Entra access token authentication policies such as BearerTokenAuthenticationPolicy should respect refresh_on information

[christothes]

Long lived credentials such as those received from managed identity authentication include additional metadata concerning when a token can/should be refreshed. Our authentication policies should take this information into account when refreshing access tokens.

This involves:

• Modifying relevant authentication policies
• Modifying the AccessToken type to include this optional information
• Modifying Azure.Identity credential implementations to populate the refresh_on information in the AccessToken

[joshfree]

Related

Azure/azure-sdk-for-java#40027

Azure/azure-sdk-for-python#35473

Azure/azure-sdk-for-js#29576

#22837

Azure/azure-sdk-for-cpp#5598

Azure/azure-sdk-for-rust#1657

[chlowell]

Blocked on AzureAD/microsoft-authentication-library-for-go#239

[chlowell]

🤔 on second thought I believe the only change we need from MSAL is to expose any refresh_in value provided by the STS. Everything else should be feasible in azidentity/azcore. And I can imagine a hacky way to get refresh_in without MSAL's help.

[chlowell]

On third thought, this is blocked because MSAL's token cache has a hardcoded expiration time preventing us from acquiring a new token when a cached one has at least 5 minutes left to expiry.