symbols: add opt-in Managed Identity support for symbol server auth

Add ManagedIdentityEnabled setting (ProtoMember 26, default false) to
SymbolFileSourceSettings. Refactor PDBDebugInfoProvider static credential
chain into BuildAndSetCredentialChain(bool) + public ReinitializeCredentials(settings)
to allow runtime reconfiguration after settings load (static ctor runs before
settings are available).

When ManagedIdentityEnabled=true, use ManagedIdentityCredential exclusively
(no developer/browser creds) for headless Azure deployments. When false
(default), use the existing full developer chain unchanged.

Expose useManagedIdentity parameter on MCP server OpenTrace tool for
headless/Azure callers like BigRedPerfAI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: devinro

src/ProfileExplorer.McpServer/Program.cs

@@ -170,9 +170,11 @@ public static string OpenTrace(
     [Description("Optional additional symbol search path (e.g. 'd:\\temp\\landy' for custom kernel symbols)")]
     string? symbolPath = null,
     [Description("Optional additional binary search path (e.g. 'd:\\temp' for loose binaries like storport.sys). Required for assembly-level disassembly via GetFunctionAssembly when the binary isn't on the symbol server.")]
-    string? binaryPath = null)
+    string? binaryPath = null,
+    [Description("Enable Azure Managed Identity for symbol server authentication. Use in headless/Azure environments where interactive browser auth is unavailable.")]
+    bool useManagedIdentity = false)
   {
-    DiagnosticLogger.LogInfo($"[MCP] OpenTrace called: profileFilePath={profileFilePath}, processNameOrId={processNameOrId}, symbolPath={symbolPath ?? "(none)"}, binaryPath={binaryPath ?? "(none)"}");
+    DiagnosticLogger.LogInfo($"[MCP] OpenTrace called: profileFilePath={profileFilePath}, processNameOrId={processNameOrId}, symbolPath={symbolPath ?? "(none)"}, binaryPath={binaryPath ?? "(none)"}, useManagedIdentity={useManagedIdentity}");
 
     if (!File.Exists(profileFilePath))
       return Error("OpenTrace", $"File not found: {profileFilePath}");
@@ -197,6 +199,7 @@ public static string OpenTrace(
         var options = new ProfileDataProviderOptions();
         var symbolSettings = new SymbolFileSourceSettings();
         symbolSettings.UseEnvironmentVarSymbolPaths = true;
+        symbolSettings.ManagedIdentityEnabled = useManagedIdentity;
         if (!string.IsNullOrWhiteSpace(symbolPath))
           symbolSettings.InsertSymbolPath(symbolPath);
         if (!string.IsNullOrWhiteSpace(binaryPath))
@@ -206,7 +209,10 @@ public static string OpenTrace(
         }
         ProfileSession.SymbolSettings = symbolSettings;
 
-        DiagnosticLogger.LogInfo($"[MCP] SymbolSettings: UseEnvVar=true, CustomPath={symbolPath ?? "(none)"}, EnvVar={symbolSettings.EnvironmentVarSymbolPath ?? "(not set)"}");
+        // Reinitialize credential chain to pick up ManagedIdentityEnabled flag.
+        PDBDebugInfoProvider.ReinitializeCredentials(symbolSettings);
+
+        DiagnosticLogger.LogInfo($"[MCP] SymbolSettings: UseEnvVar=true, CustomPath={symbolPath ?? "(none)"}, EnvVar={symbolSettings.EnvironmentVarSymbolPath ?? "(not set)"}, ManagedIdentity={useManagedIdentity}");
         DiagnosticLogger.LogInfo($"[MCP] SymbolPaths: {string.Join("; ", symbolSettings.SymbolPaths)}");
         DiagnosticLogger.LogInfo($"[MCP] BinarySearchPaths: {(options.HasBinarySearchPaths ? string.Join("; ", options.BinarySearchPaths) : "(none)")}");
 

src/ProfileExplorerCore/Binary/PDBDebugInfoProvider.cs

@@ -33,9 +33,10 @@ public sealed class PDBDebugInfoProvider : IDebugInfoProvider {
 
