auth: trim trailing slash from LoginEndpoint in tokenEndpoint

[randomnote1]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

When custom cloud (AGC) metadata discovery returns a login endpoint with a trailing slash (e.g., https://login.microsoftonline.<suffix>/), the tokenEndpoint function in sdk/auth/client_credentials.go constructs a token URL with a double slash before the tenant ID:

https://login.microsoftonline.<suffix>//<tenant-id>/oauth2/v2.0/token

This causes client certificate authentication to fail because the signed JWT assertion uses the malformed URL as the aud claim, which does not match the canonical realm issuer. The token service rejects the request with:

AADSTS700023: Client assertion audience claim does not match Realm issuer

Client secret authentication is unaffected because it does not use the token URL as an audience claim.

Fix

Apply strings.TrimRight to normalize endpoint.LoginEndpoint before constructing the token URL:

return fmt.Sprintf("%s/%s/oauth2/v2.0/token", strings.TrimRight(endpoint.LoginEndpoint, "/"), tenant)

This is a single-line change. The strings package was already imported in the file.

Tests

Added two integration tests in sdk/auth/token_endpoint_test.go that exercise the full authorizer flow with a trailing-slash login endpoint:

• TestClientCertificateAuthorizer_TrailingSlashLoginEndpoint
• TestClientSecretAuthorizer_TrailingSlashLoginEndpoint

Both tests use the existing AzureADAccessTokenMockClient, whose path regex inherently validates that the constructed URL does not contain a double slash.

This is a (please select all that apply):

• Bug Fix
• New Feature
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #1329

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the provider.

Changes to Security Controls

No changes to security controls. This change normalizes URL path construction only.

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

[hashicorp-cla-app]

All committers have signed the CLA.