[Feature Request] Show object ID of the signed in account
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Context
Currently, in order to get the object ID of the signed in account, we have to query Microsoft Graph API:
- User account: `az ad signed-in-user show`
- Service principal account: `az ad sp show`
However, since some tenant (including Microsoft tenant) has Conditional Access policies that block accessing Microsoft Graph with device code (https://github.com/Azure/azure-cli/issues/22629), querying Microsoft Graph API is no longer possible with device code.
## Proposed solutions
The result of
- `az login`
- `az account show`
- `az account list`
can show the object ID decoded from the access token.
We can also add a `--show-claims` parameter to `az account get-access-token`:
```
az account get-access-token --show-claims
```
to decode the access token and show its claims, but his solution is less intuitive.
## Manual solution
Object ID can be manually retrieved from the access token:
```sh
pip3 install --upgrade pyjwt
az account get-access-token --query accessToken --output tsv |
tr -d '\n' |
python3 -c "import jwt, sys; print(jwt.decode(sys.stdin.read(), algorithms=['RS256'], options={'verify_signature': False})['oid'])"
```
Contributor guide
Assessment
This issue has not been assessed yet.