Azure / Azure/azure-sdk-for-python

Token cache persistance with CAE disabled

Aperta
#42,898 3 commenti 0 reazioni 2 assegnatari Rivendicata da @pvaneck Vedi su GitHub
Azure.Identity Client customer-reported needs-team-attention question
Lingua principale
Python
Stelle
5.6k
Fork
3.4k
Merge medio
2g
PR unite (30g)
217

Descrizione

- **Package Name**: azure-identity
- **Package Version**: 1.24.0
- **Operating System**: Linux
- **Python Version**: 3.13.7

**Describe the bug**

Using token cache persistence causes problems on Linux with CAE disabled.

**To Reproduce**

```python
token_cache_options = TokenCachePersistenceOptions(name="MyApp")

if Path("cred.json").exists():
with open("cred.json", "r") as f:
deserealized_record = AuthenticationRecord.deserialize(f.read())

device_credential = DeviceCodeCredential(
client_id=azure_settings["clientId"],
tenant_id=azure_settings["tenantId"],
authentication_record=deserealized_record,
cache_persistence_options=token_cache_options,
disable_automatic_authentication=True,
)
else:
device_credential = DeviceCodeCredential(
client_id=azure_settings["clientId"],
tenant_id=azure_settings["tenantId"],
cache_persistence_options=token_cache_options,
disable_automatic_authentication=True,
)

record = device_credential.authenticate(scopes=azure_settings["graphScope"])

with open("cred.json", "w") as f:
f.write(record.serialize())

app_client = GraphServiceClient(
credentials=device_credential, scopes=azure_settings["graphScope"]
)

# do something with app_client, eg: `app_client.me.get()`
```

The code above will fail on second run (on silent authentication) because the `getToken` method won't be able to find the token cache on disk. This is because, by default, the `enable_cae` attribute is set to **False** and this causes the first run (interactive authentication) to create a cache file on disk called `~/.IdentityService/.nocae`, whereas the second (ie. silent) run will have the CAE set by default to **True** (due to a bug described below), which will cause the system to think there is no cache present and fail.

This can be resolved by setting the `enable_cae` attribute to **True** in the `authenticate` method, thus creating a file called `~/.IdentityService/.cae`, which makes everything work okay:

```python
record = device_credential.authenticate(scopes=azure_settings["graphScope"], enable_cae=True)
```

The main issue is that currently it is impossible to create a persistent cache without CAE in this scenario. This is because the `AzureIdentityAuthenticationProvider` class has `enable_cae` set to **True** by default (even though everywhere else it's set to False) and there is no facility to change this default setting when initializing the `GraphServiceClient`.

**Suggested resolutions**

1. add information in documentation and tutorials about how CAE affects the persistent token cache on Linux
2. add a facility to change the CAE flag in GraphServiceClient (eg. add `enable_cae` attribute to the class's initialization routine)

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.