{Profile} Use v2.0 authority to resolve tenant ID #27892

jiasli · 2023-11-21T08:45:58Z

Related command
az login

Description
Azure CLI migrated from ADAL to MSAL (#19853) which is powered by AAD v2.0. The tenant resolution logic (added by #10418) should do the same.

#14509 added unit tests azure.cli.command_modules.profile.tests.latest.test_profile_custom.ProfileCommandTest.test_login_validate_tenant for azure.cli.command_modules.profile._validators.validate_tenant.

Testing Guide
az login --tenant microsoft.onmicrosoft.com

Additional information
Even though MSAL has special logic for handling ADFS:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/09d5ff9a71a51c998b83b356047230677825a622/msal/authority.py#L106-L112

            tenant_discovery_endpoint = (
                'https://{}:{}{}{}/.well-known/openid-configuration'.format(
                    self.instance,
                    443 if authority.port is None else authority.port,
                    authority.path,  # In B2C scenario, it is "/tenant/policy"
                    "" if tenant == "adfs" else "/v2.0" # the AAD v2 endpoint
                    ))

This not our concern here since on Azure CLI side, adfs is part of active_directory_endpoint and tenant is discarded:

azure-cli/src/azure-cli-core/azure/cli/core/auth/identity.py

Lines 360 to 377 in b00483c

    
           def _get_authority_url(authority_endpoint, tenant): 
        
               """Convert authority endpoint (active_directory) to MSAL authority: 
        
                   - AAD: https://login.microsoftonline.com/your_tenant 
        
                   - ADFS: https://adfs.redmond.azurestack.corp.microsoft.com/adfs 
        
               For ADFS, tenant is discarded. 
        
               """ 
        
               # Some Azure Stack (bellevue)'s metadata returns 
        
               #   "loginEndpoint": "https://login.microsoftonline.com/" 
        
               # Normalize it by removing the trailing /, so that authority_url won't become 
        
               # "https://login.microsoftonline.com//tenant_id". 
        
               authority_endpoint = authority_endpoint.rstrip('/').lower() 
        
               is_adfs = authority_endpoint.endswith('adfs') 
        
               if is_adfs: 
        
                   authority_url = authority_endpoint 
        
               else: 
        
                   authority_url = '{}/{}'.format(authority_endpoint, tenant or "organizations") 
        
               return authority_url, is_adfs

validate_tenant shouldn't be hit at all.

