{Profile} az login: Add HTTP timeout and fix callback arg parsing

Code-review follow-ups on the OIDC token-refresh feature:

- Add an explicit connect/read timeout to the GitHub Actions and Azure DevOps OIDC
  token requests via a shared _oidc_http_request helper. Without it, a stalled
  connection would hang token acquisition (and, for --federated-identity, every
  concurrent refresh thread holding the lock) indefinitely on a long-running CI job.
  Timeout and connection failures now raise a clear CLIError.
- Parse the --federated-token-callback command with POSIX rules on every platform.
  The previous posix=False path on Windows left literal quote characters in argv, so a
  quoted argument containing spaces (e.g. an audience) reached the program corrupted.
  POSIX parsing handles quoting correctly and consistently; the Windows backslash
  caveat is documented in the help text and docstring.

Adds tests for the request timeout path and quoted-argument parsing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MaddyMicrosoft

src/azure-cli-core/azure/cli/core/auth/identity.py

@@ -485,6 +485,10 @@ def get_environment_credential():
 # MSAL may invoke a client_assertion callback concurrently; this lock keeps the dispatcher fetch thread-safe.
 _federated_id_token_lock = threading.Lock()
 
+# Connect/read timeouts (seconds) for OIDC ID token requests, so a network stall fails fast on a
+# long-running CI job instead of hanging the whole token acquisition indefinitely.
+_OIDC_HTTP_TIMEOUT = (10, 30)
+
 
 def get_federated_id_token():
     """Acquire a fresh OIDC ID token from the current CI/CD provider.
@@ -508,6 +512,21 @@ def get_federated_id_token():
             "--federated-token instead. See https://github.com/Azure/azure-cli/issues/28708 for details.")
 
 
+def _oidc_http_request(method, url, headers, provider):
+    """Issue an OIDC ID token HTTP request with an explicit timeout.
+
+    A missing timeout would let a stalled connection hang token acquisition forever on a long-running CI
+    job, so we bound it and surface a clear error on timeout or connection failure.
+    """
+    import requests
+    try:
+        return method(url, headers=headers, timeout=_OIDC_HTTP_TIMEOUT)
+    except requests.exceptions.Timeout:
+        raise CLIError('Timed out requesting an ID token from {}. Please retry.'.format(provider))
+    except requests.exceptions.RequestException as ex:
+        raise CLIError('Failed to reach the {} OIDC endpoint: {}'.format(provider, ex))
+
+
 def _get_id_token_github():
     """Fetch a fresh OIDC ID token from the GitHub Actions token service.
 
@@ -534,7 +553,7 @@ def _get_id_token_github():
         'Accept': 'application/json; api-version=2.0',
         'Content-Type': 'application/json'
     }
-    response = requests.get(url, headers=headers)
+    response = _oidc_http_request(requests.get, url, headers, 'GitHub Actions')
     if not response.ok:
         raise CLIError('Failed to retrieve an ID token from GitHub Actions: {} {}'.format(
             response.status_code, response.reason))
@@ -586,7 +605,7 @@ def _get_id_token_azure_devops():
         # Prevents the service from responding with a redirect HTTP status code.
         'X-TFS-FedAuthRedirect': 'Suppress',
     }
-    response = requests.post(url, headers=headers)
+    response = _oidc_http_request(requests.post, url, headers, 'Azure DevOps')
     if not response.ok:
         raise CLIError('Failed to retrieve an ID token from Azure DevOps: {} {}'.format(
             response.status_code, response.reason))
@@ -605,15 +624,18 @@ def _build_command_assertion_callback(command):
     is expected to print a single OIDC token to stdout; MSAL invokes the returned callable whenever it
     needs a fresh assertion, so refresh works with any CI/CD provider.
 
