Allow passing an external authentication token override instead of using the builtin authentication handler

[Fulgen301]

Relevant area(s)

COM API, WinGet CLI, PowerShell Module

Description of the new feature / enhancement

Summary

Add a command line argument as well as COM API support to supply an external authentication token, overriding the default authentication flow.

Background

The builtin authentication support (AppInstaller::Authentication) currently either supports no authentication or the use of Entra ID authentication via WebAuthenticationCoreManager. This has some shortcomings with unattended deployments:

• WebAuthenticationCoreManager has bugs involving running programs as different users (Entra ID authentication fails if the executable is executed as a different user due to a longstanding bug in WebAuthenticationCoreManager #6186). This can be worked around when using WebAuthenticationCoreManager directly by delegating the user authentication flow to a helper process, but this is not possible when using WinGet, as its API does not allow passing in an external token but requires using the builtin WebAuthenticationCoreManager flow.
• There is no way to make system-wide unattended installations work without user interaction, as WinGet does not support requesting a machine token. This would also require the device to have a corresponding Entra ID principal via a device attach / join.
• --authentication-mode silent is not useful for unattended deployments as it does not guarantee success - after all, the user must have authenticated themselves at some point. It also requires WinGet to run as the user, not as LocalSystem, which isn't possible with users not having administrator access and the installer requiring elevation.

In our case, a user should be able to order software and have it installed without further interaction via our client management solution, where the software resides in a private WinGet repository protected from unauthorized access via Entra ID authentication - we don't need to authenticate as the user, we need to authenticate as an Entra ID principal we can grant access to, but WinGet doesn't allow for external authentication flows.

Proposed technical implementation details

• Extend AuthenticationAccount with String AuthenticationToken;.
• Extend the CLI interface with --authentication-token akin to --authentication-mode and --authentication-account.
• Pass both values to AppInstaller::Authenticator as part of the AuthenticationArguments.
• Adjust AppInstaller::Authentication::AuthenticateForToken to return the token from the authentication arguments, if present.

[github-actions]

Possible duplicate(s):

Thank you for submitting this issue.

The issue(s) below may already track your request or bug. Please take a look — if one of them matches, give that issue a 👍 and close this one as a duplicate. Older or curated issues are preferred as the canonical one to follow.

• Entra ID Authentication for WinGet REST sources #4124 — Tracks Entra ID authentication support for WinGet REST sources, which is the broader feature this request is part of
• Entra ID authentication fails if the executable is executed as a different user due to a longstanding bug in WebAuthenticationCoreManager #6186 — Tracks the WebAuthenticationCoreManager bug with different users that is part of the motivation for this request

Template: msftbot/duplicate/surfaced by Duplicate Surfacing