   private static ConcurrentDictionary<SymbolFileDescriptor, DebugFileSearchResult> resolvedSymbolsCache_ = new();
   private static readonly StringWriter authLogWriter_;
-  private static readonly SymwebHandler authSymwebHandler_;
-  private static readonly AzureDevOpsSourceHandler authAzDevOpsHandler_;
+  private static SymwebHandler authSymwebHandler_;
+  private static AzureDevOpsSourceHandler authAzDevOpsHandler_;
   private static readonly string authRecordPath_ = Path.Combine(Path.GetTempPath(), "ProfileExplorer", "auth_record.bin");
+  private static readonly object credentialLock_ = new();
   private static object undecorateLock_ = new(); // Global lock for undname.
   private ConcurrentDictionary<long, SourceFileDebugInfo> sourceFileByRvaCache_ = new();
   private ConcurrentDictionary<string, SourceFileDebugInfo> sourceFileByNameCache_ = new();
@@ -84,53 +85,84 @@ public static void ClearResolvedCache() {
   public static string DiaRegistrationError => diaRegistrationError_;
 
   static PDBDebugInfoProvider() {
+    authLogWriter_ = new StringWriter();
+    BuildAndSetCredentialChain(managedIdentityEnabled: false);
+  }
+
+  /// <summary>
+  /// Rebuilds the token credential chain based on the provided settings.
+  /// This exists because the static constructor runs at class-load time, before
+  /// application settings are available. Call this after settings are loaded to
+  /// pick up the ManagedIdentityEnabled flag.
+  /// Thread-safe — uses credentialLock_.
+  /// </summary>
+  public static void ReinitializeCredentials(SymbolFileSourceSettings settings) {
+    BuildAndSetCredentialChain(settings?.ManagedIdentityEnabled ?? false);
+  }
+
+  private static void BuildAndSetCredentialChain(bool managedIdentityEnabled) {
     // Create a single instance of the Symweb handler so that
     // when concurrent requests are made and login must be done,
     // the login page is displayed a single time, with other requests waiting for a token.
 
     // DefaultAzureCredential is not allowed per SFI. Mimic behavior while continuing
-    // to exclude the managed identity credential.
+    // to exclude the managed identity credential unless explicitly opted in.
     // NOTE: ChainedTokenCredential only falls through on CredentialUnavailableException.
     // Other exceptions (like "needs re-authentication") stop the chain. We wrap each
     // credential to catch auth failures and convert them to CredentialUnavailableException
     // so the chain continues to InteractiveBrowserCredential which prompts the user.
 
-    // Enable token cache persistence for browser credential so tokens survive process restarts.
-    // Additionally, load existing AuthenticationRecord for true silent auth across sessions.
-    // This prevents re-authentication on every trace load if VS credential fails.
-    var authRecord = LoadAuthenticationRecord();
-    var browserCredentialOptions = new InteractiveBrowserCredentialOptions {
-      TokenCachePersistenceOptions = new TokenCachePersistenceOptions {
-        Name = "ProfileExplorer" // Unique cache name for this app
-      },
-      AuthenticationRecord = authRecord // Enable silent auth with cached identity
-    };
-
-    TokenCredential browserCredential = new InteractiveBrowserCredential(browserCredentialOptions);
+    List<TokenCredential> credentials;
 
