[Identity] Adjust cache credential error behavior in DAC #42934
Conversation
7a323f4 to
67f2e45
Compare
API Change CheckAPIView identified API level changes in this PR and created the following API reviews |
There was a problem hiding this comment.
Pull Request Overview
This PR adjusts the SharedTokenCacheCredential error behavior to align with other developer tool credentials when used within DefaultAzureCredential (DAC). When refresh token failures occur within the DAC context, the credential now raises CredentialUnavailableError instead of ClientAuthenticationError, allowing the credential chain to continue rather than failing outright.
Key changes:
- Added error handling logic to catch
ClientAuthenticationErrorduring refresh token operations - When within DAC context, transforms authentication errors to
CredentialUnavailableError - Added comprehensive test coverage for both sync and async implementations
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
azure/identity/_credentials/shared_cache.py |
Added try-catch block around refresh token operation with DAC-aware error transformation |
azure/identity/aio/_credentials/shared_cache.py |
Same error handling logic for async implementation |
tests/test_shared_cache_credential.py |
Added test case for DAC context error behavior in sync version |
tests/test_shared_cache_credential_async.py |
Added test case for DAC context error behavior in async version |
CHANGELOG.md |
Documented the behavior change |
sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py
Outdated
Show resolved
Hide resolved
sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py
Outdated
Show resolved
Hide resolved
Signed-off-by: Paul Van Eck <[email protected]>
67f2e45 to
84e5bd9
Compare
|
The case is we do get a token back but it is expired, right? |
This applies when a cache exists but contains no valid access token. Although a refresh token is available and used to request a new access token, the request fails due to the refresh token being expired, invalid, or encountering another error. |
sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py
Outdated
Show resolved
Hide resolved
Signed-off-by: Paul Van Eck <[email protected]>
Signed-off-by: Paul Van Eck <[email protected]>
Other developer tool credentials are lenient when it comes to continuing the chain upon failure. Even if a token attempt is made, but no token is returned, if we detect we are within the context of
DefaultAzureCredential, we raise aCredentialUnavailableErrorand continue on in the credential chain.SharedTokenCacheCredentialcan sometimes cause issues during refresh token failures when users try to use DAC, but there is an old cache lying around.SharedTokenCacheCredentialwill now follow the similar pattern as other developer tool credentials and raiseCredentialUnavailableErrorwhen within DAC.