Skip to content

Authentication with credential acquired in cloud shell fails #14218

Description

@wpbrown

Describe the bug
Trying to use a credential retrieved from the CLI fails when using Cloud Shell MSI because the token format does not match the code.

To Reproduce

from azure.common.credentials import get_azure_cli_credentials
credential, _ = get_azure_cli_credentials(resource="https://storage.azure.com/")

Use the credential in the blob client...

  File "/.../site-packages/azure/core/pipeline/policies/_authentication.py", line 93, in on_request
    self._token = self._credential.get_token(*self._scopes)
  File "/.../site-packages/azure/cli/core/adal_authentication.py", line 64, in get_token
    return AccessToken(token, int(full_token['expiresIn'] + time.time()))
KeyError: 'expiresIn'

Expected behavior
adal_authentication.get_token returns a valid AccessToken.

Environment summary
azure_cli_core-2.8.0 in Azure Cloud Shell.

Additional context

The actual full_token:

{
    "access_token": "{REMOVED}",
    "refresh_token": "",
    "expires_in": "3900",
    "expires_on": "1593791553",
    "not_before": "1593787653",
    "resource": "https://storage.azure.com/",
    "token_type": "Bearer"
}

The code looks for expiresIn, but under cloud shell the full_token contains expires_in and expires_on.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions