Support authnscheme in AcquireTokenByUsernamePassword flow

rharpavat commented 5 months ago

What is the change?

Adds support for authnScheme in AcquireTokenByUsernamePassword flow.

Currently, automated testing for AzRBAC and PoP token flow relies on SPN login, which uses the msal confidential client. However, most customers will be using the interactive login flow which uses msal's public client. In order to enable better testing of the customer scenario, this change enables PoP token support for username/password flow so that automated testing can be conducted for the public client.

How was the change tested?

Vendored this commit on msal into my local branch of kubelogin. Was able to successfully build kubelogin and get a PoP token using ropc (username/password flow):

./kubelogin get-token -l ropc --client-id <clientid> --server-id <serverid> --tenant-id <msft-tenant-id> --username k8connectsa@microsoft.com --password <redacted> --pop-enabled --pop-claims "u=/subscriptions/91d1cf86-13c9-4318-b47a-e536e3533061/resourceGroups/rharpavat-test/providers/Microsoft.Kubernetes/connectedClusters/e2et1"

Outputted token is in correct format:

{
  "typ": "pop",
  "alg": "RS256",
  "kid": "<kid>"
}.{
  "at": "<redacted>",
  "ts": 1707327222,
  "u": "/subscriptions/91d1cf86-13c9-4318-b47a-e536e3533061/resourceGroups/rharpavat-test/providers/Microsoft.Kubernetes/connectedClusters/e2et1",
  "cnf": {
    "jwk": {
      "e": "AQAB",
      "kty": "RSA",
      "n": "<n>",
      "alg": "RS256",
      "kid": "<kid>"
    }
  },
  "nonce": "014adc9d8a974430b6f5200e6801026f"
}.[Signature]