feat: add --use-device-code flag to auth login by iemejia · Pull Request #256 · microsoft/fabric-cli

iemejia · 2026-06-30T20:32:03Z

Add device code authentication flow for `fab auth login`, similar to `az login --use-device-code` in Azure CLI. This allows users to authenticate from environments where browser access is not available (SSH sessions, containers, remote servers, CI runners).

Usage

# Command-line
fab auth login --use-device-code
fab auth login --use-device-code --tenant <tenant_id>

# Interactive menu: \"Device code\" is now an option
fab auth login

The CLI displays a message like:

To sign in, use a web browser to open https://microsoft.com/devicelogin and enter the code XXXXXXXX

The user completes authentication on any device with a browser, and the CLI picks up the token.

Prerequisites to enable this feature

The current Fabric CLI app registration (`5814bfb4-2705-4994-b8d6-39aabeb5eaeb`) is configured as a confidential client. Device code flow is a public client flow (no client credentials are sent), so Azure AD currently rejects it with:

AADSTS7000218: The request body must contain the following parameter:
'client_assertion' or 'client_secret'.

To enable this feature, the app registration needs "Allow public client flows" enabled:

Azure Portal: App registrations > Authentication > Advanced settings > Allow public client flows > Yes
Manifest: Set `"allowPublicClient": true`

Once that setting is enabled, device code flow will work end-to-end.

Implementation details

Added `--use-device-code` argument to the auth login parser
Added `_acquire_token_by_device_code()` method using MSAL's `initiate_device_flow` and `acquire_token_by_device_flow` APIs
Silent refresh with `force_refresh=True` is attempted for subsequent scopes after the initial device code auth, so the user only needs to enter the code once
`_use_device_code` flag is wrapped in `try/finally` to ensure cleanup on failure
Fixed `acquire_token_silent` error handling: MSAL can return `{"error": "..."}` (not just `None`) when silent acquisition fails — now correctly falls through to interactive/device code flow
Added `device_code_flow_failed()` error message

Tests

8 new command-level tests covering: CLI flag, tenant arg, interactive selection, flag precedence over `--identity` and SPN args, flag reset on success/failure
11 new core-level tests covering: success path, silent refresh for subsequent scopes, fallback when silent fails, initiation failure, None/empty access token handling, KeyboardInterrupt, interactive_renew=False guard"
2>&1
GraphQL: Resource protected by organization SAML enforcement. You must grant your OAuth token access to this organization. (repository)
Authorize in your web browser: https://github.com/enterprises/microsoftopensource/sso?authorization_request=AAATM5BKJANCNTQNU5PG2YTKIQ2NBA5PN5ZGOYLONF5GC5DJN5XF62LEZYAF32PCVVRXEZLEMVXHI2LBNRPWSZGPAAAAAAI4P3ULNL3DOJSWIZLOORUWC3C7OR4XAZNLJ5QXK5DIIFRWGZLTOM
Still blocked. The gh token hasn't been SSO-authorized yet. I literally cannot create the PR via the API until that authorization goes through.
Go to this URL to create it from the browser (it will pre-fill from your branch):
https://github.com/microsoft/fabric-cli/compare/main...iemejia:fabric-cli:login-device-code?expand=1
That's the PR creation page. Your browser session should already have SSO access. Just paste the title/body I gave you in the previous message.

Copilot

Pull request overview

Adds an optional device-code authentication path to fab auth login so users can authenticate in environments without browser access (e.g., SSH/containers/CI), integrating MSAL’s device flow into the existing FabAuth token acquisition pipeline.

Changes:

Introduces --use-device-code to the auth login parser and adds an interactive menu option (“Device code”).
Implements a device-code token acquisition helper in FabAuth and wires it into acquire_token() as an alternative to interactive browser auth.
Adds/updates command-level and core-level tests covering device-code success, silent-refresh behavior, fallbacks, and error cases.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`src/fabric_cli/core/fab_auth.py`	Adds device-code flow helper and routes user auth renewals through device-code when enabled; adjusts silent-failure handling to treat MSAL `{ "error": ... }` as a failure.
`src/fabric_cli/commands/auth/fab_auth.py`	Exposes device-code login via CLI flag and interactive selection; toggles device-code mode during token acquisition.
`src/fabric_cli/parsers/fab_auth_parser.py`	Adds `--use-device-code` flag and help example to `fab auth login`.
`src/fabric_cli/errors/auth.py`	Adds a dedicated error message for device-code flow initiation failures.
`tests/test_core/test_fab_auth.py`	Adds unit tests for device-code helper and acquire-token integration behavior.
`tests/test_commands/test_auth.py`	Adds command-level tests for CLI flag behavior, interactive selection, precedence rules, and flag cleanup.

