Verify no ADAL dependencies

[tracyboehrer]

Verify if ADAL is in use via some out-of-date dependency outside SDK. That is, we recently switched to ADAL in SDK auth code. But it's possible that some other SDK dependency is bringing it in and needs to be updated.

[ceciliaavila]

Hi @tracyboehrer,
The only reference left to ADAL is in Microsoft.Bot.Connector. It's being used by Microsoft.Azure.Services.AppAuthentication package.
We marked all the methods and classes as deprecated in PR#6605 but didn't remove them to avoid breaking changes.
Unfortunately, Microsoft.Azure.Services.AppAuthentication package's latest version is still using this dependency, so updating it won't solve the problem.
Should we assume the breaking changes and completely remove ADAL?

[ceciliaavila]

Adding more information to keep it on the radar.
The Bot.Connector classes using references to ADAL are the following:

• AdalAuthenticator (Used in the other classes obsolete methods)
• CertificateAppCredentials (Obsolete methods)
• MicrosoftAppCredentials (Obsolete methods)
• JwtTokenProviderFactory (Obsolete class)
• ConstantHttpClientFactory (Internal class)

We can't remove them because it will represent a breaking change.

[wshxj123]

Hi @tracyboehrer ,
Do you have any suggestions about this?
I got a Component Governance Alert for the dependencies for Microsoft.IdentityModel.Clients.ActiveDirectory.
I need to fix it ASAP.

Thanks a lot.

[mit2nil]

Hi @tracyboehrer and @ceciliaavila ,

Are there any updates on this? We are also seeing component governance bugs for ADAL dependency which is going to start breaking out production builds soon if not fixed and we can not fix this ourselves as its transient dependency coming just from Microsoft.Bot.Builder 4.20.1 which is the latest version of bot builder package.

Nilay

[tracyboehrer]

@wshxj123 & @mit2nil What is the root dependency of the alerts?

[wshxj123]

@wshxj123 & @mit2nil What is the root dependency of the alerts?

I pinged you on Teams just now.
The root dependency is Microsoft.IdentityModel.Clients.ActiveDirectory.
I will try to upgrade the SDKs when the new release is ready.

[Danieladu]

Code merged with #6687