Support multi-tenant switching for Data Plane RBAC

src/Contracts/ViewModels.ts

@@ -382,6 +382,8 @@ export interface DataExplorerInputsFrame {
   databaseAccount: any;
   subscriptionId?: string;
   resourceGroup?: string;
+  tenantId?: string;
+  userName?: string;
   masterKey?: string;
   hasWriteAccess?: boolean;
   authorizationToken?: string;

src/UserContext.ts

@@ -74,6 +74,8 @@ export interface UserContext {
   readonly authType?: AuthType;
   readonly masterKey?: string;
   readonly subscriptionId?: string;
+  readonly tenantId?: string;
+  readonly userName?: string;
   readonly resourceGroup?: string;
   readonly databaseAccount?: DatabaseAccount;
   readonly endpoint?: string;

src/Utils/AuthorizationUtils.ts

@@ -91,7 +91,8 @@ export async function acquireMsalTokenForAccount(
     // This will eventually throw InteractionRequiredAuthError if silent is true, we won't handle it here.
     const loginRequest = {
       scopes: [hrefEndpoint],
-      loginHint: user_hint,
+      loginHint: user_hint ?? userContext.userName,
+      authority: userContext.tenantId ? `${configContext.AAD_ENDPOINT}${userContext.tenantId}` : undefined,
     };
     try {
       if (silent) {
@@ -132,7 +133,8 @@ export async function acquireMsalTokenForAccount(
     account: msalAccount || null,
     forceRefresh: true,
     scopes: [hrefEndpoint],
-    authority: `${configContext.AAD_ENDPOINT}${msalAccount.tenantId}`,
+    loginHint: user_hint ?? userContext.userName,
+    authority: `${configContext.AAD_ENDPOINT}${userContext.tenantId ?? msalAccount.tenantId}`,
   };
   return acquireTokenWithMsal(msalInstance, tokenRequest, silent);
 }

src/hooks/useKnockoutExplorer.ts

@@ -694,6 +694,8 @@ function updateContextsFromPortalMessage(inputs: DataExplorerInputsFrame) {
     resourceGroup: inputs.resourceGroup,
     subscriptionId: inputs.subscriptionId,
     subscriptionType: inputs.subscriptionType,
+    tenantId: inputs.tenantId,
+    userName: inputs.userName,
     quotaId: inputs.quotaId,
     portalEnv: inputs.serverId as PortalEnv,
     hasWriteAccess: inputs.hasWriteAccess ?? true,