[SSH] SSH extension should remove the usage of get_msal_token

[jiasli]

Extension name (the extension in question)

SSH

Description of issue (in as much detail as possible)

In the old ADAL-based Azure CLI, no interface is provided to pass data to ADAL and AAD to get an SSH cert. None of these methods can do this:

• Profile.get_raw_token
• AdalAuthentication.signed_session
• AdalAuthentication.get_token

That's why Profile.get_msal_token is introduced (Azure/azure-cli#12999) to send data to MSAL and AAD.

Now in the new beta MSAL-based Azure CLI, Profile.get_login_credentials returns a CredentialAdaptor which is compatible with Track 2 SDK's TokenCredential.

SSH extension should detect the CLI version or other field added in the future whether the underlying auth library is MSAL. If so, it should call Profile.get_login_credentials and call get_token on the returned credential instead of calling Profile.get_msal_token:

azure-cli-extensions/src/ssh/azext_ssh/custom.py

Line 58 in ecaacbb

_, certificate = profile.get_msal_token(scopes, data)

which will be deprecated in the GA release of MSAL-based Azure CLI.

[yonzhan]

SSH

[jiasli]

+ @N6UDP who contributed #2921.

[N6UDP]

Fixed as part of #3698 - additional detection may be done in the future.

[jiasli]

I will revisit this part when MSAL integration stabilizes.

[jiasli]

MSAL-based Azure CLI 2.30.0 has been released on November 02, 2021: https://docs.microsoft.com/en-us/cli/azure/release-notes-azure-cli#november-02-2021

The old ssh extension now fails with

AttributeError: 'Profile' object has no attribute 'get_msal_token'

To solve it, please update ssh extension to the latest version 1.8.0 with:

az extension update --name ssh