Merge branch 'dev' into add-validation-level

Author: jeskew

azure-pipelines.yml

@@ -813,6 +813,12 @@ jobs:
           artifact: rpm-ubi9-${{ arch.value }}
           python_package: python3.12
           pool: ${{ arch.pool }}
+        Red Hat Universal Base Image 10 ${{ arch.name }}:
+          dockerfile: ubi
+          image: registry.access.redhat.com/ubi10/ubi:10.0
+          artifact: rpm-ubi10-${{ arch.value }}
+          python_package: python3.12
+          pool: ${{ arch.pool }}
   steps:
   - bash: ./scripts/ci/install_docker.sh
     displayName: Install Docker
@@ -866,6 +872,14 @@ jobs:
           python_cmd: python3.12
           pip_cmd: pip3.12
           pool: ${{ arch.pool }}
+        Red Hat Universal Base Image 10 ${{ arch.name }}:
+          artifact: rpm-ubi10-${{ arch.value }}
+          distro: el10
+          image: registry.access.redhat.com/ubi10/ubi:10.0
+          python_package: python3.12
+          python_cmd: python3.12
+          pip_cmd: pip3.12
+          pool: ${{ arch.pool }}
   steps:
   - task: DownloadPipelineArtifact@1
     displayName: 'Download Metadata'

linter_exclusions.yml

@@ -285,6 +285,9 @@ aks create:
     azure_keyvault_kms_key_vault_network_access:
       rule_exclusions:
         - option_length_too_long
+    enable_ai_toolchain_operator:
+      rule_exclusions:
+      - option_length_too_long
     azure_keyvault_kms_key_vault_resource_id:
       rule_exclusions:
         - option_length_too_long
@@ -362,6 +365,12 @@ aks update:
     azure_keyvault_kms_key_vault_network_access:
       rule_exclusions:
         - option_length_too_long
+    enable_ai_toolchain_operator:
+      rule_exclusions:
+        - option_length_too_long
+    disable_ai_toolchain_operator:
+      rule_exclusions:
+        - option_length_too_long
     azure_keyvault_kms_key_vault_resource_id:
       rule_exclusions:
         - option_length_too_long

scripts/regression_test/extension_regression_test.yml

@@ -21,12 +21,7 @@ jobs:
       inputs:
         versionSpec: '3.12'
         displayName: "Use Python 3.12"
-    - task: AzureCLI@1
-      displayName: 'checkout branch'
-      inputs:
-        azureSubscription: $(AZURE_SDK_INFRA_SUB_CONNECTED_SERVICE)
-        scriptLocation: inlineScript
-        inlineScript: |
+    - bash: |
           set -ev
           pwd
           git clone https://github.com/Azure/azure-cli-extensions.git
@@ -39,6 +34,7 @@ jobs:
           git remote add azclibot https://azclibot:${GITHUB_TOKEN}@github.com/azclibot/azure-cli-extensions.git
           git checkout -b regression_test_$(Build.BuildId)
           git push --set-upstream azclibot regression_test_$(Build.BuildId)
+      displayName: 'checkout branch'
 
 - job: CLIExtensionRegressionTest
   displayName: CLI Extension Regression Test
@@ -78,12 +74,7 @@ jobs:
     inputs:
       versionSpec: '3.12'
       displayName: "Use Python 3.12"
-  - task: AzureCLI@1
-    displayName: 'checkout cli and extension repo'
-    inputs:
-      azureSubscription: $(AZURE_SDK_INFRA_SUB_CONNECTED_SERVICE)
-      scriptLocation: inlineScript
-      inlineScript: |
+  - bash: |
         set -ev
         pwd
         if [[ -n "$(CUSTOM_CLI_REPO)" && -n "$(CUSTOM_CLI_BRANCH)" ]]; then
@@ -103,21 +94,23 @@ jobs:
 
         git fetch azclibot
         git checkout -b regression_test_$(Build.BuildId) azclibot/regression_test_$(Build.BuildId)
+    displayName: 'checkout cli and extension repo'
   - template: ../../.azure-pipelines/templates/azdev_setup.yml
     parameters:
       CLIExtensionRepoPath: ./azure-cli-extensions
-  - task: AzureCLI@1
+  - task: AzureCLI@2
     displayName: 'Rerun tests'
     inputs:
-      azureSubscription: $(AZURE_SDK_TEST_SUB_CONNECTED_SERVICE)
+      connectedServiceNameARM: $(azure-cli-live-test-bami-connected-service)
+      scriptType: bash
       scriptLocation: inlineScript
       inlineScript: |
         set -ev
         
         source env/bin/activate
         cd azure-cli-extensions
         
-        az account set -s 0b1f6471-1bf0-4dda-aec3-cb9272f09590
+        az account set -s $(azure-cli-live-test-bami-sub-id)
         
         python ../scripts/ci/automation_full_test.py "12" "$(Instance_idx)" "latest" "" "True" "extension"
   
