Closed wosc closed 3 years ago
Historically, all acquire_token_xyz(..., scopes=[...])
methods in MSAL are meant to obtain access token (AT). ID token in MSAL is a happpy byprodct which provides the metadata for the current account. Your hack of "using scopes=[client_id]
to obtain an ID token" is also the result of such a side effect. We could revisit this at a later time.
Meanwhile, based on your code snippet, your app's accounts[0]
shows that it is a single-account app. In such case, you might as well just preserve and reuse the id_token_claims
returned from the initial acquire_token_xyz(...)
method. Those are the metadata associating with the signed-in account.
Alright, fair enough, if that's a "more like happily accidentally" supported use case, that makes sense. Thanks for explaining!
I'm using
msal
to cache an ID token; from the code I figured out that this means specifyingscopes=[client_id]
, and this does work fine, in principle.Expected behavior If a non-expired ID token is in the cache, I expect
acquire_token_silent
to return that.What you see instead
acquire_token_silent
does not find the cached ID token, since it only looks at access tokens, which of course can never matchscopes=[client_id]
, so it always performs a refresh.The MSAL Python version you are using 1.13.0
Workaround
I'm now examining the cached ID token manually before calling
acquire_token_silent
, like this: