Identity: Unable to log into multiple accounts using the Token Cache #28896
Assignees
Labels
Azure.Identity
Client
This issue points to a problem in the data-plane of the library.
customer-reported
Issues that are reported by GitHub users external to the Azure organization.
needs-team-attention
Workflow: This issue needs attention from Azure service team or SDK team
question
The issue doesn't require a change to the product in order to be resolved. Most issues start as that
Milestone
Comments
github-actions
bot
added
Azure.Identity
Client
|
Thank you for your feedback. Tagging and routing to the team member best able to assist. |
github-project-automation
bot
moved this to Untriaged
in Azure Identity SDK Improvements
|
Hello, I have figured what the problem is. I'll be working on a fix for this soon. @Apollo3zehn |
2 tasks
|
Great, thank you! |
|
@Apollo3zehn Can you provide me with the logs of the above sample. You can do this by import { setLogLevel } from "@azure/logger";
setLogLevel("verbose");Also in your sample, i don't see you trying to provide two different accounts. I see the authenticationRecord and loginHint pointing to the same credential login account |
KarishmaGhiya
added
needs-author-feedback
|
Hi @Apollo3zehn. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue. |
|
@Apollo3zehn Also, I did try the sample above. For me it does prompt me with the dialog box when I try to create a credential with a different email address (loginHint). I would recommend you to compare your two authentication records, if they have different contents when created. If they have the same content it means - it's taking in the same account (tenant, client id and email) credentials for login. Compare the two authentication records created locally and let me know what your content really looks like. |
|
I will test again today and report my findings! |
github-actions
bot
added
needs-team-attention
|
Please find the logs below. I tried first to access Here is the comparison of the authentication records. They are equal:
|
|
To me it looks like the login-hint being ignored. |
Yeah, first, you need the prompt with the specified login hint right? My PR will address that. That way it won't appear like silent auth is happening, when not needed. Second, I wanted to check with you is - Are both the emails approved for logging into the app registration account (the tenant-id and client-id provided above in the sample)? If your second email doesn't have the permission to authenticate to that app registration, then the login may fail even with the fix. So make sure you have the appropriate set up or use the correct tenant and client id required for the second email account. Also thank you for providing the logs. |
KarishmaGhiya
added
needs-author-feedback
|
Hi @Apollo3zehn. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue. |
That is great, it would solve my problem!
Yes, both are approved. If I switch the order of the emails I use to log in, I can access mails of that other email address. It is always the second address which does not work, no matter what order they have. |
github-actions
bot
added
needs-team-attention
|
@Apollo3zehn One more thing, while addressing the first issue, it will ALWAYS show the login dialog box as well. Is that the experience you are looking for? I vaguely remember that a few customers had complained over the amount of times they saw the login dialog in the past. Once my PR is merged, I can provide you with an alpha build that you can test and verify and give feedback. |
|
Thanks for your work so far! What I want as a user of this library is: Show the login dialog once per Microsoft account I specify in the config file of my VS Code extension. This extension allows its users to access their emails (and more). The extension's purpose is a TODO management hub to help organise myself in the face of too much work. I have many different Microsoft email accounts and I need access to all of them in parallel from within the extension. It is OK to re-show the login dialog once in while but it would be annoying if it shows up for each account everytime I launch the VS Code extension mentioned above. |
KarishmaGhiya
moved this from Not Started
to In Progress
in Azure Identity SDK Improvements
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
I am developing a VSCode extension and try to use Microsoft Graph to access Outlook resources of two different Microsoft accounts and cache the tokens using the
@azure/identity-cache-persistencepackage (v1.0.0) and theInteractiveBrowserCredential.With the token cache enabled, I can log into the first account (the browser opens) and give access to an OAuth application to some Outlook resources. I do this by manually calling
authenticationRecord = credential.authenticate(...)Since this is the first log in, no
AuthenticationRecordcan be provided to theInteractiveBrowserCredential.Now I try to log into the second account (by setting
InteractiveBrowserCredential.loginHintto another value) and again without providing anyAuthenticationRecordbecause it is not available yet. What happens then is that theAuthenticationRecordof the first account is being returned without opening the browser and thus without giving me the chance to log into that second account.My workaround for now is to disable the token cache when no authentication record is available (i.e. for the first log in) and enable it for all subsequent login attempts. But that leads to the inconvenience that I need to log in twice into every account instead of only once because only for the second log in, the token cache is enabled.
To Reproduce
Below is the code that does not work for me, i.e. the token cache is always enabled. Run it twice with different user accounts (set
loginHintto a different account each run). Azure Identity will ask the user only once to log in.Expected behavior
I expect a possibility to enforce authentication, i.e. ignore the token cache, but at the same time update it when the authentication was successful so it is populated when the user needs to authenticate the next time.
More specifically, I would expect that the token cache is (optionally) bypassed when no
AuthenticationRecordis available so that the user is forced to authenticate manually.Screenshots
Additional context
The text was updated successfully, but these errors were encountered: