search

AzureAD / microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".
https://stackoverflow.com/questions/tagged/azure-ad-msal+python
Other
790 stars 194 forks source link

Pass `on_obtaining_tokens` via `obtain_token_by_refresh_token` #339

Closed jiasli closed 3 years ago

jiasli commented 3 years ago

Symptom

While developing a PoC to solve #335, I noticed that skip_account_creation added by #262 never seems to make its way into TokenCache.__add.

skip_account_creation is assigned here and the lambda is passed to obtain_token_by_refresh_token via on_obtaining_tokens:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/0f1ab8d5d97b3722776c2c661f6f083a26d1fec2/msal/application.py#L948-L957

However, on_obtaining_tokens is discarded by obtain_token_by_refresh_token:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/eb0a86fb6bf1b021ef58a872213ec88af86212d7/msal/oauth2cli/oauth2.py#L769-L813

To Reproduce

  1. Add a debug line 
    print("__add:", realm, event.get("skip_account_creation"))

    before https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/31b24afe3eb6edd3af58bab40f1387be02cb389d/msal/token_cache.py#L178

  2. Do multi-tenant auth with Azure CLI.
  3. Verify the output is: 
    __add: organizations None
__add: 72f988bf-86f1-41af-91ab-2d7cd011db47 None
__add: 246b1785-9030-40d8-a0f0-d94b15dc002c None
__add: 2b8e6bbc-631a-4bf6-b0c6-d4947b3c79dd None
__add: ca97aaa0-5a12-4ae3-8929-c8fb57dd93d6 None
__add: 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a None

    None means skip_account_creation is not set.

Change

After the change, the output is

__add: organizations None
__add: 72f988bf-86f1-41af-91ab-2d7cd011db47 True
__add: 246b1785-9030-40d8-a0f0-d94b15dc002c True
__add: 2b8e6bbc-631a-4bf6-b0c6-d4947b3c79dd True
__add: ca97aaa0-5a12-4ae3-8929-c8fb57dd93d6 True
__add: 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a True
rayluo commented 3 years ago

Thanks for the nice catch! I derived a fix a897af41 based on your finding. It is now fixed in the dev branch.