Semantic Kernel

Semantic Kernel keeps its own auth hook. Authdog stays the identity provider. The sample attaches an agent access token there and refuses the run when that token is missing or userinfo rejects it.

Sample: semantic-kernel/python. Python 3.10+. Package semantic-kernel==1.45.0.

Channel auth, machine credentials, tool checks, and instructions for this framework are the other pages under Semantic Kernel in AI.

The hook

async def require_authdog(context: FunctionInvocationContext, next):
    token = context.arguments.get("authdog_token")
    subject = subject_if_accepted(token)
    if subject is None:
        return
    context.arguments["subject"] = subject
    del context.arguments["authdog_token"]
    await next(context)

kernel.add_filter(FilterTypes.FUNCTION_INVOCATION, require_authdog)

Not calling next means the kernel function does not run. The host puts authdog_token on the arguments. The filter deletes it before next, so the function sees subject and not the bearer. Tests invoke the function through the kernel. They do not call a chat model.

This is agent identity: client_credentials, then this hook. It is not Agent Sign-In. A browser sign-in does not replace the hook.

What you should see

Invoking whoami with no token does not enter the function. The result is not a subject.

Invoking whoami with a bearer userinfo accepts runs the function. The result is that subject.

pytest in semantic-kernel/python checks both. It does not call a model.

Configure

The shared exchange is in Agent frameworks. There is no refresh token. Repeat it before expires_in.

Related