Azure / Azure/azure-sdk-for-python

Token cache persistance with CAE disabled

Open
#42,898 3 comments 0 reactions 2 assignees Claimed by @pvaneck View on GitHub
Azure.Identity Client customer-reported needs-team-attention question
Dominant language
Python
Stars
5.6k
Forks
3.4k
Avg merge
1d 21h
Merged PRs (30d)
193

Description

- **Package Name**: azure-identity
- **Package Version**: 1.24.0
- **Operating System**: Linux
- **Python Version**: 3.13.7

**Describe the bug**

Using token cache persistence causes problems on Linux with CAE disabled.

**To Reproduce**

```python
token_cache_options = TokenCachePersistenceOptions(name="MyApp")

if Path("cred.json").exists():
with open("cred.json", "r") as f:
deserealized_record = AuthenticationRecord.deserialize(f.read())

device_credential = DeviceCodeCredential(
client_id=azure_settings["clientId"],
tenant_id=azure_settings["tenantId"],
authentication_record=deserealized_record,
cache_persistence_options=token_cache_options,
disable_automatic_authentication=True,
)
else:
device_credential = DeviceCodeCredential(
client_id=azure_settings["clientId"],
tenant_id=azure_settings["tenantId"],
cache_persistence_options=token_cache_options,
disable_automatic_authentication=True,
)

record = device_credential.authenticate(scopes=azure_settings["graphScope"])

with open("cred.json", "w") as f:
f.write(record.serialize())

app_client = GraphServiceClient(
credentials=device_credential, scopes=azure_settings["graphScope"]
)

# do something with app_client, eg: `app_client.me.get()`
```

The code above will fail on second run (on silent authentication) because the `getToken` method won't be able to find the token cache on disk. This is because, by default, the `enable_cae` attribute is set to **False** and this causes the first run (interactive authentication) to create a cache file on disk called `~/.IdentityService/.nocae`, whereas the second (ie. silent) run will have the CAE set by default to **True** (due to a bug described below), which will cause the system to think there is no cache present and fail.

This can be resolved by setting the `enable_cae` attribute to **True** in the `authenticate` method, thus creating a file called `~/.IdentityService/.cae`, which makes everything work okay:

```python
record = device_credential.authenticate(scopes=azure_settings["graphScope"], enable_cae=True)
```

The main issue is that currently it is impossible to create a persistent cache without CAE in this scenario. This is because the `AzureIdentityAuthenticationProvider` class has `enable_cae` set to **True** by default (even though everywhere else it's set to False) and there is no facility to change this default setting when initializing the `GraphServiceClient`.

**Suggested resolutions**

1. add information in documentation and tutorials about how CAE affects the persistent token cache on Linux
2. add a facility to change the CAE flag in GraphServiceClient (eg. add `enable_cae` attribute to the class's initialization routine)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.