Azure / Azure/azure-cli

`az keyvault secret list` hangs in AzureUSGovernment cloud

Open
#24,558 1 comment 0 reactions 1 assignee Claimed by @evelyn-ys View on GitHub
act-identity-squad Auto-Assign Azure CLI Team feature-request KeyVault
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az keyvault secret list`

**Describe the bug**

When running `az keyvault secret list` in AzureUSGovernment cloud, the `--debug` log shows it hangs at

```
urllib3.connectionpool: Starting new HTTPS connection (1): login.microsoftonline.com:443
```

I am able to pin down this request to MSAL’s this line:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/fc3f39f9deecc2cbb9c3c5e46023a527835beaaf/msal/application.py#L1057-L1059

```py
def _get_authority_aliases(self, instance):
if not self.authority_groups:
resp = self.http_client.get(
"https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/common/oauth2/authorize",
headers={'Accept': 'application/json'})
```

`_get_authority_aliases` is unconditionally called by [`acquire_token_silent_with_error`](https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/789342c4bc57f80314a83662af614f6f02a207d0/msal/application.py#L1238), which is called when Azure CLI tries to get an access token for a scope other than ARM.

`authority_groups` is then populated from the result of this HTTP request. When MSAL gets access token from token cache, it checks if there is an existing access token issued to current authority’ aliases.

Since `https://login.microsoftonline.com/` is blocked in isolated environments, MSAL hangs.

**Additional context**
https://portal.microsofticm.com/imp/v3/incidents/details/334661425/home

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.