Current azure-cli-core not compatible with track2 management libraries

[kraigb]

• Package Name: azure-cli-core
• Package Version: 2.12.1
• Operating System:
• Python Version: 3.8

Describe the bug

I’m working on updating the Python Developer Center's example pages for track 2 management libraries, starting with https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-example-resource-group (and its peers in the TOC).

These examples use azure.common.client_factory.get_client_from_cli_profile because these are provisioning scripts that are equivalent to what one might do with the Azure CLI. Thus it’s appropriate to use the CLI profile login rather than using a method like DefaultAzureCredential (which apparently doesn't use CLI credentials etc.), because the latter requires that the service principal in question has been assigned the appropriate role permissions. Although it's possible to just assign the SP some very broad role, I'd rather not add that (potentially dangerous) complexity to the examples. By using the CLI profile, it's clear that you're inheriting that profile's permissions.

Unfortunately, it appears that the azure-cli-core library hasn't been updated and still has dependencies v10.2.0 of azure-mgmt-resource. If I attempt to use the track 2 azure-mgmt-resource library instead, I end up getting warnings about incompatible versions of msal and msal-extensions.

Specifically, if I install azure-mgmt-resource (v15), and the install azure-cli-core, it forcibly regresses azure-mgmt-resource to v10 and reports:

ERROR: azure-identity 1.4.0 has requirement msal<2.0.0,>=1.3.0, but you'll have msal 1.0.0 which is incompatible.
ERROR: azure-identity 1.4.0 has requirement msal-extensions~=0.2.2, but you'll have msal-extensions 0.1.3 which is incompatible.

That said, if I install azure-cli-core first, then install v15 of azure-mgmt-resource and ignore the incompatibility error, the code actually works. (Error is: ERROR: azure-cli-core 2.12.1 has requirement azure-mgmt-resource==10.2.0, but you'll have azure-mgmt-resource 15.0.0 which is incompatible.) But this of course is not a viable workaround for customers.

To Reproduce
See above
1.

Expected behavior
There's a version of azure-cli-core that's compatible with track2 libraries.

[yonzhan]

azure-cli-core

[lmazuel]

@chlowell I'd like your two cents on CLI auth and azure-identity.

@kraigb we are trying to deprecate azure-common, so I wonder if we should not take a step back and rewrite a little more with azure-identity instead

[chlowell]

As of azure-identity 1.4.0, applications can use either AzureCliCredential or DefaultAzureCredential to authenticate as the identity signed in to the CLI. This is implemented by invoking the CLI in a subprocess, so I expect it's less performant than azure-cli-core but still acceptable for local development and scripting.

[kraigb]

OK, so examples that have been using azure.common.client_factory.get_client_from_cli_profile should be switched over to using AzureCliCredential, correct? I tried it and it worked as expected (without needing a role assignment), but I want to make sure that AzureCliCredential is intended to be used in this way.

@lmazuel Changing to AzureCliCredential will mean removing azure.common references, except for one piece in the auth article that notes the legacy usage. However, I can't full make that change until the azure.mgmt.web and azure.mgmt.rdbms libraries are updated to track2.

[chlowell]

Right, there's nothing special about AzureCliCredential for clients. To a client it's just another credential. So instead of calling get_client_from_cli_profile you would construct a client as usual, giving it an instance of AzureCliCredential.

[kraigb]

@lmazuel Given the discussion here, is it proper to not expect azure-cli-core to be suitably updated for track2? If that's the case, then I can close this issue.

[jsntcy]

@kraigb , if we need update azure-cli-core, we'll create issue in https://github.com/Azure/azure-cli/issues for us to track as this repo is only for python SDK.

@lmazuel , please help confirm.
cc @jiasli

[lmazuel]

Closing this issue, since as @kraigb said it is not an aim anymore to consider azure-cli-core installable by SDKs. Please use azure-identity instead. People reading this issue, you might want to follow when the support for azure-identity is coming to your SDK package here: #9310