Fixing az login --identity support when using az cli v 2.74+
#100
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for az login --identity when using Azure CLI v2.74+ by introducing the AZURE_POD_IDENTITY_AUTHORITY_HOST environment variable and a corresponding metadata token endpoint.
- Update README with instructions for CLI v2.74+ to use
AZURE_POD_IDENTITY_AUTHORITY_HOST - Introduce a minimal API route in
Program.csat/metadata/identity/oauth2/tokento serve managed identity tokens
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| README.md | Added v2.74+ instructions for AZURE_POD_IDENTITY_AUTHORITY_HOST |
| Program.cs | Mapped GET endpoint to serve identity token requests |
Comments suppressed due to low confidence (4)
README.md:72
- [nitpick] Replace the nonstandard '->' bullet with proper markdown blockquote syntax and remove the duplicated instruction already added in line 73.
> [!NOTE]
README.md:73
- [nitpick] Consolidate the MSI_ENDPOINT note with the v2.74+ instructions to avoid repeating the same sentence twice; consider merging into a single cohesive note block.
> If you are using `az cli` in your service and your service wants to do `az login --identity` then specify `MSI_ENDPOINT`: the URL of the proxy endpoint (e.g., `http://azclicredsproxy:8080/token`) environment variable instead. `IDENTITY_ENDPOINT` and `IMDS_ENDPOINT` are not required for `az login --identity`.
Program.cs:52
- Consider adding unit or integration tests for this new metadata endpoint to ensure it correctly handles various query parameters and token acquisition scenarios.
app.MapGet("/metadata/identity/oauth2/token", async (HttpContext context, string resource, CancellationToken cancellationToken) =>
Program.cs:58
- The token response is missing an
expires_onfield, which many MSAL clients expect; add"expires_on"with the appropriate UNIX timestamp.
["expires_in"] = (token.ExpiresOn - DateTimeOffset.UtcNow).TotalSeconds,
Program.cs
Outdated
| // https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/d49296c1b2a929a6ab11380e237daa89a5298512/msal/managed_identity.py#L473 | ||
| app.MapGet("/metadata/identity/oauth2/token", async (HttpContext context, string resource, CancellationToken cancellationToken) => | ||
| { | ||
| var token = await tokenCredential.GetTokenAsync(new TokenRequestContext([resource]), cancellationToken); |
There was a problem hiding this comment.
[nitpick] Using the C# 12 array expression [resource] requires targeting that language version; for broader compatibility, consider new[] { resource }.
| var token = await tokenCredential.GetTokenAsync(new TokenRequestContext([resource]), cancellationToken); | |
| var token = await tokenCredential.GetTokenAsync(new TokenRequestContext(new[] { resource }), cancellationToken); |
Copilot uses AI. Check for mistakes.
|
Hey there, I tracked down the bevaviour you're describing to AzureAD/microsoft-authentication-library-for-python#795 which adds support for AAD pod identity to MSAL for python. This appears to be a very old and long-ago-deprecated authentication mechanism. Are you running az cli inside a kubernetes pod with pod identity configured by any chance? I'm wondering if it is worth supporting pod identity vs just unsetting the |
|
Hi @starcraft66 the scenario is that we have az cli installed within a container running in docker and then in that container we run
Now start the azure cli credentials proxy container on a docker network named say
Thanks for the above pointers. I was not aware this was a deprecated option but then not sure why az cli 2.74 went down that path in the above setup. |
|
Ping... |
|
Okay, I have had time to do more research on the matter and found the real reason why things broke in azcli 2.74.0: Azure/azure-cli#31577. This old authentication mechanism properly supported using Can you try setting the environment variable |
|
@starcraft66 using IDENTITY_ENDPOINT and IDENTITY_HEADER combination worked as you suggested. Thanks for that. I've updated the PR to update the readme/comments and removed the change I introduced. |
|
@starcraft66 would you have time to approve the pr? |
2 participants
With az cli 2.74 seeing the below failure when using
az login --identitywith MSI_ENDPOINT set. On debugging the failure figured out that the implementation of fetching the token in az cli has changed and now we have to support the code path that ends up usingAZURE_POD_IDENTITY_AUTHORITY_HOSTenv variable as per https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/d49296c1b2a929a6ab11380e237daa89a5298512/msal/managed_identity.py#L473. This change adds that support.