search

Azure / azure-libraries-for-net

Azure libraries for .Net
MIT License
377 stars 190 forks source link

[BUG] AzureCliCrededentials json format changed #1329

Open riezebosch opened 1 year ago

riezebosch commented 1 year ago

Describe the bug A clear and concise description of what the bug is.

The format of the json files that are used by azure-cli to store the access tokens has changed. Therefore the AzureCliCredentials fails to parse the tokens that are used for logging in using a service principal.

$ az --version
azure-cli                         2.39.0

core                              2.39.0
telemetry                          1.0.6 *

Dependencies:
msal                            1.18.0b1
azure-mgmt-resource             21.1.0b1

Python location '/opt/homebrew/Cellar/azure-cli/2.39.0/libexec/bin/python'
Extensions directory '/Users/mriezebosch/.azure/cliextensions'

Python (Darwin) 3.10.6 (main, Aug 11 2022, 13:36:31) [Clang 13.1.6 (clang-1316.0.21.2.5)]

Legal docs and information: aka.ms/AzureCliLegal

Old format & location:

cat ~/.azure/accessTokens.json 
[
    {
        "servicePrincipalTenant": "** GUID **",
        "servicePrincipalId": "** GUID **",
        "accessToken": "** TOKEN **"
    }
]

New format & location:

cat ~/.azure/service_principal_entries.json 
[
    {
        "tenant": "** GUID **,
        "client_id": "** GUID **",
        "client_secret": "** TOKEN **"
    }
]#

Exception or Stack Trace Add the exception log and stack trace if available

To Reproduce Steps to reproduce the behavior:

  1. Upgrade azure-cli
  2. az logout (to clear the ~/.azure folder)
  3. az login --service-principal -u '** GUID **' -p '** TOKEN **' --tenant '** GUID **'
  4. Use AzureCliCredentials.Create()

Code Snippet Add the code snippet that causes the issue.

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem.

Setup (please complete the following information):

Microsoft.Azure.Management.Fluent@1.38.1

Additional context Add any other context about the problem here. https://github.com/Azure/azure-libraries-for-net/blob/master/src/ResourceManagement/ResourceManager/Authentication/AzureCliCredentials.cs#L45

Information Checklist Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

weidongxu-microsoft commented 1 year ago

new CLI should be on MSAL, but this lib stays at ADAL.

The lib is in maintenance mode, and to be deprecated.

Please plan switch to https://aka.ms/azsdk/dotnet/mgmt

riezebosch commented 1 year ago

For this particular issue I don't think it is ADAL/MSAL related. The AzureCliCredentials class just uses the credentials cached by azure-cli. I've seen the new SDK using the cli directly for that, and this lib has its built-in parser.

rvdginste commented 1 year ago

@riezebosch

I had an issue with the AzureCliCredentials and wanted to check the source code. I looked at the implementation here and thought I'd bumped into the unsupported old json issue, but I was actually using the newer library Azure.Identity. The implementation in here (old) directly reads the json file, but the implementation in Azure.Identity directly calls the Azure cli and does not have the issue.

See https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/Credentials/AzureCliCredential.cs

weidongxu-microsoft commented 1 year ago

Azure.Identity should work fine (unless there is bug).

Yes, the current solution would be call CLI and let it fetch the result. However, I am not sure whether it works same, if CLI is an old version (before they've moved to MSAL).

@riezebosch

As mentioned by @rvdginste, the JSON format changed (or even file location). Whether it is ADAL/MSAL is now internal to CLI. But as said, this lib is likely to be deprecated soon, and we are not adding new features.

riezebosch commented 1 year ago

I understand, but now people depending on this library find their software being in an unusable state since it no longer works with an updated azure-cli.

It is possible to combine the credentials provided byAzure.Identity with this library?