Skip to content

Commit 579eb5f

Browse files
committed
Document new ideas
1 parent f8f6d69 commit 579eb5f

File tree

1 file changed

+15
-0
lines changed

1 file changed

+15
-0
lines changed

msal/application.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1139,6 +1139,21 @@ def acquire_token_silent_with_error(
11391139
"""
11401140
assert isinstance(scopes, list), "Invalid parameter type"
11411141
self._validate_ssh_cert_input_data(kwargs.get("data", {}))
1142+
1143+
# TODO: TBD
1144+
# Currently, the following implementation activates Cloud Shell (CS) code path
1145+
# when a pseudo account was specified.
1146+
# But when/if the user signs in explicitly (such as "az login") with SAME account,
1147+
# to obtain tokens with scope(s) not supported by Cloud Shell's IMDS,
1148+
# the user would end up with one real account and still one pseudo account,
1149+
# both with same username.
1150+
# It would become unrealistic for end user to reason why
1151+
# the pseudo "default user" account would go one code path,
1152+
# and the real account would go another.
1153+
# I will probably refactor to automatically group Cloud Shell's default account
1154+
# and the real account into one, if they have same username.
1155+
# And then, acquire_token_silent() will always try real account if RT is available,
1156+
# and fallback to the Cloud Shell code path.
11421157
if account and account.get("home_account_id") == _CLOUD_SHELL_USER:
11431158
# Since we don't currently store cloud shell tokens in MSAL's cache,
11441159
# we can have a shortcut here, and semantically bypass all those

0 commit comments

Comments
 (0)