Backport AOT-safe auth provider to release/7.0 branch

[paulmedynski]

Summary

Backport the AOT-safe authentication provider work from PR #4348 to the release/7.0 branch for the 7.0.2 milestone.

Parent Issue

Child of #4193

Scope

Cherry-pick or port the following changes from dev/paul/aot → release/7.0:

• Public API: SqlAuthenticationProviderManager.GetProvider(), SetProvider(), ApplicationClientId
• Feature switch: Microsoft.Data.SqlClient.EnableReflectionBasedAuthenticationProviderDiscovery
  • [FeatureSwitchDefinition] on .NET 9+
  • ILLink.Substitutions.xml for .NET 8
• ILLink substitutions split (cross-platform vs Windows-only)
• Ref assembly updates
• Unit tests (SqlAuthenticationProviderManagerTests, ILLinkSubstitutionsTests)
• AotCompatibility test app

Acceptance Criteria

• All changes compile on release/7.0 branch
• Unit tests pass
• Native AOT publish succeeds with feature switch disabled
• LoadAzureExtensionProvider confirmed trimmed in ILC map
• ILLink resources correctly embedded per platform

Notes

• May require adaptation if release/7.0 has diverged from the main development branch
• Verify TFM differences (7.0 branch may not target net10.0)

[github-actions]

🔍 Triage Summary

Check	Result
Issue type	Task
Environment	N/A — backport task, not a bug report
Area	Area\Azure Connectivity
Duplicates	None — directly related: #4193 (parent bug), #4348 (source PR to backport)
Regression	Not applicable — this task tracks the fix/backport, not a new regression

Analysis

This is a well-scoped backport task to cherry-pick/port the AOT-safe authentication provider changes from PR #4348 (targeting main) into the release/7.0 branch for the 7.0.2 hotfix milestone. The underlying regression (#4193) is high severity (P1) — Entra ID authentication silently fails under NativeAOT in v7.0 due to reflection-based provider discovery, breaking Azure SQL connectivity for AOT-published apps. The fix involves making SqlAuthenticationProviderManager public, adding a trimmer feature switch, splitting ILLink substitution files per platform, updating ref assemblies, and adding AOT compatibility tests.

Next Steps

• Assign this task to the Copilot coding agent to perform the backport.
• Before cherry-picking, compare the TFM set in release/7.0 against main — the 7.0 branch likely targets net8.0/net9.0 but not net10.0, so any net10.0-specific code (e.g., [FeatureSwitchDefinition] usage gating) may need adjustment.
• Verify that ILLink.Substitutions.Windows.xml split applies cleanly to the 7.0 branch structure.
• Run the full unit test suite on release/7.0 after the port and confirm the AotCompatibility test app publishes without errors.
• Once PR AOT-safe auth provider with feature switch and trimmer support #4348 is merged to main, create a follow-up PR targeting release/7.0 using branch prefix dev/automation/backport-aot-auth-provider-7.0.

Note: This triage summary is auto-generated by an AI agent. The analysis and suggestions above have not been verified by a human maintainer. Please treat as preliminary guidance only.

Generated by SqlClient Issue Auto-Triage for issue #4349 · ● 1.8M · ◷