update

Author: jiasli

src/azure-cli-core/azure/cli/core/auth/identity.py

@@ -295,8 +295,7 @@ def build_from_credential(cls, tenant_id, client_id, credential):
         return ServicePrincipalAuth(entry)
 
     @classmethod
-    def build_credential(cls, secret_or_certificate=None, client_assertion=None, use_cert_sn_issuer=None,
-                         federated_identity=None):
+    def build_credential(cls, secret_or_certificate=None, client_assertion=None, use_cert_sn_issuer=None):
         """Build credential from user input. The credential looks like below, but only one key can exist.
         {
             'client_secret': 'my_secret',
@@ -315,9 +314,6 @@ def build_credential(cls, secret_or_certificate=None, client_assertion=None, use
                 entry[_CLIENT_SECRET] = secret_or_certificate
         elif client_assertion:
             entry[_CLIENT_ASSERTION] = client_assertion
-        elif federated_identity:
-            # Reuse client_assertion and set it to a const
-            entry[_CLIENT_ASSERTION] = FEDERATED_IDENTITY
         return entry
 
     def get_entry_to_persist(self):
@@ -352,7 +348,9 @@ def get_msal_client_credential(self):
         #     "client_assertion": "...a JWT with claims aud, exp, iss, jti, nbf, and sub..."
         # }
         if self.client_assertion:
-            client_credential = {'client_assertion': self.client_assertion}
+            client_credential = {
+                'client_assertion': get_id_token_on_github if self.client_assertion == FEDERATED_IDENTITY
+                else self.client_assertion}
 
         return client_credential
 
@@ -461,3 +459,22 @@ def get_environment_credential():
         getenv(AZURE_TENANT_ID))
     credentials = ServicePrincipalCredential(sp_auth, authority=authority)
     return credentials
+
+
+def get_id_token_on_github():
+    import os
+    from urllib.parse import quote
+    import requests
+    token = os.environ['ACTIONS_ID_TOKEN_REQUEST_TOKEN']
+    url = os.environ['ACTIONS_ID_TOKEN_REQUEST_URL']
+    encodedAudience = quote('api://AzureADTokenExchange')
+    url = f'{url}&audience={encodedAudience}'
+    headers = {
+        'Authorization': f'bearer {token}',
+        'Accept': 'application/json; api-version=2.0',
+        'Content-Type': 'application/json'
+    }
+    result = requests.get(url, headers=headers)
+    id_token = result.json()['value']
+    logger.warning('Got ID token: %s', id_token)
+    return id_token

src/azure-cli-core/azure/cli/core/auth/msal_credentials.py

@@ -107,22 +107,3 @@ def get_token(self, *scopes, **kwargs):
         result = self._msal_app.acquire_token_for_client(list(scopes), **kwargs)
         check_result(result)
         return build_sdk_access_token(result)
-
-
-def get_id_token_on_github():
-    import os
-    from urllib.parse import quote
-    import requests
-    token = os.environ['ACTIONS_ID_TOKEN_REQUEST_TOKEN']
-    url = os.environ['ACTIONS_ID_TOKEN_REQUEST_URL']
-    encodedAudience = quote('api://AzureADTokenExchange')
-    url = f'{url}&audience={encodedAudience}'
-    headers = {
-        'Authorization': f'bearer {token}',
-        'Accept': 'application/json; api-version=2.0',
-        'Content-Type': 'application/json'
-    }
-    result = requests.get(url, headers=headers)
-    id_token = result.json()['value']
-    logger.warning('Got ID token: %s', id_token)
-    return id_token

src/azure-cli/azure/cli/command_modules/profile/__init__.py

@@ -5,7 +5,7 @@
 
 from azure.cli.core import AzCommandsLoader
 from azure.cli.core.commands import CliCommandType
-from azure.cli.core.commands.parameters import get_enum_type
+from azure.cli.core.commands.parameters import get_enum_type, get_three_state_flag
 
 from azure.cli.command_modules.profile._format import transform_account_list
 import azure.cli.command_modules.profile._help  # pylint: disable=unused-import
@@ -58,7 +58,8 @@ def load_arguments(self, command):
             c.argument('use_cert_sn_issuer', action='store_true', help='used with a service principal configured with Subject Name and Issuer Authentication in order to support automatic certificate rolls')
             c.argument('scopes', options_list=['--scope'], nargs='+', help='Used in the /authorize request. It can cover only one static resource.')
             c.argument('client_assertion', options_list=['--federated-token'], help='Federated token that can be used for OIDC token exchange.')
-            c.argument('federated_identity', options_list=['--federated-identity'], help='Use federated identity credential.')
+            c.argument('federated_identity', options_list=['--federated-identity'], arg_type=get_three_state_flag(),
+                       help='Use federated identity credential.')
 
         with self.argument_context('logout') as c:
             c.argument('username', help='account user, if missing, logout the current active account')

src/azure-cli/azure/cli/command_modules/profile/custom.py

@@ -129,6 +129,9 @@ def login(cmd, username=None, password=None, service_principal=None, tenant=None
         raise CLIError("usage error: '--use-sn-issuer' is only applicable with a service principal")
     if service_principal and not username:
         raise CLIError('usage error: --service-principal --username NAME --password SECRET --tenant TENANT')
+    if client_assertion and federated_identity:
+        raise CLIError('usage error: Only one of --federated-token and --federated-identity can be specified')
+
     if username and not service_principal and not identity:
         logger.warning(USERNAME_PASSWORD_DEPRECATION_WARNING)
 
@@ -155,8 +158,9 @@ def login(cmd, username=None, password=None, service_principal=None, tenant=None
     if service_principal:
         from azure.cli.core.auth.identity import ServicePrincipalAuth
         password = ServicePrincipalAuth.build_credential(
-            secret_or_certificate=password, client_assertion=client_assertion,
-            use_cert_sn_issuer=use_cert_sn_issuer, federated_identity=federated_identity)
+            secret_or_certificate=password,
+            client_assertion='FEDERATED_IDENTITY' if federated_identity else client_assertion,
+            use_cert_sn_issuer=use_cert_sn_issuer)
 
     login_experience_v2 = cmd.cli_ctx.config.getboolean('core', 'login_experience_v2', fallback=True)
     # Send login_experience_v2 config to telemetry