Azure / Azure/azure-cli

Az cli does not refresh msgraph token cache

Open
#25,442 3 comments 1 reaction 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad Auto-Assign Azure CLI Team customer-reported feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Describe the bug

After having consented the service principal for the msgraph app permission "Group.Read.All", the token cache is still providing a token without this permission. This results in a 403.

Even after:

```
az logout
az login -u ... -p ...
```

The 403 still happens.

I need to execute `az account clear` to delete the token cache, or what works better, remove the file `msal_token_cache.bin` from disk. This does not require a new login, but enforces the cli to retrieve a fresh access token.

**Command Name**
`az ad group show`

**Errors:**
```
Insufficient privileges to complete the operation.

```

## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

- Login with a service principal without any permissions
- Add `Group.Read.All`
- az logout
- az login
- `az ad group show --group mygroup`

Yields a 403

## Expected Behavior
The cli should flush the tokens whenever an `az logout` happens.

## Environment Summary
```
Windows-10-10.0.22621-SP0
Python 3.10.5
Installer: MSI

azure-cli 2.40.0 *
```
## Additional Context
* `az cache list` returns an empty list interestingly
* An issue that came close to my situation; https://github.com/Azure/azure-cli/issues/17578
* `az account get-account-token --resource=https://graph.microsoft.com` yielded a correct JWT with the consented permissions inside. Interestingly this does not flush the token cache. I guess this could be integrated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.