interactive mode results in an empty refresh_token

[kaplik]

As described here in #311 it looks like interactive login mode is not getting a refresh token, so reauth is required every ~70 minutes (validity of AAD access token). It looks like all the upstream issues mentioned in the original issue #311 in azure go sdk are closed/implemented.

Using interactive is IMO more user-friendly and should support caching of the refresh token in a similar way to how devicecode works.

[weinong]

Token caching is only supported in v1.8.0-beta
https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/TOKEN_CACHING.MD?plain=1#L21

[jan-di]

I think azidentity sdk 1.8.0 was released yesterday:
https://github.com/Azure/azure-sdk-for-go/releases/tag/sdk%2Fazidentity%2Fv1.8.0

And there is already a dependabot pull request :-)
#534

[weinong]

cool. I will take a look next week. I actually re-wrote almost everything in https://github.com/weinong/kubelogin/tree/feat/token-cache with preview sdk. If you want to test, go for it! I need to add tests.

[kaplik]

@weinong hey, i tested the solution from the branch you are linking, and it looks good... The cache file is created, and credentials including refresh token are stored in keychain (in case of MacOS).

bin/darwin_arm64/kubelogin get-token --environment AzurePublicCloud --server-id 89aa061c-ede6-4e68-bd4a-2c23431b0f4b --client-id 89aa061c-ede6-4e68-bd4a-2c23431b0f4b --tenant-id 6340c229-1168-42c9-bd2b-ada6ac670485 -l interactive -v 99
I0121 16:37:45.496469   66042 execCredentialPlugin.go:29] Login Method: interactive, Environment: AzurePublicCloud, TenantID: 6340c229-1168-42c9-bd2b-ada6ac670485, ServerID: 89aa061c-ede6-4e68-bd4a-2c23431b0f4b, ClientID: 89aa061c-ede6-4e68-bd4a-2c23431b0f4b, IsLegacy: false, msiResourceID: , Timeout: 30s, tokenCacheDir: /Users/.../.kube/cache/kubelogin/, tokenCacheFile: /Users/.../.kube/cache/kubelogin/AzurePublicCloud-89aa061c-ede6-4e68-bd4a-2c23431b0f4b-89aa061c-ede6-4e68-bd4a-2c23431b0f4b-6340c229-1168-42c9-bd2b-ada6ac670485.json, AZURE_CONFIG_DIR:
I0121 16:37:45.580438   66042 execCredentialPlugin.go:58] using credential: InteractiveBrowserCredential
I0121 16:37:45.580473   66042 execCredentialPlugin.go:80] getting token with scopes: [89aa061c-ede6-4e68-bd4a-2c23431b0f4b/.default]
{"kind":"ExecCredential","apiVersion":"client.authentication.k8s.io/v1beta1","spec":{"interactive":false},"status":{"expirationTimestamp":"2025-01-21T17:03:29Z","token":"....."}}

any chance that the suggested changes can be merged and released?