Skip to content

Commit e4e692c

Browse files
PetarSDimovPetar DimovCopilot
authored
Fix the PoP flow in the console app (#887)
* Fix PoP flow in the test app Currently the test app sends both PoP parameters (see placeholder_auth_scheme definition) and also passes req_cnf and token type. There parameters are not compatible. If application passes PoP parameters, then MSAL (or the broker) owns the key and does the signing of the SHR. If application passes req_cnf, then application owns the key and creates and signs the SHR, so in this case it should not pass PoP parameters. The main flow is the first one - application passes only PoP parameters and either MSAL or the broker owns the key and generates the SHR. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Petar Dimov <petard@ntdev.microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 2de45ae commit e4e692c

File tree

1 file changed

+1
-11
lines changed

1 file changed

+1
-11
lines changed

msal/__main__.py

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -189,21 +189,11 @@ def _acquire_ssh_cert_interactive(app):
189189
if result.get("token_type") != "ssh-cert":
190190
logging.error("Unable to acquire an ssh-cert")
191191

192-
_POP_KEY_ID = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-AAAAAAAA' # Fake key with a certain format and length
193-
_RAW_REQ_CNF = json.dumps({"kid": _POP_KEY_ID, "xms_ksl": "sw"})
194-
_POP_DATA = { # Sampled from Azure CLI's plugin connectedk8s
195-
'token_type': 'pop',
196-
'key_id': _POP_KEY_ID,
197-
"req_cnf": base64.urlsafe_b64encode(_RAW_REQ_CNF.encode('utf-8')).decode('utf-8').rstrip('='),
198-
# Note: Sending _RAW_REQ_CNF without base64 encoding would result in an http 500 error
199-
} # See also https://github.com/Azure/azure-cli-extensions/blob/main/src/connectedk8s/azext_connectedk8s/_clientproxyutils.py#L86-L92
200-
201192
def _acquire_pop_token_interactive(app):
202193
"""Acquire a POP token interactively - This typically only works with Azure CLI"""
203194
assert isinstance(app, msal.PublicClientApplication)
204195
POP_SCOPE = ['6256c85f-0aad-4d50-b960-e6e9b21efe35/.default'] # KAP 1P Server App Scope, obtained from https://github.com/Azure/azure-cli-extensions/pull/4468/files#diff-a47efa3186c7eb4f1176e07d0b858ead0bf4a58bfd51e448ee3607a5b4ef47f6R116
205-
result = _acquire_token_interactive(app, scopes=POP_SCOPE, data=_POP_DATA)
206-
print_json(result)
196+
result = _acquire_token_interactive(app, scopes=POP_SCOPE)
207197
if result.get("token_type") != "pop":
208198
logging.error("Unable to acquire a pop token")
209199

0 commit comments

Comments
 (0)