Support Azure CLI (`az`) version `2.73.0` and newer. by gabrielcorado · Pull Request #55374 · gravitational/teleport

gabrielcorado · 2025-06-02T21:21:35Z

Related to #55298

After version 2.73.0 of the az (Azure CLI), the managed identity flows were updated to use Microsoft Authentication Library (MSAL) by default.

Effective for our usage, that meant two breaking changes happened:

The az login --username/-u flag was deprecated when using managed identities (--identity). We should use --resource-id instead.
MSI is no longer used when only MSI_ENDPOINT is set, instead it also requires a MSI_SECRET set, however the new implementation is not backwards compatible and lacks documentation. Instead of using MSI endpoint, we can rely in the Identity (App Service) endpoint which is better documented and supported (for example, by Azure functions). This API works the same way as the MSI one, with the exception of a few fields that were renamed.

❯ tsh apps login azure-cli --azure-identity=azure-identity

Passing the managed identity ID with --username is no longer supported. Use --client-id, --object-id or --resource-id instead.
ERROR: exit status 1

ERROR: failed to automatically login with `az login` using identity "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.managedidentity/userassignedidentities/azure-identity"; run with --debug for details
        exit status 1

To support the newer version of az CLI, we've updated:

Use the --resource-id flag when on a newer version of the CLI. Otherwise, fallback into using the --username/-u flag.
Update the AzureMSIMiddleware (renamed to AzureTokenMiddleware) to be able to process Identity endpoint requests. There was no flow change, only a few fields changed and tests were added.

❯ tsh apps login azure-cli --azure-identity=azure-identity
[
  {
    "environmentName": "AzureCloud",
    "homeTenantId": "00000000-0000-0000-0000-000000000000",
    "id": "00000000-0000-0000-0000-000000000000",
    "isDefault": true,
    "managedByTenants": [],
    "name": "Subscription",
    "state": "Enabled",
    "tenantId": "00000000-0000-0000-0000-000000000000",
    "user": {
      "assignedIdentityInfo": "MSIResource-/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.managedidentity/userassignedidentities/azure-identity",
      "name": "userAssignedIdentity",
      "type": "servicePrincipal"
    }
  }
]
Logged into Azure app "azure-cli".
Your identity: /subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg/providers/microsoft.managedidentity/userassignedidentities/azure-identity
Example Azure CLI command: tsh az vm list

Most of this PR changes are in the test files, which were updated to test the usage of both MSI and Identity endpoints.

changelog: Added support to tsh App Access commands for Azure CLI (az) version 2.73.0 and newer.

Tener

A few minor items.

Tener · 2025-06-03T06:57:51Z

 }

-func (m *AzureMSIMiddleware) msiEndpoint(rw http.ResponseWriter, req *http.Request) error {
+func (m *AzureTokenMiddleware) handleEndpoint(rw http.ResponseWriter, req *http.Request, identityRequest bool) error {


As far as I can tell identityRequest is true when we are serving the updated protocol. The name doesn't quite reflect that, so perhaps we can rename is slightly to clarify that fact and add a comment about it as well.

alternatively, for better readability, avoid the bool and make two separate functions like handleMSIEndpoint, handleIdentityEndpoint.

I've updated this function to receive the field name and secret, so we don't need any conditions for this function.

Tener · 2025-06-03T07:13:06Z

+	}
+
 	endpoint := os.Getenv("MSI_ENDPOINT")
 	if endpoint == "" {


Should we look for IDENTITY_ENDPOINT too? I know we will overwrite it, but perhaps checking its existence might be worth it for debugging purposes?

Having only IDENTITY_HEADER set shouldn't be effective (as per MSAL definition). So I updated this function to follow this too.

greedy52

Thanks for the quick fix! lets also update the docs (here or separately)

greedy52 · 2025-06-03T13:56:10Z

 }

-func (m *AzureMSIMiddleware) msiEndpoint(rw http.ResponseWriter, req *http.Request) error {
+func (m *AzureTokenMiddleware) handleEndpoint(rw http.ResponseWriter, req *http.Request, identityRequest bool) error {


alternatively, for better readability, avoid the bool and make two separate functions like handleMSIEndpoint, handleIdentityEndpoint.

greedy52 · 2025-06-03T14:07:02Z

+		// TODO(gabrielcorado): use the cluster name. This value must match the
+		// one used by the proxy.


i doubt we will ever fix this. if we do, how do we plan to preserve backwards compatibility? is this jwt verification even necessary?

