{Profile} Use v2.0 authority to resolve tenant ID #27892

jiasli · 2023-11-21T08:45:58Z

Related command
az login

Description
Azure CLI migrated from ADAL to MSAL (#19853) which is powered by AAD v2.0. The tenant resolution logic (added by #10418) should do the same.

#14509 added unit tests azure.cli.command_modules.profile.tests.latest.test_profile_custom.ProfileCommandTest.test_login_validate_tenant for azure.cli.command_modules.profile._validators.validate_tenant.

Testing Guide
az login --tenant microsoft.onmicrosoft.com

Additional information
Even though MSAL has special logic for handling ADFS:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/09d5ff9a71a51c998b83b356047230677825a622/msal/authority.py#L106-L112

            tenant_discovery_endpoint = (
                'https://{}:{}{}{}/.well-known/openid-configuration'.format(
                    self.instance,
                    443 if authority.port is None else authority.port,
                    authority.path,  # In B2C scenario, it is "/tenant/policy"
                    "" if tenant == "adfs" else "/v2.0" # the AAD v2 endpoint
                    ))

This not our concern here since on Azure CLI side, adfs is part of active_directory_endpoint and tenant is discarded:

azure-cli/src/azure-cli-core/azure/cli/core/auth/identity.py

Lines 360 to 377 in b00483c

    
           def _get_authority_url(authority_endpoint, tenant): 
        
               """Convert authority endpoint (active_directory) to MSAL authority: 
        
                   - AAD: https://login.microsoftonline.com/your_tenant 
        
                   - ADFS: https://adfs.redmond.azurestack.corp.microsoft.com/adfs 
        
               For ADFS, tenant is discarded. 
        
               """ 
        
               # Some Azure Stack (bellevue)'s metadata returns 
        
               #   "loginEndpoint": "https://login.microsoftonline.com/" 
        
               # Normalize it by removing the trailing /, so that authority_url won't become 
        
               # "https://login.microsoftonline.com//tenant_id". 
        
               authority_endpoint = authority_endpoint.rstrip('/').lower() 
        
               is_adfs = authority_endpoint.endswith('adfs') 
        
               if is_adfs: 
        
                   authority_url = authority_endpoint 
        
               else: 
        
                   authority_url = '{}/{}'.format(authority_endpoint, tenant or "organizations") 
        
               return authority_url, is_adfs

validate_tenant shouldn't be hit at all.

