{Auth} Bring back get_msal_token for acquiring VM SSH certificate
#31082
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
️✔️AzureCLI-FullTest
|
|
Hi @jiasli, |
️✔️AzureCLI-BreakingChangeTest
|
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
jiasli
commented
Mar 19, 2025
| """Get VM SSH certificate. Do not use it for other purposes. To get an access token, use get_raw_token instead. | ||
| """ | ||
| credential, _, _ = self.get_login_credentials() | ||
| certificate_string = credential.get_token(*scopes, data=data).token |
Member
Author
There was a problem hiding this comment.
get_token will be replaces by acquire_token after migrating managed identity authentication to MSAL: #25959
rayluo
approved these changes
Mar 19, 2025
jiasli
force-pushed
the
get_msal_token
branch
2 times, most recently
from
fbc0e05 to
7e9af5d
Compare
jiasli
commented
Jun 26, 2025
Comment on lines
168
to
170
| if data is not None: | ||
| from azure.cli.core.azclierror import AuthenticationError | ||
| raise AuthenticationError("VM SSH currently doesn't support managed identity.") |
Member
Author
There was a problem hiding this comment.
This detection was in adal_authentication.MSIAuthenticationWrapper:
It got dropped by #31577 without being migrated to msal_credentials.ManagedIdentityCredential.
jiasli
changed the title
get_msal_tokenget_msal_token for acquiring VM SSH certificate
3 tasks
jiasli
requested review from
bebound,
calvinhzy,
evelyn-ys,
jsntcy,
kairu-ms,
necusjz and
zhoxing-ms
as code owners
bebound
approved these changes
Jun 30, 2025
4 tasks
evelyn-ys
approved these changes
Jun 30, 2025
Member
Author
|
As |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related command
az ssh vmDescription
#19853 removed
Profile.get_msal_tokenand letsshextension callprofile.get_login_credentialsandcredential.get_tokento get the certificate:https://github.com/Azure/azure-cli-extensions/blob/695bd02037a7a8abd6b0ac76ae1ac1559ae46c41/src/ssh/azext_ssh/custom.py#L231-L233
This turns out to be a bad design as
get_tokenis used.get_tokendoesn't supportdataargument at all. This is a CLI-specific extension/alteration.get_token_infoprotocol ({Auth} Supportget_token_infoprotocol #30928),get_tokenis deprecated.This PR brings back
get_msal_token, so thatsshextension can seamlessly switch to the old interface without any update:https://github.com/Azure/azure-cli-extensions/blob/695bd02037a7a8abd6b0ac76ae1ac1559ae46c41/src/ssh/azext_ssh/custom.py#L229
Testing Guide