@@ -160,12 +153,7 @@ jobs:
   pool:
     name: ${{ variables.ubuntu_pool }}
   steps:
-    - task: AzureCLI@1
-      displayName: 'Result Summary'
-      inputs:
-        azureSubscription: $(AZURE_SDK_INFRA_SUB_CONNECTED_SERVICE)
-        scriptLocation: inlineScript
-        inlineScript: |
+    - bash: |
           set -ev
 
           # git config
@@ -207,3 +195,4 @@ jobs:
 
             sleep 5
           done
+      displayName: 'Result Summary'

scripts/regression_test/regression_test.yml

@@ -22,12 +22,7 @@ jobs:
       inputs:
         versionSpec: '3.12'
         displayName: "Use Python 3.12"
-    - task: AzureCLI@1
-      displayName: 'update version'
-      inputs:
-        azureSubscription: $(AZURE_SDK_INFRA_SUB_CONNECTED_SERVICE)
-        scriptLocation: inlineScript
-        inlineScript: |
+    - bash: |
           set -ev
 
           # git config
@@ -58,6 +53,7 @@ jobs:
           git add .
           git commit -m "update version"
           git push --set-upstream azclibot regression_test_$(Build.BuildId)
+      displayName: 'update version'
 
 - job: RerunTests
   displayName: CLI Regression tests
@@ -90,12 +86,7 @@ jobs:
       inputs:
         versionSpec: '3.12'
         displayName: "Use Python 3.12"
-    - task: AzureCLI@1
-      displayName: 'Checkout Target Branch'
-      inputs:
-        azureSubscription: $(AZURE_SDK_INFRA_SUB_CONNECTED_SERVICE)
-        scriptLocation: inlineScript
-        inlineScript: |
+    - bash: |
           set -ev
           # git config
           if [[ -n "$(CUSTOM_REPO)" && -n "$(CUSTOM_BRANCH)" && -n "$(CUSTOM_GITHUB_TOKEN)" ]]; then
@@ -113,11 +104,13 @@ jobs:
           git fetch ${GITHUB_REPO} ${GITHUB_BRANCH}
 
           git checkout -b ${GITHUB_BRANCH} ${GITHUB_REPO}/${GITHUB_BRANCH}
+      displayName: 'Checkout Target Branch'
     - template: ../../.azure-pipelines/templates/azdev_setup.yml
-    - task: AzureCLI@1
+    - task: AzureCLI@2
       displayName: 'Rerun tests'
       inputs:
-        azureSubscription: $(AZURE_SDK_TEST_SUB_CONNECTED_SERVICE)
+        connectedServiceNameARM: $(azure-cli-live-test-bami-connected-service)
+        scriptType: bash
         scriptLocation: inlineScript
         inlineScript: |
           set -ev
@@ -128,7 +121,7 @@ jobs:
             pip install $(CUSTOM_WHL_URL) --force-reinstall
           fi
 
-          az account set -s 0b1f6471-1bf0-4dda-aec3-cb9272f09590
+          az account set -s $(azure-cli-live-test-bami-sub-id)
 
           serial_modules="appservice botservice cloud network azure-cli-core azure-cli-telemetry"
           python scripts/ci/automation_full_test.py "8" "$(Instance_idx)" "latest" "$serial_modules" "True"
@@ -144,12 +137,7 @@ jobs:
   pool:
     name: ${{ variables.ubuntu_pool }}
   steps:
-    - task: AzureCLI@1
-      displayName: 'Create PR'
-      inputs:
-        azureSubscription: $(AZURE_SDK_INFRA_SUB_CONNECTED_SERVICE)
-        scriptLocation: inlineScript
-        inlineScript: |
+    - bash: |
           set -ev
           # git config
           if [[ -n "$(CUSTOM_REPO)" && -n "$(CUSTOM_BRANCH)" && -n "$(CUSTOM_GITHUB_TOKEN)" ]]; then

src/azure-cli-core/azure/cli/core/_profile.py

@@ -152,7 +152,7 @@ def login(self,
               allow_no_subscriptions=False,
               use_cert_sn_issuer=None,
               show_progress=False,
-              **kwargs):
+              claims_challenge=None):
         """
         For service principal, `password` is a dict returned by ServicePrincipalAuth.build_credential
         """
@@ -172,12 +172,12 @@ def login(self,
                 use_device_code = True
 
             if use_device_code:
-                user_identity = identity.login_with_device_code(scopes=scopes, **kwargs)
+                user_identity = identity.login_with_device_code(scopes=scopes)
             else:
-                user_identity = identity.login_with_auth_code(scopes=scopes, **kwargs)
+                user_identity = identity.login_with_auth_code(scopes=scopes, claims_challenge=claims_challenge)
         else:
             if not is_service_principal:
-                user_identity = identity.login_with_username_password(username, password, scopes=scopes, **kwargs)
+                user_identity = identity.login_with_username_password(username, password, scopes=scopes)
             else:
                 identity.login_with_service_principal(username, password, scopes=scopes)
 

src/azure-cli-core/azure/cli/core/auth/identity.py

@@ -145,7 +145,7 @@ def _service_principal_store(self):
             Identity._service_principal_store_instance = ServicePrincipalStore(store)
         return Identity._service_principal_store_instance
 
-    def login_with_auth_code(self, scopes, **kwargs):
+    def login_with_auth_code(self, scopes, claims_challenge=None):
         # Emit a warning to inform that a browser is opened.
         # Only show the path part of the URL and hide the query string.
 
