Support Azure CLI login for AzureAD and Azure DevOps

[mbrancato]

Allows az login authentication to work even when the identity being used is not authorized to access any Azure resources.

Fixes #11846

[mbrancato]

Hi @bishal-pdMSFT, Can you please review and provide feedback on this small but impactful PR?

[bishal-pdMSFT]

Thanks @mbrancato for raising the PR. I will take a look by EOD today.

[bishal-pdMSFT]

@mbrancato one problem with this change is that in release editor, the "Azure subscription" drop down only lists the service connections which are scoped to subscription scope. Hence this change won't prove much useful.

[mbrancato]

Hi @bishal-pdMSFT - That may be only a problem with the "release editor". I don't know what that is and don't use this. When writing pipelines with YAML we may specify any service connection by name, and there seems to be no filtering except by type.

So while that may not be seen as a help here, if this change doesn't affect that workflow negatively, it still helps my workflow of using YAML pipelines.

I think the problem is I'm probably using the authentication from this task a bit more broadly than it was originally thought to serve. Specifically, I'm using this for infrastructure builds and we don't use "classic" release pipelines. But in many cases, my service principal does not have direct access to Azure, but it does have identity. And that is what we need, and identity we can validate of the pipeline.

[bishal-pdMSFT]

Yes, for yaml it should work fine.
I was talking about the legacy release pipeline. It has an editor experience where a service connection list of shown. This list is filtered to only show connections which has subscription scope. We can make additional changes to ensure that filtering does not happen.

[bishal-pdMSFT]

@mbrancato I have suggested a couple of more changes which will make it generic so that any ARM service connection scope can be used.

[bishal-pdMSFT]

@issacnitin can you please review this PR

[bishal-pdMSFT]

@mbrancato please update the patch version specified in task.json

[bishal-pdMSFT]

IMO if we remove this filter logic then the change will work even for legacy release editor. What do you think @issacnitin

[issacnitin]

IMO if we remove this filter logic then the change will work even for legacy release editor. What do you think @issacnitin

Yes, that should do it. We should rename the variables and text to say "Azure Service Connection"/"ARM Service Connection", since we're not tied down to subscriptions scoped SPN any more
@mbrancato please run

node make.js build --task AzureCLIV2

from the root of the repository once you've your changes made. Commit the generated files as well. We'll do testing from our side and check-in the PR

[bishal-pdMSFT]

Thanks @mbrancato this looks good to me.
There is one problem though - we are very close to next release of AzureDevOps server. Hence I want to be completely sure that we do not regress any behavior.
@mbrancato hence it would be great if you can try out the updated task and test some scenarios.
@issacnitin please do some testing from your side as well