Support for service principal authentication

[karolz-ms]

In order to use Docker CLI integration with ACI in CI/CD scenarios, docker login azure should support authentication using service principal name/password (a.k.a. application ID/secret).

Sample scenario (using Azure CLI): https://docs.microsoft.com/en-us/azure/container-instances/container-instances-github-action

This is how equivalent Azure CLI command looks like:

# Log in with a service principal using client secret. Use -p=secret if the first character of the password is '-'.
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com

I believe the relevant Azure Golang SDK method to get the token is acquireTokenClientSecretFlow: https://github.com/Azure/go-autorest/blob/master/autorest/adal/cmd/adal.go#L120

[chris-crone]

Thanks for raising this @karolz-ms! I've added it to our backlog.

[gtardif]

Thanks for the proposal. Actually we looked at Service provider login for our CI as well.
One issue I see at the moment for providing this to users is that login through this method, I get an access token (valid for 1h) but no refresh token. So unlike the classic login, where the token is refreshed automatically, here the user has a token valid for 1h, and then gets an error message saying he needs to login again.
Maybe I missed something when implementing this, we can investigate a bit more to defined what is the best solution to improve this, or if we are happy to provide this in the CLI knowing the token will expire and not automatically refresh in this case. (cc @nebuk89)

[gtardif]

Discussing this a bit further with @nebuk89, we'll include this in the CLI with the limitation that Service Principal login will obtain only an access token and no refresh token, the user will need to manually re-login when the token expires. This should not be an issue for CI use cases.
the CLI will provide: docker login azure --client-id xxx --client-secret yyy --tenant-id zzz

[karolz-ms]

Makes sense, thanks Guillaume! I found this doc, which suggests that client credentials flow can only produce an access token, and not a refresh token https://docs.microsoft.com/en-us/azure/active-directory/develop/security-tokens#how-each-flow-emits-tokens-and-codes

Like you said, this is sufficient for CI scenario

[gtardif]

Available since v0.1.12, using docker login azure --client-id xx --client-secret yy --tenant-id zz