Credentials flow and refresh_token: IndexError Exception

[tbronson]

While using the credentials flow (app permissions), refresh_token can fail with an IndexError.

connection.py line 884

result = self.msal_client.acquire_token_silent_with_error(
            scopes=scopes,
            account=self.msal_client.get_accounts(username=self.username)[0],
        )

get_accounts can and does return an empty list when using app credentials, rather than delegated user credentials

[alejcas]

While using the credentials flow (app permissions), refresh_token can fail with an IndexError.

connection.py line 884

result = self.msal_client.acquire_token_silent_with_error(
scopes=scopes,
account=self.msal_client.get_accounts(username=self.username)[0],
)
get_accounts can and does return an empty list when using app credentials, rather than delegated user credentials

Hey, sorry for the late response...
I understand why it happens and in fact client credentials should not need an account to refresh the token.

BUT:

Seems like the account is required despite the confusing type annotations.

How do you think this should be fixed?

[alejcas]

Can you test if the change introduced here: 08c3e00 works?

[andhreljaKern]

Hello,
we're having the same issue, here is our account initialisation:

account = Account(
    credentials=(
        client_id,
        {
            "public_certificate": True,
            "passphrase": certificate_passphrase,
            "private_key_pfx_path": cert_file,
        },
    ),
    auth_flow_type="credentials",
    tenant_id=tenant_id,
    token_backend=FileSystemTokenBackend(
        token_path=token_path,
        token_filename=token_filename,
    ),
    protocol=MSGraphProtocol
)

I tested using the latest commit from master (f853723) and received the following error:

I tried using my Client ID as username, but I couldn't even authenticate the Account with this configuration

[alejcas]

Sorry for the late response. Seems like the error is because the scopes param is not a list.

What scopes are you passing and how?

[andhreljaKern]

No worries, thank you for looking into it! I'm not sending any scopes params, I leave it up to the default MSGraphProtocol to deal with those. However, given it didn't work as expected for me, and I needed a workaround, here is what I'm using when "refresh_token" raises an error:

def reacquire_client_credentials_token(con: Connection, protocol: Protocol) -> bool:
    if con.auth_flow_type != "credentials":
        raise ValueError(
            "reacquire_client_credentials_token only applies when "
            'auth_flow_type is "credentials"'
        )
    tb = con.token_backend
    lock = getattr(tb, "_lock", contextlib.nullcontext())
    with lock:
        tb._cache.clear()
    try:
        tb.delete_token()
    except (NotImplementedError, Exception):
        pass
    scopes = [protocol.prefix_scope(".default")]
    return bool(con.request_token(None, requested_scopes=scopes))

I call this with

# also works with (file.con, file.protocol) - I do this on every invocation to the Graph API, 
# this makes the workaround dirty but acceptable
reacquire_client_credentials_token(account.con, account.protocol)