token refresh offset

[xiangyan99]

No description provided.

[xiangyan99]

/azp run python - identity - ci

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[chlowell]

Should this be

Suggested change

	if expires_on - 30 > int(time.time()):
	if expires_on - self._token_refresh_timeout > int(time.time()):

or is there some rationale for always using 30 seconds?

[xiangyan99]

It is not _token_refresh_timeout.

We don't have a clear design for this value but it must be less than _token_refresh_offset (default to 120). Or it will hide the auto refresh feature.

The old one 300 does not meet the requirement so I updated it to 30.

[chlowell]

I wonder whether we need an explicit margin here. The 1s margin in if expires_on > int(time.time()) seems okay to me. My reasoning:

• functionally, this line served to hardcode token_refresh_offset=300
  • if all cached tokens would expire within 300 seconds, this method would return None, prompting the caller to acquire a new token
• token_refresh_offset will now be observed by callers of this method
• when a caller enters its refresh window, it should begin trying to acquire a new token
• while trying to acquire a new token, the caller should return any valid token it has

One bad outcome that could follow is the caller using a token that expires in flight. That request will fail, but the caller's other option was to raise without sending the request at all, because it couldn't acquire a new token. It seems better to try the request, which could after all succeed.

What do you think?

[xiangyan99]

The difference is when it is still in token_refresh_retry_timeout time frame.

Extreme case: user gets a token from us which expires in 1s. It is still in token_refresh_retry_timeout time frame so it does not get refreshed.

vs

They get None from us so it forces a refresh.

[chlowell]

But if the credential is waiting on the retry timeout, it won't try to get a new token, regardless of what it gets back from the cache. Returning None in that case only guarantees the current request will fail, no?

[xiangyan99]

No. if there is no valid token (it returns None), no matter it is in retry timeout window or not, we will try to get one.

Retry timeout only applies to there is A valid token but it is within the refresh offset window.

[chlowell]

Ah, I overlooked this behavior. Credentials should observe the retry timeout when the cache is empty.

[schaabs]

I'm not sure this is the behavior we want. If we have no access_token and the first attempt to get one failed, do we really want to hold all requests for 30 seconds before attempting to get one? I think we need to clarify this more.

[xiangyan99]

My opinion is if there is no one available, every time user calls our library to get one, we will try it w/o a cool down time.

[chlowell]

I wonder whether we need an explicit margin here. The 1s margin in if expires_on > int(time.time()) seems okay to me. My reasoning:

• functionally, this line served to hardcode token_refresh_offset=300
  • if all cached tokens would expire within 300 seconds, this method would return None, prompting the caller to acquire a new token
• token_refresh_offset will now be observed by callers of this method
• when a caller enters its refresh window, it should begin trying to acquire a new token
• while trying to acquire a new token, the caller should return any valid token it has

One bad outcome that could follow is the caller using a token that expires in flight. That request will fail, but the caller's other option was to raise without sending the request at all, because it couldn't acquire a new token. It seems better to try the request, which could after all succeed.

What do you think?

[chlowell]

Credentials also need to expose the refresh offset in their public API, for the authentication policy.

[chlowell]

But if the credential is waiting on the retry timeout, it won't try to get a new token, regardless of what it gets back from the cache. Returning None in that case only guarantees the current request will fail, no?

[xiangyan99]

Credentials also need to expose the refresh offset in their public API, for the authentication policy.

Do you mean BearerTokenCredentialPolicy?

refresh offset is only configurable in ctor. I don't see BearerTokenCredentialPolicy call credential ctors.

[chlowell]

Yes, recall that BearerTokenCredentialPolicy doesn't call get_token on every request. It waits until the last token it received is about to expire, as determined by a hardcoded value.

[xiangyan99]

Yes, recall that BearerTokenCredentialPolicy doesn't call get_token on every request. It waits until the last token it received is about to expire, as determined by a hardcoded value.

Yes. And given we implemented the cache functionality in get_token. I don't see a requirement to update the default value of _need_new_token

[chlowell]

What if I want to refresh tokens 6 minutes before they expire?

[xiangyan99]

What if I want to refresh tokens 6 minutes before they expire?

This is a good point. Please open a separate issue to track it. We cannot fix both of them in same PR because that one needs core changes and per our rule, core changes cannot combine with other changes in same PR.

[schaabs]

Should this be using the constant you've defined?

[chlowell]

As I commented on another instance of this, I'm not certain we need any margin here. We want credentials to return cached tokens as necessary so long as they're valid; doesn't that imply having the cache return a token right up until its expiry?

[xiangyan99]

Margin removed.

[schaabs]

Should we be logging refreshes which fail here? Is this already done in _redeem_refresh_token?

[xiangyan99]

This is a good question.

I am leaning towards not logging it because:

• if there is a valid token available, user will continue to use that one and there is no need to log it.
• if there is no valid token, user cannot get one and we will log that event (already implemented)

[schaabs]

This logic:

if not token:
  # get new token
elif should_refrsesh:
  try:
     # get new token
  except Exception:
     # swallow

seems to be present in most if not all the credentials. Perhaps it could be moved into a base or mixin, and have the implementation just provide a callback or an override for the # get new token functionality?

[xiangyan99]

Agreed. But different credentials have different ways to refresh/redeem tokens. So I have not found a clean way to do it.

[chlowell]

What do you think of something like this:

class CredentialBase(ABC):
    def __init__(self, **kwargs):
        self._client = AadClient(...)

    def _get_token_impl(*scopes, **kwargs):
        if not scopes:
            raise ValueError('"get_token" requires at least one scope')

        token = self._client.get_cached_access_token(scopes)
        if not token:
            token = self._request_token(scopes, **kwargs)
        elif self._client.should_refresh(token):
            try:
                self._request_token(scopes, **kwargs)
            except Exception:  # pylint:disable=broad-except
                pass
        return token

    @abc.abstractmethod
    def _request_token(self, *scopes, **kwargs):
        pass

class Credential(CredentialBase):
    def get_token(*scopes, **kwargs):
        """relevant user-facing docstring"""
        return self._get_token_impl(*scopes, **kwargs)

    def _request_token(*scopes, **kwargs):
        """get a new token according to this credential's personal idiom"""
        ...

[xiangyan99]

Do you mean we make a shared credential base?

I would like to have it into a separate issue/PR as code refactoring.

[chlowell]

Refactoring always has a lower priority than new features. Merging this code is an open-ended commitment to maintaining it as is, so it's worth investigating a better organization now. The one I sketched may have its own problems (e.g. multiple inheritance would require some care) but it seems workable. What do you think? Have you tried something similar already?

[xiangyan99]

I think when we do refactoring by adding a shared class for all credentials, we can do further than only this. But I don't want to rush it right before a release.

[chlowell]

#12601