[Profile] Fix "missing secret or certificate in order to authenticate through a service principal"

[jiasli]

Description

After logging in with a Service Principal using a certificate, 2 commands

• az account show --sdk-auth
• az account list --refresh

will fail with

missing secret or certificate in order to authenticate through a service principal

This is because retrieve_secret_of_service_principal can only return a secret, but None for certificateFile, causing subsequent ServicePrincipalAuth instantiation to fail due to the lack of password_arg_value.

This PR fixes these commands by:

• Rename retrieve_secret_of_service_principal to retrieve_cred_for_service_principal to reflect its actual functionality.
• Let retrieve_cred_for_service_principal return secret or certificateFile of the Service Principal so that ServicePrincipalAuth gets what it needs.

Testing Guide

To repro:

> az ad sp create-for-rbac --create-cert --skip-assignment --sdk-auth
{
    "clientId": "9bf154b1-c29b-4aeb-804a-0a1f8a9bac4c",
    "clientCertificate": "C:\\Users\\username\\tmp6yoosff6.pem",
    "subscriptionId": "0b1f6471-1bf0-4dda-aec3-cb9272f09590",
    "tenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
    "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
    "resourceManagerEndpointUrl": "https://management.azure.com/",
    "activeDirectoryGraphResourceId": "https://graph.windows.net/",
    "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
    "galleryEndpointUrl": "https://gallery.azure.com/",
    "managementEndpointUrl": "https://management.core.windows.net/"
}

> az login --service-principal 
           --username "9bf154b1-c29b-4aeb-804a-0a1f8a9bac4c" 
           --password "C:\Users\username\tmp6yoosff6.pem"
           --tenant "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a"
           --allow-no-subscriptions

> az account show --sdk-auth
missing secret or certificate in order to authenticate through a service principal

> az account list --refresh
Refreshing for '9bf154b1-c29b-4aeb-804a-0a1f8a9bac4c' failed with an error 'missing secret or certificate 
in order to authenticate through a service principal'. The existing accounts were not modified. You can run 
'az login' later to explicitly refresh them

After the fix:

> az account show --sdk-auth
{
  "clientId": "9bf154b1-c29b-4aeb-804a-0a1f8a9bac4c",
  "clientCertificate": "C:\\Users\\username\\tmp6yoosff6.pem",
  "subscriptionId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
  "tenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}

> az account list --refresh
[
  {
    "cloudName": "AzureCloud",
    "id": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
    "isDefault": true,
    "name": "N/A(tenant level account)",
    "state": "Enabled",
    "tenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
    "user": {
      "name": "9bf154b1-c29b-4aeb-804a-0a1f8a9bac4c",
      "type": "servicePrincipal"
    }
  }
]

[yonzhan]

Profile

[jiasli]

Replace of with for to be in sync with retrieve_token_for_service_principal.

[jiasli]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).