[Core] Use WAM as the default authentication method on Windows #28085
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
️✔️AzureCLI-FullTest
|
|
Hi @jiasli, |
️✔️AzureCLI-BreakingChangeTest
|
|
Core |
microsoft-github-policy-service
bot
added
Account
|
AzureAD/microsoft-authentication-library-for-python#569 introduced
Besides fixing device code flow (AzureAD/microsoft-authentication-library-for-python#563), another great benefit of that PR is that enabling WAM will not break the current login context established by auth code flow. We get error in a previous version of MSAL, such as 1.24.0b2. # Turn off token encryption so that we can edit it manually later
az config set core.encrypt_token_cache=false
# Make sure the WAM cache is cleared
az config set core.allow_broker=true
az account clear
az config set core.allow_broker=false
az login
# Edit ~/.azure/msal_token_cache.json. Change AccessToken.<key>.expires_on to 0 to make the access token expire
# {
# "AccessToken": {
# "...": {
# ...
# "expires_on": "0",
az config set core.allow_broker=true
# Trigger token refreshing
az group listWe get error Thanks to this change, MSAL will check # Turn off token encryption so that we can edit it manually later
az config set core.encrypt_token_cache=false
# Make sure the WAM cache is cleared
az config set core.enable_broker_on_windows=true
az account clear
az config set core.enable_broker_on_windows=false
az login
# Edit ~/.azure/msal_token_cache.json. Change AccessToken.<key>.expires_on to 0 to make the access token expire
# {
# "AccessToken": {
# "...": {
# ...
# "expires_on": "0",
az config set core.enable_broker_on_windows=true
# Trigger token refreshing
az group listThis makes this PR a non-breaking change as long as the existing Azure CLI already uses MSAL >=1.25.0. However, updating from an old version of MSAL to the latest MSAL with |
jiasli
force-pushed
the
wam-as-default
branch
from
1b20d74 to
371e9f7
Compare
|
Azure Pipelines successfully started running 3 pipeline(s). |
jiasli
requested review from
evelyn-ys,
calvinhzy,
jsntcy,
kairu-ms,
zhoxing-ms and
necusjz
as code owners
jiasli
commented
Feb 26, 2024
Comment on lines
-24
to
-31
| <h3>Announcements</h3> | ||
| <p>[Windows only] Azure CLI is collecting feedback on using the <a href="https://learn.microsoft.com/windows/uwp/security/web-account-manager">Web Account Manager</a> (WAM) broker for the login experience.</p> | ||
| <p>You may opt-in to use WAM by running the following commands:</p> | ||
| <code> | ||
| az config set core.enable_broker_on_windows=true<br> | ||
| az account clear<br> | ||
| az login | ||
| </code> |
There was a problem hiding this comment.
These lines are introduced by #25416.
The code block in <style> is kept in case we need it again in the future.
|
Azure Pipelines successfully started running 3 pipeline(s). |
|
Command 'run
for' is not supported by Azure Pipelines. Supported commands
See additional documentation. |
1 similar comment
|
Command 'run
for' is not supported by Azure Pipelines. Supported commands
See additional documentation. |
bebound
approved these changes
Feb 27, 2024
evelyn-ys
approved these changes
Feb 27, 2024
|
This PR has been reverted by #28483. |
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related command
az loginDescription
Fix #26573
Fix #28417
Require #27726
After previewing WAM for over a year (#23828), we now use WAM as the default authentication method on Windows.
This PR bumps MSAL to 1.27.0 (AzureAD/microsoft-authentication-library-for-python#669) which raised the upper bound of
pymsalruntime(AzureAD/microsoft-authentication-library-for-python@59c3000).pymsalruntime0.14.1 fixes the issues withPIM (#26573) andVM SSH (#28417).Testing Guide
History Notes
[Core] BREAKING CHANGE:
az login: Use WAM as the default authentication method on Windows. If you encounter any issue and want to opt out, runaz config set core.enable_broker_on_windows=false,az account clearandaz login