Support CLI Auth Scoping

[syepes]

The CLI Auth method does not correctly handle getting the token with the adequate scope.

When authenticated with the CLI the current token does not allow reading the vault secrets as its not correctly scoped, it generates the following error when trying to get the secrets:

WARN: AKV10022: Invalid audience. Expected https://vault.azure.net, found: https://management.core.windows.net/.

After troubleshooting this issue I found that the get_access_token method would need to handle scoping so the token is generated for the needed API call.

Small hack: Note this fixes the armrest secret show command but breaks the rest as the token is no longer valid for other API calls like resource creation...

armrest/lib/armrest/api/auth/cli.rb

Line 28 in 80d2d88

command = "az account get-access-token -o json"

Add this just after the above line:

if ENV['ARMREST_VAULT'] || ENV['ARM_VAULT']
  command = command + ' --scope "https://vault.azure.net/.default"'
end