az login with EC cert fails

[Jamesits]

Describe the bug

az login with a EC certificate fails.

Related command

az login

Errors

The command failed with an unexpected error. Here is the traceback:
ECPrivateKey.sign() takes 2 positional arguments but 3 were given
Traceback (most recent call last):
  File "/opt/azure-cli/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 666, in execute
    raise ex
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 733, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 703, in _run_job
    result = cmd_copy(params)
             ^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
    return op(**command_args)
           ^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/command_modules/profile/custom.py", line 165, in login
    subscriptions = profile.login(
                    ^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/_profile.py", line 181, in login
    identity.login_with_service_principal(username, password, scopes=scopes)
  File "/opt/azure-cli/lib/python3.12/site-packages/azure/cli/core/auth/identity.py", line 197, in login_with_service_principal
    result = cca.acquire_token_for_client(scopes)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/application.py", line 2339, in acquire_token_for_client
    return _clean_up(self._acquire_token_silent_with_error(
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/application.py", line 1439, in _acquire_token_silent_with_error
    result = self._acquire_token_silent_from_cache_and_possibly_refresh_it(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/application.py", line 1580, in _acquire_token_silent_from_cache_and_possibly_refresh_it
    result = self._acquire_token_for_client(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/application.py", line 2358, in _acquire_token_for_client
    response = client.obtain_token_for_client(
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/oauth2.py", line 757, in obtain_token_for_client
    return self._obtain_token("client_credentials", data=data, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/oidc.py", line 170, in _obtain_token
    ret = super(Client, self)._obtain_token(grant_type, *args, **kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/oauth2.py", line 776, in _obtain_token
    resp = super(Client, self)._obtain_token(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/oauth2.py", line 202, in _obtain_token
    self.client_assertion()  # Do lazy on-the-fly computation
    ^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/assertion.py", line 63, in __call__
    self._buf = {VALUE: self._factory(), EXPIRES_AT: now + self._expires_in}
                        ^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/assertion.py", line 42, in <lambda>
    self.create_normal_assertion(a, i, s, expires_in=e, **kwargs),
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/msal/oauth2cli/assertion.py", line 122, in create_normal_assertion
    str_or_bytes = jwt.encode(  # PyJWT 1 returns bytes, PyJWT 2 returns str
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/jwt/api_jwt.py", line 64, in encode
    return api_jws.encode(json_payload, key, algorithm, headers, json_encoder)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/jwt/api_jws.py", line 134, in encode
    signature = alg_obj.sign(signing_input, key)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/azure-cli/lib/python3.12/site-packages/jwt/algorithms.py", line 373, in sign
    return key.sign(msg, padding.PKCS1v15(), self.hash_alg())
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: ECPrivateKey.sign() takes 2 positional arguments but 3 were given
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues                                                                     

Issue script & Debug output

N/A

Expected behavior

The command should succeed

Environment Summary

azure-cli 2.65.0

core 2.65.0
telemetry 1.1.0

Extensions:
aks-preview 9.0.0b8

Dependencies:
msal 1.31.0
azure-mgmt-resource 23.1.1

Python location '/opt/azure-cli/bin/python'
Extensions directory '/home/james/.azure/cliextensions'

Python (Linux) 3.12.7 (main, Oct 1 2024, 11:15:50) [GCC 14.2.1 20240910]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

Reproduction:

Create the cert:

openssl ecparam -out test.key -name prime256v1 -genkey
openssl req -new -key test.key -x509 -nodes -days 720 -out test.crt
cat test.crt test.key > test-full.crt

Create the AAD application:

resource "azuread_application" "test" {
  display_name = "test"
}

resource "azuread_service_principal" "test" {
  client_id = azuread_application.test.client_id
  tags = [
    "AppServiceIntegratedApp",
    "WindowsAzureActiveDirectoryIntegratedApp",
    "HideApp",
  ]
  app_role_assignment_required = true
}

resource "azuread_application_certificate" "test" {
  application_id = azuread_application.test.id
  type           = "AsymmetricX509Cert"
  value          = file("test.crt")
}

Trigger the bug:

az login --service-principal --tenant <tenant id> --username <client id> --password test-full.crt

[yonzhan]

Thank you for opening this issue, we will look into it.

[dsiddy]

Not entirely sure, but I suspect that https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/msal/oauth2cli/assertion.py#L126 is the culprit. I encountered a similar TypeError: ECPrivateKey.sign() takes 2 positional arguments but 3 were given message, but mine also included the pip install cryptography exception message shown in assertion.py. (Edit: That's the smoke, not the fire. I'm continuing to investigate; will post an update when I have one.)

[jiasli]

I don't think MSAL even supports ES* algorithms:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/7b3175631c03c5b5476aaf29239c31878ab80b23/msal/application.py#L817-L826

                if sha256_thumbprint and not authority.is_adfs:
                    assertion_params = {
                        "algorithm": "PS256", "sha256_thumbprint": sha256_thumbprint,
                    }
                else:  # Fall back
                    if not sha1_thumbprint:
                        raise ValueError("You shall provide a thumbprint in SHA1.")
                    assertion_params = {
                        "algorithm": "RS256", "sha1_thumbprint": sha1_thumbprint,
                    }

test-full.crt generated by openssl ecparam contains:

$ cat test-full.crt
-----BEGIN CERTIFICATE-----
MIIB3zCCAYWgAwIBAgIUDZgklZlr2K+oCkHj0+AUVmFrl7swCgYIKoZIzj0EAwIw
RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu
dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNTAxMDMwODE2NDJaFw0yNjEyMjQw
ODE2NDJaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD
VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjO
PQMBBwNCAAREadRkeNWtq5uoo1uSEeusSX7IeOmg1+z94z+z94WLMY0KkKUkrjhL
qpjCOd440fNegVQzX2FLT5r76UVR48lFo1MwUTAdBgNVHQ4EFgQUJBie3JYbA7lY
YdzjGaNq/nkBql4wHwYDVR0jBBgwFoAUJBie3JYbA7lYYdzjGaNq/nkBql4wDwYD
VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiBDm01+IsouzRx7uDuVEkGD
WrzOHhaleTPzpI0EBq1fkAIhALZO8xV1e9i4yiRyyaNlz1/HpmJqeTCkU9IaoSD9
/ANU
-----END CERTIFICATE-----
-----BEGIN EC PARAMETERS-----
BggqhkjOPQMBBw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIOJZj1gVTZ6F3LkDAnO74YZva9/M1K1saKFxXNXRObq7oAoGCCqGSM49
AwEHoUQDQgAERGnUZHjVraubqKNbkhHrrEl+yHjpoNfs/eM/s/eFizGNCpClJK44
S6qYwjneONHzXoFUM19hS0+a++lFUePJRQ==
-----END EC PRIVATE KEY-----

This is not a format Azure CLI supports. Azure CLI currently only supports RSA certificate and private key in the form of

-----BEGIN PRIVATE KEY-----
MIIEvQ...
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIICoT...
-----END CERTIFICATE-----