{Auth} Add --claims-challenge to the re-authentication message#31699
{Auth} Add --claims-challenge to the re-authentication message#31699
--claims-challenge to the re-authentication message#31699Conversation
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
|
Support interactive re-authentication with claims challenge |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
|
An MFA error can be triggered with The claims challenge Notice SDK doesn't load the response body at all and shows |
jiasli
requested review from
bebound,
calvinhzy,
evelyn-ys,
jsntcy,
kairu-ms,
necusjz and
zhoxing-ms
as code owners
jiasli
changed the title
--claims-challenge to the re-authentication message
| else: | ||
| login_command = _generate_login_command(**kwargs) | ||
| recommendation = "Interactive authentication is needed. Please run:\n{}".format(login_command) | ||
| login_command = _generate_login_command(claims_challenge=claims_challenge, **kwargs) |
There was a problem hiding this comment.
Is it worth replacing kwargs with tenant and scopes, given the limited number of arguments?
There was a problem hiding this comment.
Good suggestion. This (removing kwargs) is what I did in #31778.
|
We ask the user to do interactive re-authentication unconditionally, as explained below. WAM flow's As discussed with @rayluo:
Therefore:
|
|
The duplicated error message is given by Python SDK: Azure/azure-sdk-for-python#41937 |
| return ' '.join(login_command) | ||
| # Explicit logout is preferred, making sure MSAL cache is purged: | ||
| # https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/335 | ||
| return 'az logout\n' + ' '.join(login_command) |
There was a problem hiding this comment.
We always ask the user to explicitly log out, in case some commands (such as az ad) don't support handling 401 challenge. See AzureAD/microsoft-authentication-library-for-python#335.
|
A screenshot of the example output: 
|
5 participants
Related command
az loginDescription
#31778 added
--claims-challengetoaz login.When a
PUTorDELETErequest is blocked by MFA policy with a401response,ARMChallengeAuthenticationPolicywill trigger silent re-authentication. If silent re-authentication fails, Azure CLI shows re-authentication message with--claims-challengeand base64-encoded value. Running thisaz login --claims-challenge xxxcommand will trigger the MFA process.The JSON value of the claims challenge is base64-encoded to avoid quoting issue (#15529). Even though base64-encoded string may contain
+/-_=characters, they will not be interpreted by shell.Below is a test in PowerShell 7.5.2:
and Bash:
so quoting the base64-encoded claims challenge is not necessary, but there could be unknown shells that do interpret these characters, so we quote it to follow the best practice.
Testing Guide
History Notes
[Core] Provide actionable error recommendation when a command fails because of Multi-Factor Authentication (MFA) policy violation