[Profile] az login: Fall back to device code flow in GitHub Codespaces
#27443
Conversation
sinedied
requested review from
jiasli,
evelyn-ys,
calvinhzy,
jsntcy,
kairu-ms,
zhoxing-ms and
necusjz
as code owners
️✔️AzureCLI-FullTest
|
azure-client-tools-bot-prd
bot
added this to the October 2023 (2023-11-15)❗ Breaking change release ❗ milestone
️✔️AzureCLI-BreakingChangeTest
|
|
Add specific logic to fallback to device code in GitHub Codespaces |
microsoft-github-policy-service
bot
added
Account
sinedied
force-pushed
the
fix-codespaces
branch
3 times, most recently
from
d7553e6
to
352a6d9
Compare
sinedied
force-pushed
the
fix-codespaces
branch
from
352a6d9
to
d65cd93
Compare
|
Tests are finally green 🙂 |
|
@sinedied, thanks for your contribution. Device code has some known limitations with Conditional Access policies (#16401), so we prefer users to use auth code flow. See https://learn.microsoft.com/en-us/cli/azure/microsoft-graph-migration#graph-command-fails-with-aadsts50005-or-aadsts53000 Also, as users can use |
yonzhan
modified the milestones:
October 2023 (2023-11-14)❗ Breaking change release ❗,
Backlog
jiasli
changed the title
az login: Fall back to device code flow in GitHub Codespaces (#20315)
jiasli
changed the title
az login: Fall back to device code flow in GitHub Codespaces (#20315)az login: Fall back to device code flow in GitHub Codespaces
|
@jiasli sorry for the delay, I missed the notification last week. My last update I received by mail was that you weren't going to merge it, but if this has changed please reopen this PR and I'll get it updated today |
Co-authored-by: Jiashuo Li <4003950+jiasli@users.noreply.github.com>
|
I have verified the PR works as expected in GitHub Codespaces:
Testing steps:
|
|
Hello - wondering if there would be any consideration given to either reverting this change or adding a CLI flag to bypass this check? The exception is when using Codespaces on Web which does not support binding ports to 127.0.0.1 - though this could be worked around by allowing the end user to pass a replacement value for We have worked around with |
Are you using a local VS Code to connect to Codespaces? I can indeed get it working as VS Code automatically maps
This is also documented at https://docs.github.com/en/codespaces/developing-in-a-codespace/forwarding-ports-in-your-codespace#using-command-line-tools-and-rest-clients-to-access-ports
No, this can't be done. This explained in #20315 (comment). |
|
BTW, I encountered a weird issue that the local VS Code somtimes cannot launch a web browser (Edge, Chrome). Instead, it launches a text-based browser in the terminal.
This can be triggered by directly running: |
Yes, we are using local VSCode. Makes sense re: the redirect URL issue and we have been able to get by w/ using VSCode desktop or reverting to the device code method manually.
Just tried this on my end and it immediately opened a browser window, when running on |
|
FWIW, we are using Codespaces with VSCode extensively, and the old workflow (automatic port forwarding + web browser) was working fine for us. With this fix, we are now discovering that login via device code flow gets somewhat different permissions; in our case breaking For now will be using |
|
We have the same issue with @tallaxes. Forcing device code login breaks And if I try to fetch the object ID, I get The workaround with |
Related command
az loginDescription
This PR fixes the long standing issue of
az loginnot working in GitHub Codespaces (#20315).For that it uses a simple workaround, the same used in the gh CLI: if the
CODESPACES=trueenvironnement variable is set, it falls back to using a device code login.Testing Guide
az login-> by default, it should run the web browser loginCODESPACES=true az login-> it should automatically fallback to device code login. You can also simply runaz loginin GitHub Codespaces :)