@@ -1139,6 +1139,21 @@ def acquire_token_silent_with_error(
1139
1139
"""
1140
1140
assert isinstance (scopes , list ), "Invalid parameter type"
1141
1141
self ._validate_ssh_cert_input_data (kwargs .get ("data" , {}))
1142
+
1143
+ # TODO: TBD
1144
+ # Currently, the following implementation activates Cloud Shell (CS) code path
1145
+ # when a pseudo account was specified.
1146
+ # But when/if the user signs in explicitly (such as "az login") with SAME account,
1147
+ # to obtain tokens with scope(s) not supported by Cloud Shell's IMDS,
1148
+ # the user would end up with one real account and still one pseudo account,
1149
+ # both with same username.
1150
+ # It would become unrealistic for end user to reason why
1151
+ # the pseudo "default user" account would go one code path,
1152
+ # and the real account would go another.
1153
+ # I will probably refactor to automatically group Cloud Shell's default account
1154
+ # and the real account into one, if they have same username.
1155
+ # And then, acquire_token_silent() will always try real account if RT is available,
1156
+ # and fallback to the Cloud Shell code path.
1142
1157
if account and account .get ("home_account_id" ) == _CLOUD_SHELL_USER :
1143
1158
# Since we don't currently store cloud shell tokens in MSAL's cache,
1144
1159
# we can have a shortcut here, and semantically bypass all those
0 commit comments