[Identity] CAE b1

[jiasli]

Description

CAE beta support build upon

• azure-core 1.12.0b1
  • https://pypi.org/project/azure-core/1.12.0b1/
  • https://github.com/Azure/azure-sdk-for-python/tree/azure-core_1.12.0b1
• azure-identity 1.6.0b1
  • https://pypi.org/project/azure-identity/1.6.0b1/
  • https://github.com/Azure/azure-sdk-for-python/tree/azure-identity_1.6.0b1

Testing Guide

# Log in with CAE enabled
az login

# Test access token is working as expected
az group list

# Revoke the session
az rest -m POST -u https://graph.microsoft.com/v1.0/me/revokeSignInSessions

az group list --output none
while ($LASTEXITCODE -eq 0)
{
   Write-Output "Access token not revoked yet. Sleeping..."
   Start-Sleep 10
   az group list --output none   
}
Write-Output "Access token has been revoked."

# A failed command using Track 2 SDK
az storage account list

# A failed command using Track 1 SDK
az group list

[jiasli]

ScenarioTest (inherited from ReplayableTest) patches azure.cli.core.util.handle_exception so that the raw exception is thrown and can be captured by assertRaises. (handle_exception silences any exception.)

Do the same for LiveScenarioTest.

[jiasli]

Using canary ARM endpoint causes CI failure:

https://dev.azure.com/azure-sdk/public/_build/results?buildId=750605&view=logs&j=75453f46-9c6c-5df4-6021-c5646ce3452d&t=4b9b4997-7a06-5274-d89c-915764f2e7f7&l=213892

____________________ TestCloud.test_metadata_url_endpoints _____________________
self = <azure.cli.core.tests.test_cloud.TestCloud testMethod=test_metadata_url_endpoints>

    @mock.patch.dict('os.environ', {'ARM_CLOUD_METADATA_URL': 'https://management.azure.com/metadata/endpoints?api-version=2019-05-01'})
    def test_metadata_url_endpoints(self):
        clouds = get_known_clouds(refresh=True)
        for cloud in HARD_CODED_CLOUD_LIST:
            metadata_url_cloud = next(c for c in clouds if c.name == cloud.name)
            for k, v1 in cloud.endpoints.__dict__.items():
                v2 = metadata_url_cloud.endpoints.__dict__[k]
                if v1:
>                   self.assertEqual(v1.strip('/'), v2.strip('/'))
E                   AssertionError: 'https://eastus2euap.management.azure.com' != 'https://management.azure.com'
E                   - https://eastus2euap.management.azure.com
E                   ?         ------------
E                   + https://management.azure.com

src/azure-cli-core/azure/cli/core/tests/test_cloud.py:260: AssertionError

This can't be fixed because

1. There are tests like test_metadata_url_endpoints using https://management.azure.com.
2. All YAML recordings are based on https://management.azure.com. Calling https://eastus2euap.management.azure.com will cause mismatch during playback.

[dingmeng-xue]

My understanding is continuous access evaluation just makes revoke happen before AT is expired. The statement can be "blocked by access policy" or "not meet the criteria to access this resource"

[yonzhan]

CAE