Enable persistent cache for user credentials on Linux and macOS

[chlowell]

Azure/azure-sdk-for-java#9188 has design details.

• adopt msal-extensions~=0.2.0
• extend cache loading code to include Linux, macOS
• add keyword argument for opting in to unencrypted fallback (allow_unencrypted_cache)
  • update documentation
    • in particular, Linux requirements

[chlowell]

This is available now in azure-identity 1.4.0b4. DeviceCodeCredential, InteractiveBrowserCredential, and UsernamePasswordCredential cache in memory by default. The argument enable_persistent_cache opts in to persistent caching. On Linux the cache is encrypted by default, which requires libsecret and PyGObject. You can disable this requirement with the argument allow_unencrypted_cache, which configures the credential to use a plaintext cache when encryption isn't possible.

For example:

from azure.identity import InteractiveBrowserCredential

# opting in to persistent caching
credential = InteractiveBrowserCredential(enable_persistent_cache=True)

# forgoing encryption when it isn't possible
credential = InteractiveBrowserCredential(
    enable_persistent_cache=True, allow_unencrypted_cache=True
)

[jgentil]

Was this rolled back? patch notes indicates that it would be fixed in 1.5.0b1 but as of 1.5.0b2 it has not:

• Removed application authentication APIs added in 1.4.0 beta versions. These
  will be reintroduced in 1.5.0b1. Passing the keyword arguments below
  generally won't cause a runtime error, but the arguments have no effect.
  • Removed authenticate method from DeviceCodeCredential,
    InteractiveBrowserCredential, and UsernamePasswordCredential
  • Removed allow_unencrypted_cache and enable_persistent_cache keyword
    arguments from CertificateCredential, ClientSecretCredential,
    DeviceCodeCredential, InteractiveBrowserCredential, and
    UsernamePasswordCredential

Is there a plan to reintroduce these?

[chlowell]

I believe #13070 restored that API for 1.5.0b1, and it's present in 1.5.0b2 as well. What's still missing?

[tomerparnasa]

Hi, enable_persistent_cache=True does not seem to be working, I tried to use it in 1.5.0b2 and 1.5.0 on a mac device, and every time I am executing my code I get redirected to the web interface to approve my login.
We found only a reference for this when the SDK tries to load a cached token. but nothing regarding writing it in the cache. the cache is located at ~/.IdentityService/msal.cache if I understand it right

[chlowell]

The API we're discussing here isn't in 1.5.0. We removed it from the stable release because we're redesigning it in light of new requirements. In the meantime this API is available in 1.5.0b2, and I expect it to work on a mac. Can you add a code example of what your application is doing? There's a bit more to it than enable_persistent_cache=True. The cache may contain multiple identities, so a newly constructed credential needs to know which to authenticate. The user authentication sample walks through this. Here's the gist:

# if your application hasn't authenticated a user yet, create a credential
# and call authenticate() to get an AuthenticationRecord
credential = InteractiveBrowserCredential(enable_persistent_cache=True)
record = credential.authenticate() 

# serialize the record and store it however you like (it contains no secrets)
serialized_record = record.serialize()

# on subsequent runs, initialize a credential with the record
record = AuthenticationRecord.deserialize(serialized_record)
credential = InteractiveBrowserCredential(enable_persistent_cache=True, authentication_record=record)