[Enhancement Proposal] Add config option to disable token cache encryption

[jiasli]

Azure PowerShell's token encryption issues

Various issues have been reported regarding Azure PowerShell's token encryption functionality:

Windows:

• Connect-AzAccount Unable to acquire token for tenant 'organizations' azure-powershell#14925
• Connect-AzAccount : InteractiveBrowserCredential authentication failed: Persistence check failed. Inspect inner exception for details azure-powershell#13691

MacOS:

• OSX Connect-AzAccount doesn't function azure-powershell#14478
• Connect-AzAccount: MacOS KeyChain authorization/authentication failed azure-powershell#15423

The workaround is to disable persistent token cache between sessions:

• Document MSAL workaround MicrosoftDocs/azure-docs-powershell#1872

However, this approach is not feasible for Azure CLI, as there is no concept of session - Azure CLI is a python application and there is no connection between commands.

Python SDK status

In current Python SDKs, a fallback mechanism is used:

• Azure Identity (Python) provides allow_unencrypted
• MSAL Extension (Python)'s sample code uses fallback_to_plaintext

But this fallback mechanism only takes effect when initializing LibsecretPersistence on Linux fails - it is possible that failures can also occur when

• FilePersistenceWithDataProtection on Windows, KeychainPersistence on MacOS are initialized or actually used. (Token encryption is enforced on Windows and MacOS)
• LibsecretPersistence on Linux is actually used

When failures happen on various platforms, forcing token encryption will render Azure CLI totally unusable.

Proposed solution

Instead of using allow_unencrypted or fallback_to_plaintext and let Azure CLI try its best to encrypt, we should introduce a definitive option like plaintext to force unencrypted token cache, so that complex platform-dependent problems can be bypassed.

Reference email: Workaround for DPAPI/KeyChain Errors

[yonzhan]

Enhancement

[rayluo]

Regarding to this:

Windows:

• Connect-AzAccount Unable to acquire token for tenant 'organizations' azure-powershell#14925

One of its comment linked to this MSAL Ex .Net PR which adds WithUnprotectedFile() option.

So, if that kind of "opt-in to unprotected token cache" behavior is what you want, you can use the FilePersistence in MSAL EX Python. The choice is yours.

[jiasli]

Totally understand. That's why this issue is opened in Azure CLI repo.

[jiasli]

Implemented in #19853 as core.token_encryption (for now).

Renamed to core.encrypt_token_cache (#20432).