-
Notifications
You must be signed in to change notification settings - Fork 3.3k
Description
Is your feature request related to a problem? Please describe.
Hi there, I am using the azure-identity library to authenticate a user using Device Code Login. After their access token expires after 60 minutes, I am unable to silently refresh this token.
Describe the solution you'd like
I would like to be able to silently refresh their access token once it is expired, so that they don't have to go through device code login again if they call my Python module after 60 minutes.
Describe alternatives you've considered
The Python adal library supports this, but I am unable to use it because I am using the new azure-keyvault-secrets library, which requires you to pass in a credential created by azure-identity.
Here's the API supported by adal library
Additionally, I tried calling internal APIs within azure-identity. I understand that both these APIs are meant to be used for application-delegated authentication instead of user-delegated.
Two that I looked at:
class CachedDeviceCodeCredential(DeviceCodeCredential):
def get_token(self):
... # calls super().get_token() the first time around
... # calls silently_refresh_token() after a token was obtained but is now expired
def silently_refresh_token_1(self):
... # hard coded params for testing
new_token = self._get_app().acquire_token_silent(scopes, account=account) # doesn't work after 60 min
def silently_refresh_token_2(self):
from azure.identity._credentials.shared_cache import SharedTokenCacheCredential
... # hard coded params for testing
cache = SharedTokenCacheCredential(username=username, tenant_id=tenant_id)
new_token = cache.get_token() # doesn't work
Additional context
Please let me know if you'd like for me to provide additional context.
One thing to note is that since the DeviceCodeCredential doesn't provide caching (i.e. each get_token() call starts a new flow), I created the wrapper class with an overridden get_token() that caches the token in memory and on disk.