Move auth provider registry into Abstractions; remove core reflection bridge

Relocates the authentication provider registry into the shared Abstractions
assembly and removes the Abstractions->core reflection bridge. A lazy,
core-side AuthenticationBootstrapper performs config-driven and Azure
extension provider discovery, seeding the Abstractions registry on first
federated authentication.

- Add internal AuthenticationProviderRegistry + resource infra
  (AbstractionsStrings) to Abstractions; wire SqlAuthenticationProvider
  Get/SetProvider to it directly.
- Delete SqlAuthenticationProvider.Internal reflection bridge.
- Replace public SqlAuthenticationProviderManager with internal
  AuthenticationBootstrapper in core; remove it from the public ref surface
  and notsupported stubs.
- Trigger bootstrap from SqlConnectionInternal.GetFedAuthToken.
- Redistribute manager tests into Abstractions.Test (registry) and
  UnitTests (bootstrapper); Azure DefaultAuthProviderTests triggers bootstrap
  via reflection (TODO: switch to IVT once PR #4385 signs Azure.Test).
- Update AotCompatibility tool/docs and doc-comment references.

Author: paulmedynski

aot-auth-provider-proposal.md

@@ -131,9 +131,7 @@ See the LICENSE file in the project root for more information.
       <param name="authenticationMethod">The authentication method.</param>
       <returns>The authentication provider or <see langword="null" /> if not found.</returns>
       <remarks>
-        This method is provided for backward compatibility only. New code should use
-        <see cref="M:Microsoft.Data.SqlClient.SqlAuthenticationProviderManager.GetProvider(Microsoft.Data.SqlClient.SqlAuthenticationMethod)" />
-        instead. This method will be deprecated in a future version and subsequently removed.
+        This is the canonical way to retrieve a registered authentication provider.
       </remarks>
     </GetProvider>
     <SetProvider>
@@ -144,9 +142,7 @@ See the LICENSE file in the project root for more information.
         <see langword="true" /> if the operation succeeded; otherwise, <see langword="false" /> (for example, the existing provider disallows overriding).
       </returns>
       <remarks>
-        This method is provided for backward compatibility only. New code should use
-        <see cref="M:Microsoft.Data.SqlClient.SqlAuthenticationProviderManager.SetProvider(Microsoft.Data.SqlClient.SqlAuthenticationMethod,Microsoft.Data.SqlClient.SqlAuthenticationProvider)" />
-        instead. This method will be deprecated in a future version and subsequently removed.
+        This is the canonical way to register an authentication provider.
       </remarks>
     </SetProvider>
   </members>

doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationProviderManager.xml

@@ -35,9 +35,12 @@
   <!-- Strong name signing ============================================= -->
   <!-- This is done in Directory.Build.props -->
 
-  <!-- Unsigned: expose internals to the test assembly in any reference mode. -->
+  <!-- Unsigned: expose internals to the test assembly and to the SqlClient driver in any
+       reference mode.  The driver hosts the authentication provider bootstrapper, which seeds
+       the AuthenticationProviderRegistry (internal to this assembly). -->
   <ItemGroup Condition="'$(SigningKeyPath)' == ''">
     <InternalsVisibleTo Include="$(AssemblyName).Test" />
+    <InternalsVisibleTo Include="Microsoft.Data.SqlClient" />
   </ItemGroup>
 
   <!--
@@ -48,6 +51,12 @@
   -->
   <ItemGroup Condition="'$(SigningKeyPath)' != '' AND '$(ReferenceType)' == 'Package'">
     <InternalsVisibleTo Include="$(AssemblyName).Test, PublicKey=00240000048000001401000006020000002400005253413100080000010001003D19684676DA365F331D00CE7BD4B8EF03E74102F39A5681B40622703D68F0298ECACECC723D3FFC1EA9365AF4958578550EA1EBEEC084B0B3757F3762449F5365E872802A4B548056760764FAD062BFEE81ED26183109AD46810E7E6E965419D0A10473680144D20C1BFE1027A5F586CA987523C06F5C126C44EA7D4F51EB023867A9F294315F95775ACEFD2D678186919458DFCCB4DE2E9F53AEFC766C7CBCEC474ED21C1616E5A9414D366D91D121C39F5FE6641295ADC058EF3FB10593BCDE2E82D9F217C2634909EEF496CD53AE78ABBEA572B871D72EBFC5378205950ABA97C7CCC2B9635D96933D5F9C9624D71FF53EE2094CF3A6BD38534D66E414B7" />
+    <!--
+      Expose internals to the SqlClient driver, which hosts the authentication provider
+      bootstrapper that seeds the AuthenticationProviderRegistry.  The driver is signed with the
+      product key (public key token 23ec7fc2d6eaa4a5), which differs from the test key above.
+    -->
+    <InternalsVisibleTo Include="Microsoft.Data.SqlClient, PublicKey=0024000004800000940000000602000000240000525341310004000001000100C14C6D7EE398F4910F849A9511EC66BBB621E7FFF7E0802860E283AAA4F3B7FAD06A3AFA95628D8907176D3C61E3F4DF845CDD821B3751A9917FC7A5EC2F191C887AAF72732B5FD85F6D82DE8461BCBA93ECCE724737D48683A62089597DE4EA24F263FB9A70B04DD3F4B9A003CE883DAC51DE59A6DB2BAF429A42BCD72112EE" />
   </ItemGroup>
 
