Azure / Azure/azure-cli

Share Azure CLI's MSAL token cache with Azure Identity

Open
#23,911 1 comment 2 reactions 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad Auto-Assign feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az login`

**Is your feature request related to a problem? Please describe.**
I'm using `AzureCliCredential` from Azure Identity as one of multiple authentication methods for a CLI. It is calling `az account get-access-token` in a subprocess, which is rather slow, even if we cache the returned token in memory. This slowness is annoying when the user is executing commands frequently.

**Describe the solution you'd like**
Azure CLI uses a dedicated MSAL token cache which is persisted at `~/.azure/msal_token_cache.bin` or `~/.azure/msal_token_cache.json`, which is not supposed to be read by other programs.

Azure CLI can save its MSAL token cache to `%LOCALAPPDATA%\.IdentityService\msal.cache` (Windows) `~/.IdentityService/msal.cache` (Linux, MacOS) so that `SharedTokenCacheCredential` can read from it:

https://github.com/Azure/azure-sdk-for-python/blob/47108e9251cd706f48bea359a388b6c8fd161faf/sdk/identity/azure-identity/azure/identity/_persistent_cache.py#L77-L92

The disadvantage is that Azure CLI's MSAL cache can easily be changed or corrupted without Azure CLI's notice. Handling that will be very difficult.

**Describe alternatives you've considered**
`SharedTokenCacheCredential` can take `~/.azure/msal_token_cache.bin` as input.

**Additional context**
Related:

- https://github.com/Azure/azure-cli/issues/16460

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.