Credentials accept tenant_id argument to get_token

[chlowell]

This is the first step in enabling clients to implement tenant discovery via authentication challenges. Credentials which can in principle authenticate in multiple tenants (i.e. not ManagedIdentityCredential) receive a new parameter, allow_multitenant_authentication. When this is True, these credentials will honor a tenant_id keyword argument to get_token. When it's False, which is the default, get_token raises an exception when given a tenant that doesn't match the credential's configured tenant (i.e. the one set at instantiation), unless environment variable AZURE_IDENTITY_ENABLE_LEGACY_TENANT_SELECTION is set (because raising this exception may be a breaking change for some applications). When that environment variable is set get_token will use the credential's configured tenant, ignoring a tenant_id keyword argument.

Closes #17979, closes #19300

[mccoyp]

Should we kwargs.pop here and in the sync version?

[chlowell]

No need, kwargs isn't used again. I should use keyword-only syntax here though.

[check-enforcer]

This pull request is protected by Check Enforcer.

What is Check Enforcer?

Check Enforcer helps ensure all pull requests are covered by at least one check-run (typically an Azure Pipeline). When all check-runs associated with this pull request pass then Check Enforcer itself will pass.

Why am I getting this message?

You are getting this message because Check Enforcer did not detect any check-runs being associated with this pull request within five minutes. This may indicate that your pull request is not covered by any pipelines and so Check Enforcer is correctly blocking the pull request being merged.

What should I do now?

If the check-enforcer check-run is not passing and all other check-runs associated with this PR are passing (excluding license-cla) then you could try telling Check Enforcer to evaluate your pull request again. You can do this by adding a comment to this pull request as follows:
/check-enforcer evaluate
Typically evaulation only takes a few seconds. If you know that your pull request is not covered by a pipeline and this is expected you can override Check Enforcer using the following command:
/check-enforcer override
Note that using the override command triggers alerts so that follow-up investigations can occur (PRs still need to be approved as normal).

What if I am onboarding a new service?

Often, new services do not have validation pipelines associated with them, in order to bootstrap pipelines for a new service, you can issue the following command as a pull request comment:
/azp run prepare-pipelines
This will run a pipeline that analyzes the source tree and creates the pipelines necessary to build and validate your pull request. Once the pipeline has been created you can trigger the pipeline using the following comment:
/azp run python - [service] - ci

[chlowell]

@christothes I believe this is equivalent to your TenantIdResolver but please take a look, maybe I misread that (C# pattern matching syntax is new to me).

[mccoyp]

What's the reasoning for making InteractiveCredential an ABC instead of MsalCredential? I'm not too familiar with the purpose of inheriting from ABC

[chlowell]

A class inheriting ABC can only be instantiated if it implements every method the ABC decorates with abstractmethod. That's useful here because it enables InteractiveCredential.get_token to consolidate common code and do most of the work for subclasses while ensuring you get a runtime error when a subclass doesn't implement the one method that differs between authentication flows. With this change MsalCredential loses its only abstract method and thus its reason for inheriting ABC. InteractiveCredential still has an abstract method but was inheriting ABC through MsalCredential. So, now it must inherit ABC directly.