Az cli does not refresh msgraph token cache
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Describe the bug
After having consented the service principal for the msgraph app permission "Group.Read.All", the token cache is still providing a token without this permission. This results in a 403.
Even after:
```
az logout
az login -u ... -p ...
```
The 403 still happens.
I need to execute `az account clear` to delete the token cache, or what works better, remove the file `msal_token_cache.bin` from disk. This does not require a new login, but enforces the cli to retrieve a fresh access token.
**Command Name**
`az ad group show`
**Errors:**
```
Insufficient privileges to complete the operation.
```
## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.
- Login with a service principal without any permissions
- Add `Group.Read.All`
- az logout
- az login
- `az ad group show --group mygroup`
Yields a 403
## Expected Behavior
The cli should flush the tokens whenever an `az logout` happens.
## Environment Summary
```
Windows-10-10.0.22621-SP0
Python 3.10.5
Installer: MSI
azure-cli 2.40.0 *
```
## Additional Context
* `az cache list` returns an empty list interestingly
* An issue that came close to my situation; https://github.com/Azure/azure-cli/issues/17578
* `az account get-account-token --resource=https://graph.microsoft.com` yielded a correct JWT with the consented permissions inside. Interestingly this does not flush the token cache. I guess this could be integrated.
Contributor guide
Assessment
This issue has not been assessed yet.