-    // If no auth record exists yet, the user will be prompted on first symbol download.
-    // After first successful auth, capture and save the AuthenticationRecord for future sessions.
-    if (authRecord == null) {
-      browserCredential = new CaptureAuthRecordCredential((InteractiveBrowserCredential)browserCredential);
+    if (managedIdentityEnabled) {
+      // In Azure/headless environments use Managed Identity exclusively.
+      // Developer credentials (VS, CLI, browser) are unnecessary and can be
+      // slow or misleading when running in a cloud context.
+      Trace.WriteLine("[Auth] Building credential chain: ManagedIdentity-only");
+      credentials = new List<TokenCredential>
+      {
+        WrapCredential(new ManagedIdentityCredential()),
+      };
     }
+    else {
+      // Developer/interactive chain. Enable token cache persistence for browser
+      // credential so tokens survive process restarts. Load any existing
+      // AuthenticationRecord for true silent auth across sessions.
+      var authRecord = LoadAuthenticationRecord();
+      var browserCredentialOptions = new InteractiveBrowserCredentialOptions {
+        TokenCachePersistenceOptions = new TokenCachePersistenceOptions {
+          Name = "ProfileExplorer"
+        },
+        AuthenticationRecord = authRecord
+      };
+
+      TokenCredential browserCredential = new InteractiveBrowserCredential(browserCredentialOptions);
+
+      // If no auth record exists yet, the user will be prompted on first symbol download.
+      // After first successful auth, capture and save the record for future sessions.
+      if (authRecord == null) {
+        browserCredential = new CaptureAuthRecordCredential((InteractiveBrowserCredential)browserCredential);
+      }
 
-    var credentials = new List<TokenCredential>
-    {
-      WrapCredential(new EnvironmentCredential()),
-      WrapCredential(new WorkloadIdentityCredential()),
-      WrapCredential(new SharedTokenCacheCredential()),
-      WrapCredential(new VisualStudioCredential()),
-      WrapCredential(new AzureCliCredential()),
-      WrapCredential(new AzurePowerShellCredential()),
-      WrapCredential(new AzureDeveloperCliCredential()),
-      browserCredential // Don't wrap - final fallback should show errors
-    };
+      credentials = new List<TokenCredential>
+      {
+        WrapCredential(new EnvironmentCredential()),
+        WrapCredential(new WorkloadIdentityCredential()),
+        WrapCredential(new SharedTokenCacheCredential()),
+        WrapCredential(new VisualStudioCredential()),
+        WrapCredential(new AzureCliCredential()),
+        WrapCredential(new AzurePowerShellCredential()),
+        WrapCredential(new AzureDeveloperCliCredential()),
+        browserCredential // Don't wrap - final fallback should show errors
+      };
+    }
 
     var authCredential = new ChainedTokenCredential(credentials.ToArray());
 
-    authLogWriter_ = new StringWriter();
-    authSymwebHandler_ = new SymwebHandler(authLogWriter_, authCredential);
-    authAzDevOpsHandler_ = new AzureDevOpsSourceHandler(authLogWriter_, authCredential);
+    lock (credentialLock_) {
+      authSymwebHandler_ = new SymwebHandler(authLogWriter_, authCredential);
+      authAzDevOpsHandler_ = new AzureDevOpsSourceHandler(authLogWriter_, authCredential);
+    }
   }
 
   /// <summary>
@@ -425,8 +457,11 @@ public static async Task<DebugFileSearchResult>
 
   public static SymbolReaderAuthenticationHandler CreateAuthHandler(SymbolFileSourceSettings settings) {
     var authHandler = new SymbolReaderAuthenticationHandler();
-    authHandler.AddHandler(authSymwebHandler_);
-    authHandler.AddHandler(authAzDevOpsHandler_);
+
+    lock (credentialLock_) {
+      authHandler.AddHandler(authSymwebHandler_);
+      authHandler.AddHandler(authAzDevOpsHandler_);
+    }
 
     if (settings.AuthorizationTokenEnabled) {
       authHandler.AddHandler(new BasicAuthenticationHandler(settings, authLogWriter_));

src/ProfileExplorerCore/Settings/SymbolFileSourceSettings.cs

@@ -85,6 +85,8 @@ public SymbolFileSourceSettings() {
   public int RejectedFilesCacheExpirationDays { get; set; }
   [ProtoMember(25)][OptionValue(true)]
   public bool AllowApproximateBinaryMatch { get; set; }
+  [ProtoMember(26)][OptionValue(false)]
+  public bool ManagedIdentityEnabled { get; set; }
   public bool HasAuthorizationToken => AuthorizationTokenEnabled && !string.IsNullOrEmpty(AuthorizationToken);
   public bool HasCompanyFilter => CompanyFilterEnabled;