@@ -168,21 +168,21 @@ def _prompt_launching_ui(ui=None, **_):
             success_template=success_template, error_template=error_template,
             parent_window_handle=self._msal_app.CONSOLE_WINDOW_HANDLE, on_before_launching_ui=_prompt_launching_ui,
             enable_msa_passthrough=True,
-            **kwargs)
+            claims_challenge=claims_challenge)
         return check_result(result)
 
-    def login_with_device_code(self, scopes, **kwargs):
-        flow = self._msal_app.initiate_device_flow(scopes, **kwargs)
+    def login_with_device_code(self, scopes):
+        flow = self._msal_app.initiate_device_flow(scopes)
         if "user_code" not in flow:
             raise ValueError(
                 "Fail to create device flow. Err: %s" % json.dumps(flow, indent=4))
         from azure.cli.core.style import print_styled_text, Style
         print_styled_text((Style.WARNING, flow["message"]), file=sys.stderr)
-        result = self._msal_app.acquire_token_by_device_flow(flow, **kwargs)  # By default it will block
+        result = self._msal_app.acquire_token_by_device_flow(flow)  # By default it will block
         return check_result(result)
 
-    def login_with_username_password(self, username, password, scopes, **kwargs):
-        result = self._msal_app.acquire_token_by_username_password(username, password, scopes, **kwargs)
+    def login_with_username_password(self, username, password, scopes):
+        result = self._msal_app.acquire_token_by_username_password(username, password, scopes)
         return check_result(result)
 
     def login_with_service_principal(self, client_id, credential, scopes):

src/azure-cli-core/azure/cli/core/auth/msal_credentials.py

@@ -51,15 +51,15 @@ def acquire_token(self, scopes, claims_challenge=None, **kwargs):
                      scopes, claims_challenge, kwargs)
 
         if claims_challenge:
-            logger.warning('Acquiring new access token silently for tenant %s with claims challenge: %s',
-                           self._msal_app.authority.tenant, claims_challenge)
+            logger.info('Acquiring new access token silently with claims challenge: %s', claims_challenge)
         result = self._msal_app.acquire_token_silent_with_error(
             scopes, self._account, claims_challenge=claims_challenge, **kwargs)
 
         from azure.cli.core.azclierror import AuthenticationError
         try:
             # Check if an access token is returned.
-            check_result(result, scopes=scopes, claims_challenge=claims_challenge)
+            check_result(result, tenant=self._msal_app.authority.tenant, scopes=scopes,
+                         claims_challenge=claims_challenge)
         except AuthenticationError as ex:
             # For VM SSH ('data' is passed), if getting access token fails because
             # Conditional Access MFA step-up or compliance check is required, re-launch

src/azure-cli-core/azure/cli/core/auth/tests/test_util.py

@@ -54,9 +54,29 @@ def test_generate_login_command(self):
         # No parameter is given
         assert _generate_login_command() == 'az login'
 
-        # scopes
+        # tenant
+        actual = _generate_login_command(tenant='21987a97-4e85-47c5-9a13-9dc3e11b2a9a')
+        assert actual == 'az login --tenant "21987a97-4e85-47c5-9a13-9dc3e11b2a9a"'
+
+        # scope
         actual = _generate_login_command(scopes=["https://management.core.windows.net//.default"])
-        assert actual == 'az login --scope https://management.core.windows.net//.default'
+        assert actual == 'az login --scope "https://management.core.windows.net//.default"'
+
+        # tenant and scopes
+        actual = _generate_login_command(tenant='21987a97-4e85-47c5-9a13-9dc3e11b2a9a',
+                                         scopes=["https://management.core.windows.net//.default"])
+        assert actual == ('az login --tenant "21987a97-4e85-47c5-9a13-9dc3e11b2a9a" '
+                          '--scope "https://management.core.windows.net//.default"')
+
+        # tenant, scopes and claims_challenge
+        actual = _generate_login_command(
+            tenant='21987a97-4e85-47c5-9a13-9dc3e11b2a9a',
+            scopes=["https://management.core.windows.net//.default"],
+            claims_challenge='{"access_token":{"acrs":{"essential":true,"values":["p1"]}}}')
+        assert actual == ('az logout\n'
+                          'az login --tenant "21987a97-4e85-47c5-9a13-9dc3e11b2a9a" '
+                          '--scope "https://management.core.windows.net//.default" '
+                          '--claims-challenge "eyJhY2Nlc3NfdG9rZW4iOnsiYWNycyI6eyJlc3NlbnRpYWwiOnRydWUsInZhbHVlcyI6WyJwMSJdfX19"')
 
 
 if __name__ == '__main__':