Simpler authentication for the CLI and CI/CD pipelines

[odinr]

We've overhauled how the Fusion Framework CLI handles authentication. The headline: your CI/CD pipelines no longer need to manually acquire and pass around access tokens, and locally ffc auth token finally remembers that you already logged in.

What's new

The CLI now uses Azure Identity under the hood instead of raw MSAL. Two things change in practice:

1. No more FUSION_TOKEN plumbing in pipelines

Previously, every GitHub Actions workflow that called ffc commands needed a dedicated step to fetch an access token and export it as FUSION_TOKEN:

# ❌ Before — manual token acquisition required
- name: Azure Login
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.CLIENT_ID }}
    tenant-id: ${{ secrets.TENANT_ID }}
    allow-no-subscriptions: true

- name: Get Access Token
  run: |
    echo "FUSION_TOKEN=$(az account get-access-token \
      --scope ${{ vars.SCOPE }} \
      --query accessToken --output tsv)" >> $GITHUB_ENV

- name: Run CLI command
  run: ffc app publish

Now the CLI picks up the Azure session automatically — just azure/login and go:

# ✅ After — CLI resolves credentials from the environment
- name: Azure Login
  uses: azure/login@v3
  with:
    client-id: ${{ vars.SP_CLIENT_ID }}
    tenant-id: 3aa4a235-b6e2-48d5-9195-7fcf05b459b0
    allow-no-subscriptions: true

- name: Run CLI command
  run: ffc app publish

No az account get-access-token, no FUSION_TOKEN, no extra step. The CLI detects the logged-in Azure session and acquires tokens on its own. This works with OIDC federation, managed identity, service principals, and az login — anything DefaultAzureCredential supports.

2. Login persists across terminal restarts

Locally, ffc auth login now stores your credentials in the OS keychain (Keychain on macOS, DPAPI on Windows, libsecret on Linux). That means:

• Run ffc auth login once
• Close your terminal, reboot, come back tomorrow
• ffc auth token still works — no browser prompt

Previously every ffc auth token call would open the browser again because nothing was persisted between sessions.

What you need to do

Locally: Run ffc auth login once after upgrading. The old token cache is not carried over.

In pipelines: You can remove the Get Access Token / FUSION_TOKEN step. Just make sure azure/login runs before any ffc commands.

The existing @equinor/fusion-framework-module-msal-node package is not removed — if your code uses it directly, nothing changes.

Learn more

• CLI Authentication docs
• Azure Identity Module README

Released packages

Package	Version	Release
@equinor/fusion-framework-module-azure-identity	0.2.0	Release
@equinor/fusion-framework-cli	15.0.0	Release
@equinor/fusion-framework-module-msal-node	4.1.1	Release