[Identity] CAE b3

[jiasli]

Dependencies

CAE b3 support build upon

• azure-core 1.14.0b1
  • https://pypi.org/project/azure-core/1.14.0b1/
  • https://github.com/Azure/azure-sdk-for-python/tree/azure-core_1.14.0b1
• azure-mgmt-core 1.3.0b1
  • https://pypi.org/project/azure-mgmt-core/1.3.0b1/
  • https://github.com/Azure/azure-sdk-for-python/tree/azure-mgmt-core_1.3.0b1
• azure-identity 1.6.0b3
  • https://pypi.org/project/azure-identity/1.6.0b3/
  • https://github.com/Azure/azure-sdk-for-python/tree/azure-identity_1.6.0b3

This PR is a rework of #17070.

Testing Guide

# Log in with CAE enabled
> az login

# A successful command using Track 2 SDK
> az storage account list

# A successful command using Track 1 SDK
> az group list

# Get the access token
# Decode it at https://jwt.ms and check claims
#   - "xms_cc": ["CP1"]
#   - "xms_ssm": "1" 
> az account get-access-token

# Revoke the session
> az rest -m POST -u https://graph.microsoft.com/v1.0/me/revokeSignInSessions

# Wait several minute for the session revocation to propagate

# A failed command using Track 2 SDK
> az storage account list
AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-04-08T07:28:53.6808518Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-08T07:29:09.0000000Z'.
Trace ID: 686ab9c1-9991-4bc1-b353-279b2ea2ab01
Correlation ID: d1731352-800d-4b95-ae15-5e1999ce5d0b
Timestamp: 2021-04-08 07:53:44Z
To re-authenticate, please run:
az logout
az login
If the problem persists, please contact your tenant administrator.

# A failed command using Track 1 SDK
> az group list
Authentication failed.
The access token has expired or been revoked by Continuous Access Evaluation. Silent re-authentication will be attempted in the future.
To re-authenticate, please run:
az logout
az login
If the problem persists, please contact your tenant administrator.

Additional context

Due to MSAL caching issue AzureAD/microsoft-authentication-library-for-python#335, az logout is currently mandatory before calling az login again so that revoked access tokens can be purged from MSAL cache.

[yonzhan]

CAE b3

[jiasli]

Installation instruction:

python -m venv cae-venv

# PowerShell
. .\cae-venv\Scripts\Activate.ps1

# Bash
. cae-venv/bin/activate

python -m pip install --upgrade pip

pip install --extra-index-url https://azurecliedge.blob.core.windows.net/cae/simple/ azure-cli==2.21.0.1