Add support for refreshing Azure tokens.

config/kube_config.py

@@ -18,7 +18,9 @@
 import json
 import os
 import tempfile
+import time
 
+import adal
 import google.auth
 import google.auth.transport.requests
 import oauthlib.oauth2
@@ -202,10 +204,29 @@ def _load_azure_token(self, provider):
             return
         if 'access-token' not in provider['config']:
             return
-        # TODO: Refresh token here...
+        if 'expires-on' in provider['config']:
+            if int(provider['config']['expires-on']) < time.gmtime():
+                self._refresh_azure_token(provider['config'])
         self.token = 'Bearer %s' % provider['config']['access-token']
         return self.token
 
+    def _refresh_azure_token(self, config):
+        tenant = config['tenant-id']
+        authority = 'https://login.microsoftonline.com/{}'.format(tenant)
+        context = adal.AuthenticationContext(
+            authority, validate_authority=True,
+        )
+        refresh_token = config['refresh-token']
+        client_id = config['client-id']
+        token_response = context.acquire_token_with_refresh_token(
+            refresh_token, client_id, '00000002-0000-0000-c000-000000000000')
+
+        provider = self._user['auth-provider']['config']
+        provider.value['access-token'] = token_response['accessToken']
+        provider.value['expires-on'] = token_response['expiresOn']
+        if self._config_persister:
+            self._config_persister(self._config.value)
+
     def _load_gcp_token(self, provider):
         if (('config' not in provider) or
                 ('access-token' not in provider['config']) or