+    if args.use_device_code:
+        FabAuth().set_access_mode("user", args.tenant)
+        FabAuth()._use_device_code = True
+        try:
+            FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
+            FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)


+            elif selected_auth == "Device code":
+                FabAuth().set_access_mode("user", args.tenant)
+                FabAuth()._use_device_code = True
+                try:
+                    FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
+                    FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
+                    FabAuth().get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)
+                finally:
+                    FabAuth()._use_device_code = False


Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

    assert exc_info.value.status_code == con.ERROR_AUTHENTICATION_FAILED
-    assert (
-        exc_info.value.message
-        == ErrorMessages.Auth.token_acquisition_failed()
-    )
+    assert exc_info.value.message == ErrorMessages.Auth.token_acquisition_failed()
    assert exc_info.value.status_code == con.ERROR_AUTHENTICATION_FAILED


                )
        return self.app

+    def _acquire_token_by_device_code(self, scope: list[str]) -> dict:


+    if args.use_device_code:
+        FabAuth().set_access_mode("user", args.tenant)
+        FabAuth()._use_device_code = True
+        try:
+            FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)


+            elif selected_auth == "Device code":
+                FabAuth().set_access_mode("user", args.tenant)
+                FabAuth()._use_device_code = True
+                try:
+                    FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)


Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/fabric_cli/core/fab_auth.py:274

_acquire_token_by_device_code is currently defined at module scope (no class indentation). This makes self._acquire_token_by_device_code(...) in acquire_token() fail and will also trigger an IndentationError when the next method definition is encountered. Indent the def line so it becomes a proper FabAuth method.

                        con.IDENTITY_TYPE: "service_principal",

Add device code authentication flow for environments where browser access is not available. Users can now authenticate by entering a code at https://microsoft.com/devicelogin from any device with a browser. Usage: fab auth login --use-device-code fab auth login --use-device-code --tenant <tenant_id> The option is also available in the interactive authentication menu as "Device code". Implementation: - Add --use-device-code argument to the auth login parser - Add _acquire_token_by_device_code() using MSAL's initiate_device_flow and acquire_token_by_device_flow APIs - Add device_code_flow_failed() error message - Wrap device code flow in try/finally to ensure flag cleanup on failure - Use silent refresh for subsequent scopes after initial device code auth Assisted-by: GitHub Copilot:claude-opus-4.6

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

    assert exc_info.value.status_code == con.ERROR_AUTHENTICATION_FAILED
-    assert (
-        exc_info.value.message
-        == ErrorMessages.Auth.token_acquisition_failed()
-    )
+    assert exc_info.value.message == ErrorMessages.Auth.token_acquisition_failed()
    assert exc_info.value.status_code == con.ERROR_AUTHENTICATION_FAILED


+        Raises:
+            FabricCLIError: When device code flow initiation or token acquisition fails
+        """


Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

+        self._use_device_code = True
+        try:
+            yield
+        finally:
+            self._use_device_code = False


-                        prompt="select_account",
-                        parent_window_handle=msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE,
-                    )
+                if (token is None or token.get("error")) and interactive_renew:


+        Returns:
+            Full MSAL result dictionary containing access_token, expires_on, etc.,
+            or None if the device flow returns no result.        Raises:
+            FabricCLIError: When device code flow initiation or token acquisition fails
+        """


iemejia requested a review from a team as a code owner June 30, 2026 20:32

Copilot AI review requested due to automatic review settings June 30, 2026 20:32

Copilot started reviewing on behalf of iemejia June 30, 2026 20:32 View session

iemejia force-pushed the login-device-code branch from 3f00d3a to 49775d9 Compare June 30, 2026 20:34