x-ms-authorization-auxiliary header should be redacted

[jiasli]

Is your feature request related to a problem? Please describe.

x-ms-authorization-auxiliary header's value is logged by NetworkTraceLoggingPolicy, because only authorization header is redacted.

azure-sdk-for-python/sdk/core/azure-core/azure/core/pipeline/policies/_universal.py

Line 283 in 2e6022b

if header.lower() == 'authorization':

Even though x-ms-authorization-auxiliary is not supported by Track 2 SDK yet (#8313), Azure CLI is manually adding this header to support cross-tenant auth (Azure/azure-cli#16797).

Describe the solution you'd like

Make an ARMNetworkTraceLoggingPolicy, just like ARMHttpLoggingPolicy. SDKs should use ARMNetworkTraceLoggingPolicy instead of NetworkTraceLoggingPolicy, so that x-ms-authorization-auxiliary can also be redacted.

NetworkTraceLoggingPolicy is created in xxxClientConfiguration, like NetworkManagementClientConfiguration (which belongs to a specific SDK):

azure-sdk-for-python/sdk/network/azure-mgmt-network/azure/mgmt/network/_configuration.py

Line 59 in 3bf5688

self.logging_policy = kwargs.get('logging_policy') or policies.NetworkTraceLoggingPolicy(**kwargs)

We should change this line to

self.logging_policy = kwargs.get('logging_policy') or policies.ARMNetworkTraceLoggingPolicy(**kwargs)

but this of course requires all existing SDKs to be regenerated.

Describe alternatives you've considered

Add the redacting x-ms-authorization-auxiliary behavior directly to NetworkTraceLoggingPolicy from azure-core.

[jiasli]

Another possible solution:

1. Keep all headers except Authorization, so that there is no breaking change and it is by default secure. x-ms-authorization-auxiliary is Azure ARM specific, so keep it.

2. Then expose the blocklist to the caller, so that Azure CLI can make a config like:

   az config set logging.incude_credential=True
   

   Currently it is hard coded:
   

   azure-sdk-for-python/sdk/core/azure-core/azure/core/pipeline/policies/_universal.py

   Lines 283 to 284 in 2e6022b

   	if header.lower() == 'authorization':
   	value = '*****'

3. If so, CLI can simply set the blocklist to []. If not, CLI can also simply set the blocklist to ['Authorization', 'x-ms-authorization-auxiliary']

In this way, users can still log sensitive headers explicitly.

[xiangyan99]

As we discussed offline, this is by design.