Get JWT token from AzureAD v2.0 endpoint about kubelogin

[weinong]

@sleterrier did you try -l interactive?

[weinong]

@sleterrier You are good now, right? please reopen for follow up

[bcho]

Just to confirm, are you using device code authentication in this case?

[sleterrier]

That is correct. Using distinct --server-id and client-id if that also matters (with clientApp granted user_impersonation permission on serverApp).

[bcho]

I guess the culprit is kube-login is using adal SDK here:

kubelogin/pkg/token/devicecode.go

Lines 39 to 44 in e5dd891

	emptyToken := adal.Token{}
	client := &autorest.Client{}
	deviceCode, err := adal.InitiateDeviceAuth(client, p.oAuthConfig, p.clientID, p.resourceID)
	if err != nil {
	return emptyToken, fmt.Errorf("initialing the device code authentication: %s", err)
	}

We might need to update the SDK to make it support the v2 endpoint. But not sure the back compatibility here. Will discuss more with my team mate on this.

[sleterrier]

Thank you for looking into this @bcho, much appreciated ❤️

[sleterrier]

@weinong I had not, but confirm it allows azure-kubelogin to get tokens from the v2 endpoint! Thank you 🎉

Here are some details others might find useful:

• kubelogin get-token \
  --environment AzureUSGovernmentCloud \
  --server-id <server-app-id> \
  --client-id <client-app-id> \
  --tenant-id <tenant-id> \
  --login interactive
  

• Despite successful in-browser authentication, my initial attempts were failing with:

  Error: failed to get token: expected an empty error but received: InteractiveBrowserCredential authentication failed
  POST https://login.microsoftonline.us/<tenant-id>/oauth2/v2.0/token
  --------------------------------------------------------------------------------
  RESPONSE 401 Unauthorized
  --------------------------------------------------------------------------------
  {
    "error": "invalid_client",
    "error_description": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.",
    "error_codes": [
      7000218
    ],
    "timestamp": "2023-08-29 02:59:54Z",
    "trace_id": "obfuscated",
    "correlation_id": "obfuscated",
    "error_uri": "https://login.microsoftonline.us/error?code=7000218",
    "claims": "{\"access_token\":{\"capolids\":{\"essential\":true,\"values\":[\"obfuscated\"]}}}"
  

• Which was due to an incorrect platform configuration on <client-app-id>. See MicrosoftDocs/azure-docs#61446 for details, TLDR: Mobile and Desktop applications is needed, not Web.