Feature/OIDC token refresh - #1
Open
MaddyMicrosoft wants to merge 103 commits into
Open
Conversation
…compute cluster resources management (Azure#33759)
…tion startup attempt data (Azure#33673)
…lti-label sovereign suffixes (Azure#33754) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6daaab37-9f50-49e2-bbba-9dd6ff4b3727
…Fabric Mirroring (Azure#33774) Co-authored-by: Laveena Fulwani <lfulwani@microsoft.com>
…date (Azure#33768) Co-authored-by: Copilot <copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f9c96871-4d63-4a60-9622-70bfffb3cc7a
Co-authored-by: Zubair <zubairabid1999+github@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
… NVA to ILB architecture (Azure#33766) Co-authored-by: Jordan Graves <jordangraves@microsoft.com> Co-authored-by: Ethan Yang <necusjz@gmail.com>
…set gallery applications (Azure#33715)
…o` to enable writable behavior for cache repositories within a registry (Azure#33772)
Co-authored-by: Yabo Hu <yabhu@microsoft.com> Co-authored-by: Yu Chen <16348853+jsntcy@users.noreply.github.com>
…licy` to attach a DDoS custom policy (Azure#33812)
…zure#33831) Co-authored-by: Mansoor Sarfraz <msarfraz+microsoft@microsoft.com>
…le-cluster-autoscaler`: Add CAS support for VMS agent pools (Azure#33801) Co-authored-by: reneeli <reneeli@microsoft.com>
…n for Linux web apps (Azure#33640)
…the node OS upgrade channel is enabled (Azure#33854)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>
…torage redundancy on target (Azure#33814) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Rambabu Yalla <ramyal@microsoft.com>
… for creating new database (Azure#33951)
Co-authored-by: Mansoor Sarfraz <msarfraz+microsoft@microsoft.com>
…o avoid content-encoding decode failures (Azure#33730) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com> Co-authored-by: azure-client-tools-agent[bot] <299377795+azure-client-tools-agent[bot]@users.noreply.github.com>
… for all regions (Azure#33747) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: azure-client-tools-agent[bot] <299377795+azure-client-tools-agent[bot]@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>
…les to include `--is-linux false` (Azure#33828) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
…in target region validation (Azure#33882)
…#33958) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ently ignores camelCase properties like `webJobsEnabled` (Azure#33826) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com> Co-authored-by: azure-client-tools-agent[bot] <299377795+azure-client-tools-agent[bot]@users.noreply.github.com>
…atching flush and delete (Azure#33905)
Co-authored-by: Ethan Yang <ethanyang@microsoft.com>
…u (SCM) container in addition to the main application container (Azure#33954)
…ommand to collect network capture (Azure#33949)
…ypeError with azure-mgmt-storage 25.0.0 (Azure#33872)
Co-authored-by: Cooper Cox <coopercox@microsoft.com> Co-authored-by: mansoor sarfraz <msarfraz@microsoft.com>
… federated tokens Static `--federated-token` values expire in ~10 minutes and cannot be refreshed, so long-running CI/CD tasks fail with `AADSTS700024: Client assertion is not within its valid time range`. This registers a callable client_assertion with MSAL (the documented, recommended interface) so an expired OIDC ID token is transparently re-fetched on every token acquisition, including in later `az` processes. Wiring: - New `FEDERATED_IDENTITY` sentinel persisted as the SP entry's client_assertion. - `ServicePrincipalAuth.get_msal_client_credential()` resolves that sentinel to a provider dispatcher, `get_federated_id_token()`, instead of a static string. - Dispatcher implements GitHub Actions; other environments raise a clear error pointing at `--federated-token`. Azure DevOps is a planned follow-up (Azure#28708). - New `az login --federated-identity` flag, mutually exclusive with `--federated-token` and only valid with `--service-principal`. Adds unit tests covering the sentinel-to-callable resolution, the GitHub fetch (success and HTTP error), and the unsupported/no-provider branches. Partially addresses Azure#28708 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…token refresh Extends `--federated-identity` (GitHub Actions only) to also refresh OIDC federated tokens on Azure DevOps Pipelines, so long-running pipeline tasks no longer fail with `AADSTS700024`. The provider dispatcher now detects Azure DevOps and POSTs to the pipeline oidctoken API, following the documented Azure DevOps / azure-identity `AzurePipelinesCredential` contract. Because the refresh runs in a later `az` process, the three required inputs are read from the environment: - request URL: ARM_OIDC_REQUEST_URL, else SYSTEM_OIDCREQUESTURI - access token: ARM_OIDC_REQUEST_TOKEN, else SYSTEM_ACCESSTOKEN (System.AccessToken) - service conn: ARM_OIDC_AZURE_SERVICE_CONNECTION_ID Missing variables produce a clear, actionable error. Adds unit tests for the Azure DevOps success path, missing-environment handling, and updates the help text. Partially addresses Azure#28708 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…oken refresh Adds a provider-agnostic escape hatch alongside the built-in `--federated-identity` providers. `--federated-token-callback <command>` takes any command that prints a fresh OIDC token to stdout; Azure CLI wraps it as the MSAL client_assertion callable and re-runs it on demand, so token refresh works with any CI/CD system (not just the built-in GitHub Actions / Azure DevOps providers) without platform-specific logic in the CLI. - The command is persisted (client_assertion_callback) so later `az` processes rebuild the callable and refresh independently. - Mutually exclusive with --federated-token and --federated-identity; service principal only. Clear errors on non-zero exit or empty output. The token value is never logged. The three flags now cover the full spectrum: static token (--federated-token), built-in providers (--federated-identity), and universal callback (--federated-token-callback). Partially addresses Azure#28708 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Harden --federated-token-callback: parse the command into an argv list and run it without a shell (shell=False), so a tampered token cache cannot become arbitrary code execution. Users needing pipes/redirection use a script or wrap in bash -c. - Reject combining --federated-token/--federated-identity/--federated-token-callback with --password or --certificate (previously the secret silently won and refresh was silently disabled). - Fix the GitHub OIDC request URL to append the audience with the correct separator when the URL has no existing query string. - Correct the misleading --service-principal usage error to list all credential modes. - Align --federated-identity help text with the actual mutual-exclusion validation. - Add tests for the no-shell argv behavior and the query-less GitHub URL case. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…on-length linter The --federated-token-callback option (26 chars) exceeds azure-cli's 22-char option-length threshold, so add the shorter --federated-token-cmd alias. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
Description
Testing Guide
History Notes
[Component Name 1] BREAKING CHANGE:
az command a: Make some customer-facing breaking change[Component Name 2]
az command b: Add some customer-facing featureThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.