[Feature Request] Drop multi-account login
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Context
As @henrik-me pointed out, currently Azure CLI supports login with with multiple user or Service Principal accounts.
The authentication information is bound to the subscription:
```jsonc
> az account show
{
"environmentName": "AzureCloud",
"homeTenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
"id": "0b1f6471-1bf0-4dda-aec3-cb9272f09590",
"isDefault": true,
"managedByTenants": [
{
"tenantId": "2f4a9838-26b7-47ee-be60-ccc1fdec5953"
}
],
"name": "AzureSDKTest",
"state": "Enabled",
"tenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
"user": {
"name": "test@azuresdkteam.onmicrosoft.com", // User information is provided here
"type": "user"
}
}
```
If several user or Service Principal accounts have access to the same subscription, the subscription will be bound to the last account that logged in.
## Proposed solution
Drop multi-user login. The old user should be removed if `az login` is called.
## Reason
1. From a security perspective, it should be forbidden to login multiple accounts at the same time.
2. For [cross-tenant authentication](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/authenticate-multi-tenant), all access tokens must belong to the same user or Service Principal, so cross-tenant authentication is not affected:
> All the tokens must be from the same user or application.
3. Because only one account is permitted, `az login` can log out that account first before a new login, thus resolving https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/335#issuecomment-812302876 easily.
Contributor guide
Assessment
This issue has not been assessed yet.