Azure credentials

Freeleapp relies on the Azure CLI (2.30.0 or later), which stores tokens in ~/.azure/msal_token_cache.json and profiles in ~/.azure/azureProfile.json. Freeleapp keeps the long-lived part of those tokens in the keychain and leaves only short-lived ones in the Azure CLI files.

Logging in to an integration

1. Clean msal_token_cache.json and azureProfile.json.
2. Run az login --tenant <tenant-id> to get the user profile and a refresh token for the integration.
3. Create a session for each subscription in the tenant.
4. Save the refresh token, account and profile in the system vault.
5. Remove that information from the Azure CLI files.

Starting a session

Only one Azure session can be active at a time.

1. Read the refresh token, account and profile from the vault.
2. Write the profile of the chosen subscription to azureProfile.json, and the account and refresh token to msal_token_cache.json.
3. Run az account get-access-token --subscription <subscription-id> to get the access and ID tokens, which the CLI writes to its cache.
4. Save the updated refresh token in the vault and remove it from msal_token_cache.json.

A refresh token can last up to 90 days; an access token lasts about 70 minutes.

Rotating and stopping

Every 20 minutes Freeleapp checks whether the access token expires soon. If it does, it puts the refresh token back in the cache, requests new tokens and removes the refresh token again.

Stopping the session runs az logout, which clears both Azure CLI files.