azure-client-tools-bot-prd · 2023-11-21T08:46:01Z

️✔️AzureCLI-FullTest

️✔️acr

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️acs

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️advisor

️✔️latest

️✔️3.11

️✔️3.9

️✔️ams

️✔️latest

️✔️3.11

️✔️3.9

️✔️apim

️✔️latest

️✔️3.11

️✔️3.9

️✔️appconfig

️✔️latest

️✔️3.11

️✔️3.9

️✔️appservice

️✔️latest

️✔️3.11

️✔️3.9

️✔️aro

️✔️latest

️✔️3.11

️✔️3.9

️✔️backup

️✔️latest

️✔️3.11

️✔️3.9

️✔️batch

️✔️latest

️✔️3.11

️✔️3.9

️✔️batchai

️✔️latest

️✔️3.11

️✔️3.9

️✔️billing

️✔️latest

️✔️3.11

️✔️3.9

️✔️botservice

️✔️latest

️✔️3.11

️✔️3.9

️✔️cdn

️✔️latest

️✔️3.11

️✔️3.9

️✔️cloud

️✔️latest

️✔️3.11

️✔️3.9

️✔️cognitiveservices

️✔️latest

️✔️3.11

️✔️3.9

️✔️config

️✔️latest

️✔️3.11

️✔️3.9

️✔️configure

️✔️latest

️✔️3.11

️✔️3.9

️✔️consumption

️✔️latest

️✔️3.11

️✔️3.9

️✔️container

️✔️latest

️✔️3.11

️✔️3.9

️✔️containerapp

️✔️latest

️✔️3.11

️✔️3.9

️✔️core

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️cosmosdb

️✔️latest

️✔️3.11

️✔️3.9

️✔️databoxedge

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️dla

️✔️latest

️✔️3.11

️✔️3.9

️✔️dls

️✔️latest

️✔️3.11

️✔️3.9

️✔️dms

️✔️latest

️✔️3.11

️✔️3.9

️✔️eventgrid

️✔️latest

️✔️3.11

️✔️3.9

️✔️eventhubs

️✔️latest

️✔️3.11

️✔️3.9

️✔️feedback

️✔️latest

️✔️3.11

️✔️3.9

️✔️find

️✔️latest

️✔️3.11

️✔️3.9

️✔️hdinsight

️✔️latest

️✔️3.11

️✔️3.9

️✔️identity

️✔️latest

️✔️3.11

️✔️3.9

️✔️iot

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️keyvault

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️kusto

️✔️latest

️✔️3.11

️✔️3.9

️✔️lab

️✔️latest

️✔️3.11

️✔️3.9

️✔️managedservices

️✔️latest

️✔️3.11

️✔️3.9

️✔️maps

️✔️latest

️✔️3.11

️✔️3.9

️✔️marketplaceordering

️✔️latest

️✔️3.11

️✔️3.9

️✔️monitor

️✔️latest

️✔️3.11

️✔️3.9

️✔️mysql

️✔️latest

️✔️3.11

️✔️3.9

️✔️netappfiles

️✔️latest

️✔️3.11

️✔️3.9

️✔️network

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️policyinsights

️✔️latest

️✔️3.11

️✔️3.9

️✔️privatedns

️✔️latest

️✔️3.11

️✔️3.9

️✔️profile

️✔️latest

️✔️3.11

️✔️3.9

️✔️rdbms

️✔️latest

️✔️3.11

️✔️3.9

️✔️redis

️✔️latest

️✔️3.11

️✔️3.9

️✔️relay

️✔️latest

️✔️3.11

️✔️3.9

️✔️resource

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️role

️✔️latest

️✔️3.11

️✔️3.9

️✔️search

️✔️latest

️✔️3.11

️✔️3.9

️✔️security

️✔️latest

️✔️3.11

️✔️3.9

️✔️servicebus

️✔️latest

️✔️3.11

️✔️3.9

️✔️serviceconnector

️✔️latest

️✔️3.11

️✔️3.9

️✔️servicefabric

️✔️latest

️✔️3.11

️✔️3.9

️✔️signalr

️✔️latest

️✔️3.11

️✔️3.9

️✔️sql

️✔️latest

️✔️3.11

️✔️3.9

️✔️sqlvm

️✔️latest

️✔️3.11

️✔️3.9

️✔️storage

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️synapse

️✔️latest

️✔️3.11

️✔️3.9

️✔️telemetry

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️util

️✔️latest

️✔️3.11

️✔️3.9

️✔️vm

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

azure-client-tools-bot-prd · 2023-11-21T08:46:04Z

Hi @jiasli,
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

azure-client-tools-bot-prd · 2023-11-21T08:46:07Z

️✔️AzureCLI-BreakingChangeTest

️✔️Non Breaking Changes

yonzhan · 2023-11-21T08:46:10Z

Profile

src/azure-cli/azure/cli/command_modules/profile/_validators.py

resolve-tenant

550977e

azure-client-tools-bot-prd bot added this to the December 2023 (2024-01-02) milestone Nov 21, 2023

microsoft-github-policy-service bot requested review from yonzhan and wangzelin007 November 21, 2023 08:46

microsoft-github-policy-service bot added the Auto-Assign Auto assign by bot label Nov 21, 2023

microsoft-github-policy-service bot assigned jiasli Nov 21, 2023

microsoft-github-policy-service bot added Account az login/account AAD labels Nov 21, 2023

jiasli requested a review from rayluo November 24, 2023 05:37

rayluo reviewed Nov 24, 2023

View reviewed changes

src/azure-cli/azure/cli/command_modules/profile/_validators.py Show resolved Hide resolved

rayluo reviewed Nov 24, 2023

View reviewed changes

src/azure-cli/azure/cli/command_modules/profile/_validators.py Show resolved Hide resolved

rayluo approved these changes Nov 24, 2023

View reviewed changes

yonzhan modified the milestones: December 2023 (2024-01-09), January 2024 (2024-02-06) Jan 2, 2024

jiasli marked this pull request as ready for review January 5, 2024 06:47

jiasli requested review from evelyn-ys and calvinhzy as code owners January 5, 2024 06:47

evelyn-ys approved these changes Jan 5, 2024

View reviewed changes

bebound approved these changes Jan 5, 2024

View reviewed changes

jiasli merged commit 2548ad6 into Azure:dev Jan 5, 2024
55 checks passed

jiasli deleted the resolve-tenant branch January 5, 2024 07:18

MaxHorstmann pushed a commit to MaxHorstmann/azure-cli that referenced this pull request Jan 19, 2024

{Profile} Use v2.0 authority to resolve tenant ID (Azure#27892)

300e81f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

{Profile} Use v2.0 authority to resolve tenant ID #27892

{Profile} Use v2.0 authority to resolve tenant ID #27892

jiasli commented Nov 21, 2023

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading

azure-client-tools-bot-prd bot commented Nov 21, 2023

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading

yonzhan commented Nov 21, 2023

	def _get_authority_url(authority_endpoint, tenant):
	"""Convert authority endpoint (active_directory) to MSAL authority:
	- AAD: https://login.microsoftonline.com/your_tenant
	- ADFS: https://adfs.redmond.azurestack.corp.microsoft.com/adfs
	For ADFS, tenant is discarded.
	"""

	# Some Azure Stack (bellevue)'s metadata returns
	# "loginEndpoint": "https://login.microsoftonline.com/"
	# Normalize it by removing the trailing /, so that authority_url won't become
	# "https://login.microsoftonline.com//tenant_id".
	authority_endpoint = authority_endpoint.rstrip('/').lower()
	is_adfs = authority_endpoint.endswith('adfs')
	if is_adfs:
	authority_url = authority_endpoint
	else:
	authority_url = '{}/{}'.format(authority_endpoint, tenant or "organizations")
	return authority_url, is_adfs

{Profile} Use v2.0 authority to resolve tenant ID #27892

{Profile} Use v2.0 authority to resolve tenant ID #27892

Conversation

jiasli commented Nov 21, 2023

azure-client-tools-bot-prd bot commented Nov 21, 2023 • edited Loading

azure-client-tools-bot-prd bot commented Nov 21, 2023

azure-client-tools-bot-prd bot commented Nov 21, 2023 • edited Loading

yonzhan commented Nov 21, 2023

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading