Azure / Azure/azure-powershell
Get-AzContext is unable to detect password changes to account and is unreliable
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
Get-Azcontext cannot be reliably used as a way to determine if the user is connected to azure.
I believe the problem may involve accounts with auto rotating passwords.
Example:
Monday: Connect-azaccount, then do work as normal.
Monday at midnight - account password is reset in AAD.
Tuesday: Run Get-AzContext to see if account is logged in - This command returns information, as if there was an active connection, Then run any command such as get-azsubscription - the command fails with:
`WARNING: Unable to acquire token for tenant 'xxxxx' with error
'SharedTokenCacheCredential authentication unavailable. Token acquisition failed for user user@domain.com. Ensure
that you have authenticated with a developer tool that supports Azure single sign on.'`
What I believe _may_ be happening is that signing in with connect-azaccount likely sets a token into a file on the local PC - that file is then referenced by get-azcontext without get-azcontext actually checking to see if the token is valid.
When the AAD account associated with the token has it's password changed, the cached token is technically not valid anymore, but get-azcontext does not check the validity and reports back an active context.
Solution: Get-azcontext should confirm the token is valid before reporting.
### Issue script & Debug output
```PowerShell
I can't recreate the debug script at this time since I've already re-logged into azure for the day. Please let me know if the other information isn't sufficient.
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 5.1.19041.1320
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.1320
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```
### Module versions
```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 2.7.2 Az.Accounts {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Con...
Binary 2.0.2.134 AzureADPreview {Add-AzureADAdministrativeUnitMember, Add-AzureADApplicat...
```
### Error output
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.