CLI managed identity authentication does not work with non-IMDS token endpoints or sytem-assigned managed identities #511

devtunnel user login allows managed identity authentication using --mi-client-id, --mi-object-id or --mi-resource-id. The implementation in Microsoft.DevTunnels.Cli.Authentication.ManagedIdentityApp.AcquireTokenAsync tries to acquire an access token from the IMDS managed identity token endpoint http://169.254.169.254/metadata/identity/oauth2/token with the Metadata header.

This does not work with hosting platforms that expose managed identities on a different endpoint. For example Managed identities in Azure Container Apps expose the token endpoint at an endpoint defined in the environment variable IDENTITY_ENDPOINT, in practice this is always http://localhost:42356/msi/token. ACA also requires a x-identity-header with the value of the IDENTITY_HEADER environment variable.

This also does not work for system-assigned managed identities which require the object_id/client_id/msi_res_id parameters to be omitted.

Consider support for authenticating using managed identity on platforms with non-IMDS managed identity token endpoints.