[Core] Support Continuous Access Evaluation

[jiasli]

Description

Close #21296

Support Continuous Access Evaluation. For details of CAE, see

• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation
• https://docs.microsoft.com/en-us/azure/active-directory/develop/app-resilience-continuous-access-evaluation

Testing Guide

az login now passes CP1 client capability to MSAL and AAD eSTS server:

az login
az account get-access-token

Decode the retrieved access token at https://jwt.ms/ to verify it has CP1 in xms_cc:

  "xms_cc": [
    "CP1"
  ],

Revoke all sessions:

az rest -m POST -u https://graph.microsoft.com/v1.0/me/revokeSignInSessions

Retry calling ARM until failure:

> az group list
WARNING: Acquiring new access token silently for tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a with claims challenge: {"access_token":{"nbf":{"essential":true, "value":"1661241267"}}}
AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2022-08-23T07:42:08.0617654Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2022-08-23T07:43:29.0000000Z'.
Trace ID: 23138fe7-e03f-4be2-b22d-4bf997b80a00
Correlation ID: b61947d7-37e2-4678-b397-d2de4eef5868
Timestamp: 2022-08-23 07:54:28Z
Interactive authentication is needed. Please run:
az logout
az login --scope https://management.core.windows.net//.default --claims eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwgInZhbHVlIjoiMTY2MTI0MTI2NyJ9fX0=

Log in again with the returned claims challenge:

az login --scope https://management.core.windows.net//.default --claims eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwgInZhbHVlIjoiMTY2MTI0MTI2NyJ9fX0=

Additional information

However, as explained in #21296 (comment), according to AAD document:

https://docs.microsoft.com/en-us/azure/active-directory/develop/app-resilience-continuous-access-evaluation#the-code

try
{
    authResult = await _clientApp.AcquireTokenSilent(scopes, firstAccount)
        .WithClaims(claimChallenge)
        .ExecuteAsync()
        .ConfigureAwait(false);
}
catch (MsalUiRequiredException)
{
    try
    {
        authResult = await _clientApp.AcquireTokenInteractive(scopes)
            .WithClaims(claimChallenge)
            .WithAccount(firstAccount)
            .ExecuteAsync()
            .ConfigureAwait(false);
    }
    // ...

claims challenge should be sent back to interactive re-auth. But Azure PowerShell cmdlet Connect-AzAccount doesn't expose -Claims parameter, and everything still works as expected.

We still need to decide whether Azure CLI wants to expose --claims in az login.

2022-08-33 Update

As discussed with Azure PowerShell, Azure CLI will not support --claims for now until further required.

> az group list
Acquiring new access token silently for tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a with claims challenge: {"access_token":{"nbf":{"essential":true, "value":"1661831250"}}}
AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2022-08-30T03:44:31.6241251Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2022-08-30T03:44:55.0000000Z'.
Trace ID: 19e0cb8b-a0bc-4743-a639-5f122c051b00
Correlation ID: cf0dc7d9-7042-4c7f-83f0-0a00a5c3bb7a
Timestamp: 2022-08-30 03:47:31Z
Interactive authentication is needed. Please run:
az login --scope https://management.core.windows.net//.default

Azure CLI will support AZURE_IDENTITY_DISABLE_CP1 to align with Azure PowerShell, .NET Azure Identity SDK and Python Azure Identity SDK.

[jiasli]

I accidentally bumped into a scenario where silent re-auth works, without interactive re-auth:

> az login

# Switch to a tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a where I am a guest
> az account set -s 0b1f6471-1bf0-4dda-aec3-cb9272f09590

# Revoke all sessions
> az rest -m POST -u https://graph.microsoft.com/v1.0/me/revokeSignInSessions

> az group list > $null
WARNING: Acquiring new access token silently for tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a with claims challenge: {"access_token":{"nbf":{"essential":true, "value":"1661243399"}}}

I guess it is because I didn't revoke sessions in home tenant 72f988bf-86f1-41af-91ab-2d7cd011db47, which makes the fresh token still valid. Silent re-auth can successfully get a new access token for tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a.

[jiasli]

The implementation with az login --claims is pushed to https://github.com/jiasli/azure-cli/tree/cae-login-claims

[jiasli]

It seems xms_ssm claims is dropped from GA version of CAE, so this test is no longer needed:

self.assertEqual(decoded['xms_ssm'], '1')  # xms_ssm: extension microsoft smart session management