[Bastion] Fix native-client token authentication across tenants

[Patrick W. Healy (phealy)]

Bastion native-client connections can obtain an Azure token from the default subscription's tenant even when the Bastion ARM ID selects a subscription in another tenant. Authentication failures then appear as SSH/RDP timeouts.

Scope token acquisition to the subscription parsed from the resolved Bastion ARM ID for tunnels, Developer SKU connection discovery, and gateway RDP. Check credentials before starting tunnel workers, report HTTP authentication failures clearly, close failed client connections, and remove token-bearing debug output. Target VM IDs do not override the Bastion authentication context.

Bump Bastion to patch release 1.4.4 and add the corresponding HISTORY.rst entry. Leave src/index.json to the publish pipeline.

Validation:

• azdev style bastion: Pylint and Flake8 passed.
• python scripts/ci/test_index.py -q: passed (9 tests, 2 skipped).
• Bastion authentication unit regressions: all 14 passed.
• git diff --check: passed.
• A locally built extension was exercised in WSL using a Bastion ARM ID with SSH-key authentication and an IP target: the ARM lookup and token request returned HTTP 200, the WebSocket connected, and bidirectional traffic flowed. The current default subscription and Bastion subscription were confirmed to belong to different tenants.

AAD SSH certificate acquisition is a separate flow and is not changed here.

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az network bastion ssh, az network bastion rdp, az network bastion tunnel

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

N/A: this modifies an existing extension.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[Copilot]

Copilot review overview

🟡 Changes recommended

The extension version and release history must be updated so users can receive the fix.

Review effort: Balanced
Findings: 1

Open (1)

• Bump package version for runtime fix release · New

What changed in this PR

Scopes Bastion native-client authentication to the Bastion subscription and improves failure handling.

Changes:

• Acquires tokens using the Bastion ARM ID’s subscription.
• Improves HTTP errors and client cleanup.
• Adds cross-tenant authentication regression tests.

File	Description
custom.py	Scopes tunnel and gateway RDP credentials.
developer_sku_helper.py	Scopes Developer SKU tokens and handles HTTP failures.
tunnel.py	Scopes tunnel tokens and improves cleanup/errors.
test_bastion_auth.py	Adds authentication regression coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

Bastion