   <!-- Build Output ==================================================== -->

src/Microsoft.Data.SqlClient.Extensions/Abstractions/doc/SqlAuthenticationProvider.xml

@@ -0,0 +1,147 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using Microsoft.Data.SqlClient.Internal;
+
+namespace Microsoft.Data.SqlClient;
+
+/// <summary>
+/// Holds the registry of <see cref="SqlAuthenticationProvider"/> instances keyed by
+/// <see cref="SqlAuthenticationMethod"/>.  This is the shared store that backs the public
+/// <see cref="SqlAuthenticationProvider.GetProvider"/> and
+/// <see cref="SqlAuthenticationProvider.SetProvider"/> methods.
+/// </summary>
+/// <remarks>
+/// Providers fall into two categories:
+/// <list type="bullet">
+///   <item>
+///     <description>
+///       Permanent providers, registered via <see cref="SetPermanentProvider"/> (e.g. from an
+///       application's configuration). These take precedence and cannot be overridden by a later
+///       call to <see cref="SetProvider"/>.
+///     </description>
+///   </item>
+///   <item>
+///     <description>
+///       Overridable providers, registered via <see cref="SetProvider"/>. These can be replaced
+///       by subsequent <see cref="SetProvider"/> calls, but never override a permanent provider.
+///     </description>
+///   </item>
+/// </list>
+/// </remarks>
+internal sealed class AuthenticationProviderRegistry
+{
+    /// <summary>
+    /// The singleton instance backing the static accessors.
+    /// </summary>
+    private static readonly AuthenticationProviderRegistry s_instance = new();
+
+    /// <summary>
+    /// Authentication methods whose provider was registered as permanent (e.g. application
+    /// specified). These are not overridable via <see cref="SetProvider"/>.
+    /// </summary>
+    private readonly HashSet<SqlAuthenticationMethod> _permanentProviders = new();
+
+    /// <summary>
+    /// The registered providers keyed by authentication method.
+    /// </summary>
+    private readonly ConcurrentDictionary<SqlAuthenticationMethod, SqlAuthenticationProvider> _providers = new();
+
+    private AuthenticationProviderRegistry()
+    {
+    }
+
+    /// <summary>
+    /// Gets the provider registered for the given authentication method, or <see langword="null"/>
+    /// if none is registered.
+    /// </summary>
+    internal static SqlAuthenticationProvider? GetProvider(SqlAuthenticationMethod authenticationMethod)
+    {
+        return s_instance._providers.TryGetValue(authenticationMethod, out SqlAuthenticationProvider? value)
+            ? value
+            : null;
+    }
+
+    /// <summary>
+    /// Registers an overridable provider for the given authentication method.
+    /// </summary>
+    /// <returns>
+    /// <see langword="true"/> if the provider was registered; <see langword="false"/> if a
+    /// permanent provider is already registered for the authentication method.
+    /// </returns>
+    /// <exception cref="NotSupportedException">
+    /// The provider does not support the given authentication method.
+    /// </exception>
+    internal static bool SetProvider(SqlAuthenticationMethod authenticationMethod, SqlAuthenticationProvider provider)
+    {
+        if (!provider.IsSupported(authenticationMethod))
+        {
+            throw new NotSupportedException(
+                string.Format(
+                    AbstractionsStrings.SQL_UnsupportedAuthenticationByProvider,
+                    provider.GetType().Name,
+                    authenticationMethod.ToString()));
+        }
+
+        if (s_instance._permanentProviders.Contains(authenticationMethod))
+        {
+            SqlClientEventSource.Log.TryTraceEvent(
+                "AuthenticationProviderRegistry.SetProvider | Failed to add provider {0} because a " +
+                "permanent provider with type {1} already existed for authentication {2}.",
+                GetProviderType(provider),
+                GetProviderType(GetProvider(authenticationMethod)),
+                authenticationMethod);
+
+            // A permanent provider was already specified for this authentication method, so we
+            // won't override it.
+            return false;
+        }
+
+        s_instance._providers.AddOrUpdate(
+            authenticationMethod,
+            provider,
+            (SqlAuthenticationMethod key, SqlAuthenticationProvider oldProvider) =>
+            {
+                oldProvider?.BeforeUnload(authenticationMethod);
+                provider.BeforeLoad(authenticationMethod);
+
+                SqlClientEventSource.Log.TryTraceEvent(
+                    "AuthenticationProviderRegistry.SetProvider | Added auth provider {0}, overriding " +
+                    "existing provider {1} for authentication {2}.",
+                    GetProviderType(provider),
+                    GetProviderType(oldProvider),
+                    authenticationMethod);
+
+                return provider;
+            });
+
+        return true;
+    }
+
+    /// <summary>
+    /// Registers a permanent provider for the given authentication method. Permanent providers
+    /// take precedence and cannot be overridden by <see cref="SetProvider"/>.
+    /// </summary>
+    /// <remarks>
+    /// Callers are responsible for verifying that the provider supports the authentication method
+    /// before registering it.
+    /// </remarks>
+    internal static void SetPermanentProvider(SqlAuthenticationMethod authenticationMethod, SqlAuthenticationProvider provider)
+    {
+        s_instance._providers[authenticationMethod] = provider;
+        s_instance._permanentProviders.Add(authenticationMethod);
+    }
+
+    private static string GetProviderType(SqlAuthenticationProvider? provider)
+    {
+        if (provider is null)
+        {
+            return "null";
+        }
+        return provider.GetType().FullName ?? "unknown";
+    }
+}