Open NileshGhodekar opened 2 years ago
@jiasli for awareness
Enabling token encryption on Linux is a truly complex topic. We previously discussed with MSLA owner @rayluo heavily on this topic. The packaging on Linux is very challenging. In short:
PyGObject
which requires GUI.PyGObject
itself is complex in containers without GUI.Enabling token encryption on MacOS was attempted in https://github.com/Azure/azure-cli/pull/20636, but didn't finish.
The encryption is provided by MSAL EXtensions.
- Encryption on Linux is done via
PyGObject
which requires GUI.
I am not entirely sure about that one. As mentioned in the Q&A at the bottom of this MSAL EX wiki page, we have been able to get rid of the dependency of GTK, although we currently still install libcairo which is a graphic library. Bottom line, we were able to wrap the MSAL EX into a docker image for our unit testing. Does a docker container count as a non-GUI environment?
Perhaps we can try a proof-of-concept Azure CLI docker image built on top of MSAL EX image.
Linux is a little bit different from Windows.
As explained in https://github.com/AzureAD/microsoft-authentication-extensions-for-python/wiki/Encryption-on-Linux
Encryption on Linux is available by using libsecret to connect to secret service running on your Linux machine.
Secret service is only available when running in a desktop environment. It won't be available when remotely connected to a Linux machine, such as via an SSH connection.
Plain-text fall back would be the only option here. That is probably OK, because if the remote machine you are SSHing into is a backend server, it is by definition a "confidential client" in OAuth2 terminology, it is considered as a secure and safe environment that can store secrets there.
Related command
az login
Is your feature request related to a problem? Please describe.
Azure CLI has not yet enable token encryption when running on Linux even when MSAL now has implemented support for this.
Describe the solution you'd like
Azure CLI should store the token cache encrypted instead if plaintext on Linux
Describe alternatives you've considered
The current solution is to depend on file permissions 600 set the by CLI on the token cache file. However, encrypting it as well will improve the security posture.
Additional context
This is essentially the follow up on thread https://github.com/AzureAD/microsoft-authentication-extensions-for-python/issues/106