I haven't looked into too many details on this, either. I just updated the comment because now it is confusing why we use the MSI endpoint here, so I wanted to clarify that it is just a placeholder.

We can leave here and look later. If the JWT verification is not required, we can also simplify this code.

I'd drop the TODO. Using the cluster name would be helpful for validation purposes, but the other validation element is the CA that signed the JWT. It is safe to assume that CA is cluster-specific, so we don't necessarily need the cluster name to be different; it won't validate in the other cluster.

backport-bot-workflows · 2025-06-03T20:08:43Z

@gabrielcorado See the table below for backport results.

Branch	Result
branch/v15	Failed
branch/v16	Failed
branch/v17	Failed
branch/v18	Create PR

* refactor(tsh): support `az login` with MSAL * chore(tsh): fix lint * refactor: code review suggestions * test(tsh): fix wrong env names

refactor(tsh): support az login with MSAL

d5ec928

gabrielcorado requested review from greedy52 and marcoandredinis June 2, 2025 21:21

gabrielcorado added backport/branch/v17 backport/branch/v18 labels Jun 2, 2025

github-actions Bot requested review from atburke and fspmarshall June 2, 2025 21:22

github-actions Bot added application-access size/md tsh tsh - Teleport's command line tool for logging into nodes running Teleport. labels Jun 2, 2025

chore(tsh): fix lint

abc9c07

greedy52 requested review from Tener and marcoandredinis and removed request for atburke, fspmarshall and marcoandredinis June 2, 2025 22:42

Tener approved these changes Jun 3, 2025

View reviewed changes

greedy52 approved these changes Jun 3, 2025

View reviewed changes

public-teleport-github-review-bot Bot removed the request for review from marcoandredinis June 3, 2025 14:26

greedy52 added backport/branch/v15 labels Jun 3, 2025

gabrielcorado added 2 commits June 3, 2025 15:47

refactor: code review suggestions

1a66d4f

Merge branch 'master' into gabrielcorado/tsh-az-login-resource

072db13

gabrielcorado enabled auto-merge June 3, 2025 18:54

test(tsh): fix wrong env names

8e9708b

gabrielcorado added this pull request to the merge queue Jun 3, 2025

Merged via the queue into master with commit affde68 Jun 3, 2025
41 checks passed

gabrielcorado deleted the gabrielcorado/tsh-az-login-resource branch June 3, 2025 20:05

gabrielcorado mentioned this pull request Jun 3, 2025

[v18] Support Azure CLI (az) version 2.73.0 and newer. #55408

Merged

gabrielcorado added a commit that referenced this pull request Jul 18, 2025

Support Azure CLI (az) version 2.73.0 and newer. (#55374)

ca646cb

* refactor(tsh): support `az login` with MSAL * chore(tsh): fix lint * refactor: code review suggestions * test(tsh): fix wrong env names

gabrielcorado added a commit that referenced this pull request Jul 18, 2025

Support Azure CLI (az) version 2.73.0 and newer. (#55374)

53a846f

* refactor(tsh): support `az login` with MSAL * chore(tsh): fix lint * refactor: code review suggestions * test(tsh): fix wrong env names

This was referenced Jul 18, 2025

[v16] Support Azure CLI (az) version 2.73.0 and newer. #56950

Merged

[v17] Support Azure CLI (az) version 2.73.0 and newer. #56951

Merged

		// TODO(gabrielcorado): use the cluster name. This value must match the
		// one used by the proxy.

Conversation

gabrielcorado commented Jun 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Tener left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greedy52 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Tener Jun 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

backport-bot-workflows Bot commented Jun 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gabrielcorado commented Jun 2, 2025 •

edited

Loading

Tener Jun 3, 2025 •

edited

Loading