{Auth} Add --tenant to the re-authentication message#31742
Conversation
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
microsoft-github-policy-service
bot
added
the
ARM
There was a problem hiding this comment.
Pull Request Overview
Adds tenant support to the re-authentication prompt and standardizes quoting for scopes in the generated az login command.
- Enhanced
_generate_login_commandto accept atenantparameter and wrap arguments in double quotes. - Split
--scopeinvocation so each scope is individually quoted. - Updated MSAL credentials to pass the tenant into
check_result, enabling the tenant flag in the recommendation.
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/azure-cli-core/azure/cli/core/auth/util.py | Extended _generate_login_command to handle tenant and improve quoting |
| src/azure-cli-core/azure/cli/core/auth/tests/test_util.py | Added test for tenant+scope scenario (missing a standalone scopes-only test) |
| src/azure-cli-core/azure/cli/core/auth/msal_credentials.py | Forwarded tenant from MSAL app authority into check_result |
Comments suppressed due to low confidence (2)
src/azure-cli-core/azure/cli/core/auth/util.py:52
- The call to
_generate_login_commandinaad_error_handlerdoesn’t pass the newtenantkwarg, so recommendations will never include--tenant. Update it to_generate_login_command(tenant=kwargs.get('tenant'), scopes=scopes, claims_challenge=claims_challenge).
from azure.cli.core.azclierror import AuthenticationError
src/azure-cli-core/azure/cli/core/auth/tests/test_util.py:57
- The standalone scopes-only path is no longer tested after removing the previous test for scopes alone. Add a test case for
_generate_login_command(scopes=[...])without a tenant to ensure it still generates the correct command.
# tenant and scopes
|
|
||
|
|
||
| def _generate_login_command(scopes=None, claims_challenge=None): | ||
| def _generate_login_command(tenant=None, scopes=None, claims_challenge=None): |
There was a problem hiding this comment.
Shall we append the tenant info in re-login recommendation msg only for some error code (for example AADSTS50076)?
Now it seems all failure cases will append this except for 7000215
azure-cli/src/azure-cli-core/azure/cli/core/auth/util.py
Lines 43 to 47 in cf56331
There was a problem hiding this comment.
There are many possible AADSTS errors. We cannot enumerate all of them. For example, if you haven't configured MFA in a tenant, acquire_token_silent will fail with
AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.
If you have configured MFA in a tenant but didn't perform MFA in the browser before, acquire_token_silent will fail with
AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.
It is a good practice to always specify --tenant so that Azure CLI can only access resources in the specified tenant and also trigger MFA as required by that tenant.
There was a problem hiding this comment.
My concern is whether there will be any cases that adding tenant id during login is misleading? If no such case, then I'm good with this
There was a problem hiding this comment.
I cannot think of a case where adding tenant ID is misleading.
--tenant will not be shown for managed identity and Cloud Shell:
5 participants
Related command
az loginDescription
Similar to #17738
MFA status is not shared between tenants.
az loginwill only trigger MFA on the home tenant, but not guest tenants.Following
acquire_token_silent_with_errorcalls (such asaz account get-access-token --tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a) on guest tenants will fail withTesting Guide