-    The command is parsed into an argument vector and run WITHOUT a shell (shell=False). Because the command
-    is persisted in the service principal entry and re-executed on every refresh, avoiding a shell prevents a
-    tampered token cache from turning into arbitrary code execution. Users who need shell features such as
-    pipes or redirection should either point to a script file or wrap the pipeline explicitly, e.g.
+    The command is parsed into an argument vector (with POSIX rules on every platform) and run WITHOUT a
+    shell (shell=False). Because the command is persisted in the service principal entry and re-executed on
+    every refresh, avoiding a shell prevents a tampered token cache from turning into arbitrary code
+    execution. Users who need shell features such as pipes or redirection should either point to a script
+    file or wrap the pipeline explicitly, e.g.
     --federated-token-callback "bash -c 'curl ... | jq -r .value'".
+    On Windows, use forward slashes in paths or escape backslashes (POSIX parsing treats '\\' as an escape).
     """
     import shlex
-    # posix=False keeps Windows paths (backslashes) intact; args are still executed without a shell.
-    args = shlex.split(command, posix=not sys.platform.startswith('win'))
+    # POSIX parsing on every platform so quoted arguments containing spaces are handled correctly and
+    # consistently. The trade-off is that backslashes are escape characters (see the Windows note above).
+    args = shlex.split(command, posix=True)
     if not args:
         raise CLIError('--federated-token-callback: the command is empty.')
 

src/azure-cli-core/azure/cli/core/auth/tests/test_identity.py

@@ -324,6 +324,15 @@ def test_federated_token_callback_no_shell_interpretation(self):
             sp_auth.get_msal_client_credential()['client_assertion']()
         assert run_mock.call_args.args[0] == ['get-token', ';', 'rm', '-rf', '/']
 
+    def test_federated_token_callback_quoted_argument(self):
+        # A quoted argument containing spaces must reach the program without the surrounding quotes.
+        sp_auth = ServicePrincipalAuth.build_from_credential(
+            'tenant1', 'sp_id1', {'client_assertion_callback': 'mytool --aud "api://x y"'})
+        with mock.patch('subprocess.run') as run_mock:
+            run_mock.return_value = mock.MagicMock(stdout='tok\n', stderr='')
+            sp_auth.get_msal_client_credential()['client_assertion']()
+        assert run_mock.call_args.args[0] == ['mytool', '--aud', 'api://x y']
+
     @mock.patch('subprocess.run')
     def test_federated_token_callback_empty_output(self, run_mock):
         run_mock.return_value = mock.MagicMock(stdout='   \n', stderr='')
@@ -415,6 +424,19 @@ def test_get_federated_id_token_github(self, get_mock):
         assert called_url.startswith('https://github.example/token?foo=bar&audience=')
         assert 'api%3A//AzureADTokenExchange' in called_url
         assert get_mock.call_args.kwargs['headers']['Authorization'] == 'bearer request_token'
+        # A timeout is always passed so a network stall fails fast instead of hanging the CI job.
+        assert get_mock.call_args.kwargs['timeout'] is not None
+
+    @mock.patch.dict(os.environ, {
+        'ACTIONS_ID_TOKEN_REQUEST_URL': 'https://github.example/token',
+        'ACTIONS_ID_TOKEN_REQUEST_TOKEN': 'request_token'
+    }, clear=True)
+    @mock.patch('requests.get')
+    def test_get_federated_id_token_github_timeout(self, get_mock):
+        import requests
+        get_mock.side_effect = requests.exceptions.Timeout()
+        with self.assertRaisesRegex(CLIError, 'Timed out'):
+            get_federated_id_token()
 
     @mock.patch.dict(os.environ, {
         'ACTIONS_ID_TOKEN_REQUEST_URL': 'https://github.example/token',

src/azure-cli/azure/cli/command_modules/profile/__init__.py

@@ -94,9 +94,10 @@ def load_arguments(self, command):
                        options_list=['--federated-token-callback', '--federated-token-cmd'],
                        help='A command that prints a fresh OIDC federated token to stdout. Azure CLI runs it on '
                             'demand to refresh the token, so it works with any CI/CD provider. The command runs '
-                            'without a shell; to use pipes or redirection, point to a script file or wrap it, '
-                            'e.g. "bash -c \'...\'". Cannot be combined with --federated-token or '
-                            '--federated-identity.')
+                            'without a shell (arguments are parsed with POSIX rules; on Windows use forward '
+                            'slashes or escape backslashes). To use pipes or redirection, point to a script '
+                            'file or wrap it, e.g. "bash -c \'...\'". Cannot be combined with --federated-token '
+                            'or --federated-identity.')
 
             # Managed identity
             c.argument('identity', options_list=('-i', '--identity'), action='store_true',