Add token cache on AzureCliCredential

[mmaitre314]

Is your feature request related to a problem? Please describe.

Access tokens are not cached for AzureCliCredential, which adds 3s to every single HTTP request that needs an access token. This quickly adds up and slows down development work.

Describe the solution you'd like

Cache tokens for the duration of their lifetime minus 5 minutes.

Describe alternatives you've considered

A decorator can be used to intercept calls to AzureCliCredential.get_token() and cache tokens:

import time
import azure.identity
from azure.core.credentials import AccessToken

_access_tokens: dict[tuple[str], AccessToken] = {}

_get_token = azure.identity.AzureCliCredential.get_token

def get_token_decorator(self, *scopes: str, claims: Optional[str] = None, tenant_id: Optional[str] = None, **kwargs: Any) -> AccessToken:
	token = _access_tokens.get(scopes, None)
	if token is None or int(time.time()) >= token.expires_on - 300:
		token = _get_token(self, *scopes, claims = claims, tenant_id = tenant_id, **kwargs)
		_access_tokens[scopes] = token
	return token

azure.identity.AzureCliCredential.get_token = get_token_decorator

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[xiangyan99]

Thanks for reaching out.

This is by design that we don't cache access token from azure cli in memory.

The reason is in the case that users log out in azure cli, caching it may introduce security concerns.

[github-actions]

Hi @mmaitre314. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[mmaitre314]

Makes sense. There is potential to refine the design to better handle cases where developers do not log out, which is the case for most developers I interact with. This could be an opt-in mechanism. Security-wise, it would be better to have an official implementation than to have users roll out custom (and likely buggy) caching.