[Identity] Azure Identity should expose the original MSAL error

Is your feature request related to a problem? Please describe.

When AuthenticationRequiredError is raised, the original MSAL result (error dict) is discarded:

https://github.com/Azure/azure-sdk-for-python/blob/ef46a5c14a3c49c040a124d9c626c77cf2964cdc/sdk/identity/azure-identity/azure/identity/_internal/interactive.py#L198-L202

This makes aad_exception_handler (https://github.com/Azure/azure-cli/pull/17072) impossible to handle MSAL error directly.

Describe the solution you’d like

AuthenticationRequiredError should have an attribute referring to the original MSAL result.

[rayluo]

If MSAL raised an Exception instead of an error dict, we would be supposed to use Exception Chaining

From MSAL’s perspective, an error response is equally likely as a successful response, so the return value is a dict in both cases. But feel free to wrap it inside an exception as you see fit.

By the way, that Exception Chaining was introduced since Python 3.3. This might not be a problem for Azure CLI as an application, but historically Azure Identity and MSAL work with Python 2.7 too.

specify a smaller subset of those raw fields

Maybe we can start with error and error_description, which are mentioned in the OAuth2 specs. I don’t see them going away in the future. The correlation_id is an AAD practice that could also be helpful during troubleshooting, if the customer does not have other ways to obtain it.

[chlowell]

As discussed offline, I’ve opened a PR to address this by attaching Azure AD’s HTTP response to authentication exceptions whenever possible. That will provide all the information returned by MSAL after an auth failure while remaining consistent with exceptions raised by credentials that do not use MSAL.