[Profile] az account get-access-token: Show expiresOn for Managed Identity

[jiasli]

Description

Currently, az account get-access-token shows "expiresOn": "N/A" for Managed Identity:

> az login --identity
> az account get-access-token
{
  "accessToken": "eyJ0eXAi...",
  "expiresOn": "N/A",
  "subscription": "0b1f6471-1bf0-4dda-aec3-cb9272f09590",
  "tenant": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
  "tokenType": "Bearer"
}

It works for a user account:

> az login
> az account get-access-token
{
  "accessToken": "eyJ0eXAi...",
  "expiresOn": "2020-06-29 17:22:16.443545",
  "subscription": "a18897a6-7e44-457d-9260-f2854c0aca42",
  "tenant": "72f988bf-86f1-41af-91ab-2d7cd011db47",
  "tokenType": "Bearer"
}

This is because msrestazure.azure_active_directory.MSIAuthentication's token entry has expires_on, while ADAL's token entry has expiresOn.

This PRs fixes this by converting the epoch expires_on to ISO expiresOn:

> az account get-access-token
{
  "accessToken": "eyJ0eXAi...",
  "expiresOn": "2020-06-30 06:14:41.000000",
  "subscription": "0b1f6471-1bf0-4dda-aec3-cb9272f09590",
  "tenant": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
  "tokenType": "Bearer"
}

Testing Guide

az login --identity
az account get-access-token

More info

In fact, the REST call in ADAL for token retrieval is:

Request:

POST https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/token HTTP/1.1

Response:

{
    "token_type": "Bearer",
    "scope": "user_impersonation",
    "expires_in": "3595",
    "ext_expires_in": "3595",
    "expires_on": "1593413327",
    "not_before": "1593409427",
    "resource": "https://management.core.windows.net/",
    "access_token": "...",
    "refresh_token": "...",
    "foci": "1"
}

ADAL ignores expires_on, but calculates expiresOn based on the current time and expires_in.

https://github.com/AzureAD/azure-activedirectory-library-for-python/blob/6f0c4755658fbbacf50de684c16eb378d1dbfb92/adal/oauth2_client.py#L187

now = datetime.now()
soon = timedelta(seconds=expires_in)
wire_response[OAuth2.ResponseParameters.EXPIRES_ON] = str(now + soon)

This is why the microsecond 443545 appears in "expiresOn": "2020-06-29 17:22:16.443545", while expires_on is an integer 1593413327.

[yonzhan]

add to S172

[jiasli]

@yungezz @yonzhan , I am adding @qianwens as the code owner too.

[yonzhan]

LGTM

[arrownj]

LGTM

[yonzhan]

add to S172