Disable CAE in microsoft-graph-authz plugin

[jfreden]

Resolves: #142743

Disable CAE in the AzureIdentityAuthenticationProvider used by the Microsoft Graph authorization realm plugin.

Problem

The Microsoft Graph Authz plugin uses AzureIdentityAuthenticationProvider from the Kiota SDK to authenticate with Microsoft Entra via the client_credentials (service principal) flow. The 3-argument constructor enables CAE by default, which advertises the cp1 client capability to Entra.

When Entra updates its Conditional Access policies, it issues a CAE claims challenge with InteractionRequired and code TokenCreatedWithOutdatedPolicies. This challenge requires interactive user re-authentication, which is impossible for a service principal.

The result is that all users are denied login for up to 1 hour (the token expiry default) or until the coordinator nodes are restarted.

Fix

Pass isCaeEnabled=false to the AzureIdentityAuthenticationProvider constructor:

new AzureIdentityAuthenticationProvider(
    credentialProvider, Strings.EMPTY_ARRAY,
    null, false,
    "https://graph.microsoft.com/.default")

This stops the SDK from advertising cp1, so Entra:

1. Does not issue CAE challenges to this client. See docs here
2. Issues standard 1-hour tokens (instead of extended 28-hour CAE tokens). See docs here
3. Policy changes take effect at the next natural token refresh (within 1 hour)
   The integration test fixture's mock token endpoint now rejects any token request that advertises the cp1 CAE capability, so all existing integration tests implicitly verify the fix.

Why CAE cannot be handled instead of disabled

1. The Kiota SDK has built-in CAE retry logic: OkHttpRequestAdapter.retryCAEResponseIfRequired checks for 401 responses with claims challenges and retries once with a refreshed token. The AuthorizationHandler middleware (suggested in Microsoft Graph Authz plugin: CAE challenges cause authorization lockout #142743) uses the same mechanism. Since the error
   still surfaces to the application, the retry either did not trigger (claims extraction failed) or the retried request was also rejected.
2. InteractionRequired cannot be satisfied by client_credentials: The InteractionRequired result in the CAE challenge indicates that resolving the outdated-policy condition requires user interaction, which is impossible in a service principal flow.
3. Microsoft guidance: Applications should only advertise cp1 if they can handle claims challenges (docs). Since this plugin uses client_credentials and cannot handle interactive challenges, it should not
   advertise cp1.

[elasticsearchmachine]

Hi @jfreden, I've created a changelog YAML for you.

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[jfreden]

Added test mute for unrelated CI failures in #142926 so going to merge.

[elasticsearchmachine]

💚 Backport successful

Status	Branch	Result
✅	9.3
✅	8.19
✅	9.2