

src/Cli/ConfigGenerator.cs Outdated Show resolved Hide resolved

Update src/Cli/Utils.cs

b6d0fd5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into copilot/add-unauthenticated-auth-provider

a441af8

Copilot started work on behalf of JerryNixon January 22, 2026 16:40 View session

Address PR review comments: add Unauthenticated scheme mapping, use e…

e3fb034

…xplicit Where() filtering, add unit tests Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Copilot AI requested a review from JerryNixon January 22, 2026 16:46

Copilot finished work on behalf of JerryNixon January 22, 2026 16:46

RubenCerna2079 self-assigned this Jan 22, 2026

JerryNixon unassigned JerryNixon and Copilot Jan 23, 2026

JerryNixon approved these changes Jan 23, 2026

View reviewed changes

RubenCerna2079 reviewed Jan 27, 2026

View reviewed changes

RubenCerna2079 requested changes Jan 28, 2026

View reviewed changes

Merge branch 'main' into copilot/add-unauthenticated-auth-provider

00444b8

Copilot started work on behalf of RubenCerna2079 January 28, 2026 00:20 View session

Address PR review comments: rename folder, update docs, simplify warn…

f0b25d0

…ing, add tests Co-authored-by: RubenCerna2079 <32799214+RubenCerna2079@users.noreply.github.com>

Copilot AI requested a review from RubenCerna2079 January 28, 2026 00:27

Copilot finished work on behalf of RubenCerna2079 January 28, 2026 00:27

	/// <returns>True when all operations run as anonymous.</returns>
	/// <returns>True if Provider is Unauthenticated type.</returns>

	/// Returns whether the configured Provider value matches the unauthenticated authentication type.
	/// Returns whether the configured Provider value matches the Unauthenticated authentication type.

Introduce new authentication provider Unauthenticated #3075

Are you sure you want to change the base?

Introduce new authentication provider Unauthenticated #3075

Conversation

Copilot AI commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why make this change?

What is this change?

How was this tested?

Sample Request(s)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JerryNixon commented Jan 22, 2026

Uh oh!

Copilot AI commented Jan 22, 2026

Uh oh!

RubenCerna2079 commented Jan 22, 2026

Uh oh!

azure-pipelines bot commented Jan 22, 2026

Uh oh!

JerryNixon commented Jan 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 commented Jan 28, 2026

Introduce new authentication provider `Unauthenticated` #3075

Introduce new authentication provider `Unauthenticated` #3075

Copilot AI commented Jan 21, 2026 •

edited

Loading