Implementing known_authority_hosts

[rayluo]

Implementing the known_authorities behaviors based on the internal design.

The unit tests of this PR is almost as readable as plain English, and are considered as generic acceptance tests for this feature.

This PR also contains the "api reference documentation" for the newly introduced known_authority_hosts parameter.

When merged, this PR will close this internal workitem.

---

This entire PR has been shelved, because later we discovered some new requirements for Azure Stack scenarios (internal link), so we proceeded with #496.

[sameerag]

Added a few comments but looks good.

[jiasli]

Azure CLI never used validate_authority and everything works fine. Per our observation, all Azure Stack environments utilizing ADFS have the /adfs postfix in their authentication endpoint URL, which makes MSAL bypass authority verification:

microsoft-authentication-library-for-python/msal/authority.py

Line 78 in c9a36e9

if (tenant != "adfs" and (not self._is_b2c) and self._validate_authority

For example, to verify with redmond Azure Stack environment:

az cloud register -n redmond --endpoint-resource-manager "https://management.redmond.azurestack.corp.microsoft.com/"
az cloud set -n redmond --profile 2019-03-01-hybrid
az login

az cloud register queries https://management.redmond.azurestack.corp.microsoft.com/metadata/endpoints?api-version=2019-05-01 for endpoints and authentication endpoint is https://adfs.redmond.azurestack.corp.microsoft.com/adfs.

[chlowell]

Is it expected in this case that get_accounts() does instance discovery? That is to say, ClientApplication() doesn't call known_to_microsoft_validation but get_accounts() does.

[rayluo]

The answer is two-fold.

• The "validating whether an input authority looks legit" and "getting some metadata for alias grouping" are two different things. This test case, as described in line 141, made a point that one does not necessarily turn off the other. In this case, ClientApplication() skips validation, but get_accounts() would like to know alias groups.
• The actual timing of when to send out the metadata call, is an implementation detail. Since MSAL Python delays that metadata call to get_accounts(), so this test case is written this way. Your MSAL's implementation does not have to call get_accounts().

Last but not least, this entire PR has been shelved, because later we discovered some new requirements for Azure Stack scenarios (internal link), so we proceeded with #496.

[rayluo]

Closing this without merging, because we ended up going with #496