Ignore CachedAuth if Broker is present in AuthMode on win 10 or 11 #419
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Investigation findings:
getTokenSilent()
method of PCA class and the way silent Auth is performed when calling this method depends on the way each AuthFlow builds and passes its own PCA wrapper object.getTokenSilent
method, detects windows platform, and makes the call non-compliant when the RT expires/some conditions change because it needs to fetch new RT (and thus API call).withBroker(options)
and also calls CachedAuth with its own built PCAWraapper. This means that when someone calls AzureAuth and specifies to use only Broker mode, we try CachedAuth 2 times, one with PCAWrapper that CachedAuth itself builds (because cached auth is always added) without Broker config and then when Broker flow gets executed, it will pass on the PCA Wrapper that it builtwithbroker(options)
.Workaround:
It might be important for us to reconsider the Auth flows and make it more close to current MSAL ideology of silent v/s interactive. However, to address current compliance issues, I am implementing following workaround - Whenever Broker is present in AuthMode (default/all/separate invocation to Broker), we leverage the CachedAuth call from Broker and ignore the initial CachedAuth call which is non-compliant.
Testing:
For the following commands, make sure the default/all mode skips initial CachedAuth call and uses CachedAuth from Broker. For
--mode Broker
make sure it only calls Broker and not separate CachedAuth.For
--mode web
,--mode device-code
make sure CachedAuth is still present and works.On mac the current behavior should remain unchanged.