{Core} Proof-of-Concept: Support OIDC token refreshing on GitHub Actions

[jiasli]

Fix https://github.com/Azure/azure-cli/issues/28708

Related command az login

Description MSAL reserved an undocumented interface which allows using a callback function to get client_assertion, instead of supplying a raw OIDC token.

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/a8476fbe665356aae60e65296337d9eff86d0d66/msal/oauth2cli/oauth2.py#L198-L201

            _data["client_assertion"] = encoder(
                self.client_assertion()  # Do lazy on-the-fly computation
                if callable(self.client_assertion) else self.client_assertion
                )

As a Proof-of-Concept, this PR uses this interface to achieve OIDC token refreshing.

Some interesting finds:

When a task is run on 2024-04-18 10:35:31, the ACTIONS_ID_TOKEN_REQUEST_TOKEN has below claims:

  "nbf": 1713435930,  // 2024-04-18 10:25:30
  "exp": 1713458730   // 2024-04-18 16:45:30

This means the token starts 10min before the task and expires after 6h10min. After the token expires, no ID token can be retrieved. Therefore, even if we can refresh ID token, the maximum execution time of a task is around 6h.

References:

• https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#requesting-the-jwt-using-environment-variables
• https://github.com/actions/toolkit/blob/5a736647a123ecf8582376bdaee833fbae5b3847/packages/core/src/oidc-utils.ts
• https://github.com/Azure/azure-cli/issues/28708#issuecomment-2049014471
• https://github.com/github/docs/issues/32573

Testing Guide [Only for development and debugging]

1. To get all environment variables on the agent, add this Bash command env | base64 to bypass GitHub Actions' credential redaction. Then decode it with VS Code.
2. You have to use sleep 1800 to keep the task alive, otherwise, the OIDC token request will be rejected after the task finishes.

[azure-client-tools-bot-prd[bot]]

️✔️AzureCLI-FullTest

️✔️acr

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️acs

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️advisor

️✔️latest

️✔️3.11

️✔️3.9

️✔️ams

️✔️latest

️✔️3.11

️✔️3.9

️✔️apim

️✔️latest

️✔️3.11

️✔️3.9

️✔️appconfig

️✔️latest

️✔️3.11

️✔️3.9

️✔️appservice

️✔️latest

️✔️3.11

️✔️3.9

️✔️aro

️✔️latest

️✔️3.11

️✔️3.9

️✔️backup

️✔️latest

️✔️3.11

️✔️3.9

️✔️batch

️✔️latest

️✔️3.11

️✔️3.9

️✔️batchai

️✔️latest

️✔️3.11

️✔️3.9

️✔️billing

️✔️latest

️✔️3.11

️✔️3.9

️✔️botservice

️✔️latest

️✔️3.11

️✔️3.9

️✔️cdn

️✔️latest

️✔️3.11

️✔️3.9

️✔️cloud

️✔️latest

️✔️3.11

️✔️3.9

️✔️cognitiveservices

️✔️latest

️✔️3.11

️✔️3.9

️✔️compute_recommender

️✔️latest

️✔️3.11

️✔️3.9

️✔️config

️✔️latest

️✔️3.11

️✔️3.9

️✔️configure

️✔️latest

️✔️3.11

️✔️3.9

️✔️consumption

️✔️latest

️✔️3.11

️✔️3.9

️✔️container

️✔️latest

️✔️3.11

️✔️3.9

️✔️containerapp

️✔️latest

️✔️3.11

️✔️3.9

️✔️core

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️cosmosdb

️✔️latest

️✔️3.11

️✔️3.9

️✔️databoxedge

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️dla

️✔️latest

️✔️3.11

️✔️3.9

️✔️dls

️✔️latest

️✔️3.11

️✔️3.9

️✔️dms

️✔️latest

️✔️3.11

️✔️3.9

️✔️eventgrid

️✔️latest

️✔️3.11

️✔️3.9

️✔️eventhubs

️✔️latest

️✔️3.11

️✔️3.9

️✔️feedback

️✔️latest

️✔️3.11

️✔️3.9

️✔️find

️✔️latest

️✔️3.11

️✔️3.9

️✔️hdinsight

️✔️latest

️✔️3.11

️✔️3.9

️✔️identity

️✔️latest

️✔️3.11

️✔️3.9

️✔️iot

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️keyvault

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️kusto

️✔️latest

️✔️3.11

️✔️3.9

️✔️lab

️✔️latest

️✔️3.11

️✔️3.9

️✔️managedservices

️✔️latest

️✔️3.11

️✔️3.9

️✔️maps

️✔️latest

️✔️3.11

️✔️3.9

️✔️marketplaceordering

️✔️latest

️✔️3.11

️✔️3.9

️✔️monitor

️✔️latest

️✔️3.11

️✔️3.9

️✔️mysql

️✔️latest

️✔️3.11

️✔️3.9

️✔️netappfiles

️✔️latest

️✔️3.11

️✔️3.9

️✔️network

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️policyinsights

️✔️latest

️✔️3.11

️✔️3.9

️✔️privatedns

️✔️latest

️✔️3.11

️✔️3.9

️✔️profile

️✔️latest

️✔️3.11

️✔️3.9

️✔️rdbms

️✔️latest

️✔️3.11

️✔️3.9

️✔️redis

️✔️latest

️✔️3.11

️✔️3.9

️✔️relay

️✔️latest

️✔️3.11

️✔️3.9

️✔️resource

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️role

️✔️latest

️✔️3.11

️✔️3.9

️✔️search

️✔️latest

️✔️3.11

️✔️3.9

️✔️security

️✔️latest

️✔️3.11

️✔️3.9

️✔️servicebus

️✔️latest

️✔️3.11

️✔️3.9

️✔️serviceconnector

️✔️latest

️✔️3.11

️✔️3.9

️✔️servicefabric

️✔️latest

️✔️3.11

️✔️3.9

️✔️signalr

️✔️latest

️✔️3.11

️✔️3.9

️✔️sql

️✔️latest

️✔️3.11

️✔️3.9

️✔️sqlvm

️✔️latest

️✔️3.11

️✔️3.9

️✔️storage

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️synapse

️✔️latest

️✔️3.11

️✔️3.9

️✔️telemetry

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

️✔️util

️✔️latest

️✔️3.11

️✔️3.9

️✔️vm

️✔️2018-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2019-03-01-hybrid

️✔️3.11

️✔️3.9

️✔️2020-09-01-hybrid

️✔️3.11

️✔️3.9

️✔️latest

️✔️3.11

️✔️3.9

[azure-client-tools-bot-prd[bot]]

Hi @jiasli, Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[azure-client-tools-bot-prd[bot]]

⚠️AzureCLI-BreakingChangeTest

⚠️profile

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	login	cmd login added parameter federated_identity

[yonzhan]

Support OIDC token refreshing on GitHub Actions