[Compute] az ssh vm: Automatically launch browser when getting certificate fails

[jiasli]

Description

Fix #16988, #16989
Require #17072

When getting certificate fails for VM SSH,

1. the original AAD error is shown as a warning
2. browser is automatically launched to open /authorize with resource=https://pas.windows.net/CheckMyAccess/Linux

Conditional Access policy for MFA (#16989)

When ARM doesn't require MFA, but VM SSH does, az ssh vm calls /token and fails with

AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access 'ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0'.
Trace ID: ab8e08ab-b0f3-4c1b-b2b8-85f905da5b00
Correlation ID: 73ad3fe7-524c-4a6f-9e14-b448fa4b8c06
Timestamp: 2021-02-25 11:21:49Z

CLI then launches the browser. The browser prompts the user to do MFA.

Conditional Access policy for compliance check (#16988)

When ARM doesn't require compliance check, but VM SSH does, az ssh vm calls /token and fails with

AADSTS53000: Device is not in required device state: compliant. Conditional Access policy requires a compliant device, and the device is not compliant. The user must enroll their device with an approved MDM provider like Intune.
Trace ID: fed27c52-e7f0-4d4b-a6df-51016ec54a00
Correlation ID: 582d7943-5bc3-4fd4-9bb9-f6c7721b131f
Timestamp: 2021-02-25 11:06:44Z

CLI then launches the browser. After logging in, the browser gives the user a better error message:

Limitation

• Only user account with authorization code flow is supported.
• CLI should selectively launch the browser instead of launching the browser unconditionally for any AAD error.

Testing Guide

az login
az ssh vm -g <group> --vm-name <vm>

[yonzhan]

Automatically launch browser for ssh vm failure

[rayluo]

LGTM

[SanDeo-MSFT]

approved