[Core] Support getting SSH certificate inside Cloud Shell

[rayluo]

Close #22063

This is a proof-of-concept to acquire SSH Cert from inside Cloud Shell.

Prerequisite: An MSAL prototype from this PR AzureAD/microsoft-authentication-library-for-python#420

@jiasli

[yonzhan]

PoC of support SSH Cert

[jiasli]

My test steps in Cloud Shell:

python -m venv cli-env
. cli-env/bin/activate

git clone https://github.com/Azure/azure-cli
cd azure-cli
git checkout cloudshell-imds

pip install -U pip
pip install azdev
azdev setup -c

# Working, in sub ae43b1e3-c35d-4c8c-bc0d-f148b4c52b78
az ssh vm -g rayluo-eastus2 -n LinuxVM

# Not working, in sub 0b1f6471-1bf0-4dda-aec3-cb9272f09590
az ssh vm -g jiasli-ssh-rg -n jiasli-ssh2
# output
A Cloud Shell credential problem occurred. When you report the issue with the error below, please mention the hostname 'cc-f29c4d42-7cd5855d5c-gpgrf'
token_type ssh-cert is not supported by this version of Azure Portal
Please explicitly log in with:
az login --scope https://pas.windows.net/CheckMyAccess/Linux/.default

[rayluo]

If the real central MSAL instance is somehow available here, I think we can reuse it, so that its already configured token_cache behavior will automatically be used to store SSH certs, and then this section can probably be refactored into something like below.

However, you do NOT have to make this change in this PR. We can merge this PR as-is (perhaps after MSAL 1.18 ships?) and postpone this cache improvement to a later date.

Suggested change

	import msal
	from .util import check_result, build_sdk_access_token
	from .identity import AZURE_CLI_CLIENT_ID
	app = msal.PublicClientApplication(
	AZURE_CLI_CLIENT_ID, # Use a real client_id, so that cache would work
	# TODO: This PoC does not currently maintain a token cache;
	# Ideally we should reuse the real MSAL app object which has cache configured.
	# token_cache=...,
	)
	result = app.acquire_token_interactive(list(scopes), prompt="none", data=kwargs["data"])
	from .util import check_result, build_sdk_access_token
	app = somehow_get_the_central_app_that_already_initialized() # TODO
	result = app.acquire_token_silent_with_error(list(scopes), data=kwargs["data"])
	if result is None or "error" in result:
	result = app.acquire_token_interactive(list(scopes), prompt="none", data=kwargs["data"])

[jiasli]

Tested MSAL released to https://test.pypi.org/project/msal/ and it works well!

pip install --index-url https://test.pypi.org/simple/ msal==1.18.0b1

[rayluo]

Great team work! Ship it! #Approve