azure-client-tools-bot-prd · 2023-11-21T08:46:01Z

️✔️AzureCLI-FullTest

️✔️acr

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️acs

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️advisor

️✔️latest

️✔️3.11

️✔️3.9

️✔️ams

️✔️latest

️✔️3.11

️✔️3.9

️✔️apim

️✔️latest

️✔️3.11

️✔️3.9

️✔️appconfig

️✔️latest

️✔️3.11

️✔️3.9

️✔️appservice

️✔️latest

️✔️3.11

️✔️3.9

️✔️aro

️✔️latest

️✔️3.11

️✔️3.9

️✔️backup

️✔️latest

️✔️3.11

️✔️3.9

️✔️batch

️✔️latest

️✔️3.11

️✔️3.9

️✔️batchai

️✔️latest

️✔️3.11

️✔️3.9

️✔️billing

️✔️latest

️✔️3.11

️✔️3.9

️✔️botservice

️✔️latest

️✔️3.11

️✔️3.9

️✔️cdn

️✔️latest

️✔️3.11

️✔️3.9

️✔️cloud

️✔️latest

️✔️3.11

️✔️3.9

️✔️cognitiveservices

️✔️latest

️✔️3.11

️✔️3.9

️✔️config

️✔️latest

️✔️3.11

️✔️3.9

️✔️configure

️✔️latest

️✔️3.11

️✔️3.9

️✔️consumption

️✔️latest

️✔️3.11

️✔️3.9

️✔️container

️✔️latest

️✔️3.11

️✔️3.9

️✔️containerapp

️✔️latest

️✔️3.11

️✔️3.9

️✔️core

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️cosmosdb

️✔️latest

️✔️3.11

️✔️3.9

️✔️databoxedge

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️dla

️✔️latest

️✔️3.11

️✔️3.9

️✔️dls

️✔️latest

️✔️3.11

️✔️3.9

️✔️dms

️✔️latest

️✔️3.11

️✔️3.9

️✔️eventgrid

️✔️latest

️✔️3.11

️✔️3.9

️✔️eventhubs

️✔️latest

️✔️3.11

️✔️3.9

️✔️feedback

️✔️latest

️✔️3.11

️✔️3.9

️✔️find

️✔️latest

️✔️3.11

️✔️3.9

️✔️hdinsight

️✔️latest

️✔️3.11

️✔️3.9

️✔️identity

️✔️latest

️✔️3.11

️✔️3.9

️✔️iot

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️keyvault

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️kusto

️✔️latest

️✔️3.11

️✔️3.9

️✔️lab

️✔️latest

️✔️3.11

️✔️3.9

️✔️managedservices

️✔️latest

️✔️3.11

️✔️3.9

️✔️maps

️✔️latest

️✔️3.11

️✔️3.9

️✔️marketplaceordering

️✔️latest

️✔️3.11

️✔️3.9

️✔️monitor

️✔️latest

️✔️3.11

️✔️3.9

️✔️mysql

️✔️latest

️✔️3.11

️✔️3.9

️✔️netappfiles

️✔️latest

️✔️3.11

️✔️3.9

️✔️network

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️policyinsights

️✔️latest

️✔️3.11

️✔️3.9

️✔️privatedns

️✔️latest

️✔️3.11

️✔️3.9

️✔️profile

️✔️latest

️✔️3.11

️✔️3.9

️✔️rdbms

️✔️latest

️✔️3.11

️✔️3.9

️✔️redis

️✔️latest

️✔️3.11

️✔️3.9

️✔️relay

️✔️latest

️✔️3.11

️✔️3.9

️✔️resource

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️role

️✔️latest

️✔️3.11

️✔️3.9

️✔️search

️✔️latest

️✔️3.11

️✔️3.9

️✔️security

️✔️latest

️✔️3.11

️✔️3.9

️✔️servicebus

️✔️latest

️✔️3.11

️✔️3.9

️✔️serviceconnector

️✔️latest

️✔️3.11

️✔️3.9

️✔️servicefabric

️✔️latest

️✔️3.11

️✔️3.9

️✔️signalr

️✔️latest

️✔️3.11

️✔️3.9

️✔️sql

️✔️latest

️✔️3.11

️✔️3.9

️✔️sqlvm

️✔️latest

️✔️3.11

️✔️3.9

️✔️storage

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️synapse

️✔️latest

️✔️3.11

️✔️3.9

️✔️telemetry

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️util

️✔️latest

️✔️3.11

️✔️3.9

️✔️vm

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

azure-client-tools-bot-prd · 2023-11-21T08:46:04Z

Hi @jiasli,
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

azure-client-tools-bot-prd · 2023-11-21T08:46:07Z

️✔️AzureCLI-BreakingChangeTest

️✔️Non Breaking Changes

yonzhan · 2023-11-21T08:46:10Z

Profile

src/azure-cli/azure/cli/command_modules/profile/_validators.py

resolve-tenant

550977e

azure-client-tools-bot-prd bot added this to the December 2023 (2024-01-02) milestone Nov 21, 2023

microsoft-github-policy-service bot requested review from wangzelin007 and yonzhan November 21, 2023 08:46

microsoft-github-policy-service bot added the Auto-Assign Auto assign by bot label Nov 21, 2023

microsoft-github-policy-service bot assigned jiasli Nov 21, 2023

microsoft-github-policy-service bot added Account az login/account AAD labels Nov 21, 2023

jiasli requested a review from rayluo November 24, 2023 05:37

rayluo reviewed Nov 24, 2023

View reviewed changes

src/azure-cli/azure/cli/command_modules/profile/_validators.py Show resolved Hide resolved

rayluo reviewed Nov 24, 2023

View reviewed changes

src/azure-cli/azure/cli/command_modules/profile/_validators.py Show resolved Hide resolved

rayluo approved these changes Nov 24, 2023

View reviewed changes

yonzhan modified the milestones: December 2023 (2024-01-09), January 2024 (2024-02-06) Jan 2, 2024

jiasli marked this pull request as ready for review January 5, 2024 06:47

jiasli requested review from calvinhzy and evelyn-ys as code owners January 5, 2024 06:47

evelyn-ys approved these changes Jan 5, 2024

View reviewed changes

bebound approved these changes Jan 5, 2024

View reviewed changes

jiasli merged commit 2548ad6 into Azure:dev Jan 5, 2024

jiasli deleted the resolve-tenant branch January 5, 2024 07:18

MaxHorstmann pushed a commit to MaxHorstmann/azure-cli that referenced this pull request Jan 19, 2024

{Profile} Use v2.0 authority to resolve tenant ID (Azure#27892)

300e81f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

{Profile} Use v2.0 authority to resolve tenant ID #27892

{Profile} Use v2.0 authority to resolve tenant ID #27892

Uh oh!

jiasli commented Nov 21, 2023

Uh oh!

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading

Uh oh!

azure-client-tools-bot-prd bot commented Nov 21, 2023

Uh oh!

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading

Uh oh!

yonzhan commented Nov 21, 2023

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	def _get_authority_url(authority_endpoint, tenant):
	"""Convert authority endpoint (active_directory) to MSAL authority:
	- AAD: https://login.microsoftonline.com/your_tenant
	- ADFS: https://adfs.redmond.azurestack.corp.microsoft.com/adfs
	For ADFS, tenant is discarded.
	"""

	# Some Azure Stack (bellevue)'s metadata returns
	# "loginEndpoint": "https://login.microsoftonline.com/"
	# Normalize it by removing the trailing /, so that authority_url won't become
	# "https://login.microsoftonline.com//tenant_id".
	authority_endpoint = authority_endpoint.rstrip('/').lower()
	is_adfs = authority_endpoint.endswith('adfs')
	if is_adfs:
	authority_url = authority_endpoint
	else:
	authority_url = '{}/{}'.format(authority_endpoint, tenant or "organizations")
	return authority_url, is_adfs

{Profile} Use v2.0 authority to resolve tenant ID #27892

{Profile} Use v2.0 authority to resolve tenant ID #27892

Uh oh!

Conversation

jiasli commented Nov 21, 2023

Uh oh!

azure-client-tools-bot-prd bot commented Nov 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-client-tools-bot-prd bot commented Nov 21, 2023

Uh oh!

azure-client-tools-bot-prd bot commented Nov 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonzhan commented Nov 21, 2023

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading

azure-client-tools-bot-prd bot commented Nov 21, 2023 •

edited

Loading