az login / az account clear fail: json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

[Persedes]

Describe the bug

Command Name
az login

Errors:

az account clear
The command failed with an unexpected error. Here is the traceback:
Expecting value: line 1 column 1 (char 0)
Traceback (most recent call last):
  File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
    raise ex
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
    result = cmd_copy(params)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
    return self.handler(*args, **kwargs)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
    return op(**command_args)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/command_modules/profile/custom.py", line 97, in account_clear
    profile.logout_all()
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/_profile.py", line 296, in logout_all
    identity.logout_all_users()
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/auth/identity.py", line 203, in logout_all_users
    accounts = self._msal_app.get_accounts()
  File "/opt/az/lib/python3.10/site-packages/msal/application.py", line 1066, in get_accounts
    accounts = self._find_msal_accounts(environment=self.authority.instance)
  File "/opt/az/lib/python3.10/site-packages/msal/application.py", line 1108, in _find_msal_accounts
    for a in self.token_cache.find(
  File "/opt/az/lib/python3.10/site-packages/msal_extensions/token_cache.py", line 77, in find
    self._reload_if_necessary()
  File "/opt/az/lib/python3.10/site-packages/msal_extensions/token_cache.py", line 55, in _reload_if_necessary
    self.deserialize(self._persistence.load())
  File "/opt/az/lib/python3.10/site-packages/msal/token_cache.py", line 326, in deserialize
    self._cache = json.loads(state) if state else {}
  File "/opt/az/lib/python3.10/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/opt/az/lib/python3.10/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/opt/az/lib/python3.10/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az login
• az account clear

Expected Behavior

az login succeeds

Environment Summary

Linux-5.15.79.1-microsoft-standard-WSL2-x86_64-with-glibc2.35, Ubuntu 22.04.1 LTS
Python 3.10.10
Installer: DEB

azure-cli 2.48.1

Extensions:
azure-devops 0.26.0

Dependencies:
msal 1.20.0
azure-mgmt-resource 22.0.0

Additional Context

[yonzhan]

Thank you for opening this issue, we will look into it.

[jiasli]

Similar to #20853, but az account clear won't work now, because previously we don't retrieve all accounts from MSAL token cache (we simply delete whole MSAL token cache), but now we need to retrieve all accounts from MSAL token cache in order to also sign out from WAM (#23828).

To solve it, please delete ~/.azure folder and run az login again.

@rayluo, I think we do need a way to recover from corrupted MSAL token cache. Also, if the MSAL token cache is corrupted, how do we even know which account are currently signed into WAM via Azure CLI?

[rayluo]

I think we do need a way to recover from corrupted MSAL token cache.

Well, if it is really corrupted, there is no way to recover from it, right? You may consider catch that JSONDecodeError and then still simply delete whoe MSAL token cache. Because the alternative is a manual delete ~/.azure, then you might as well auto delete it.

Also, if the MSAL token cache is corrupted, how do we even know which account are currently signed into WAM via Azure CLI?

We won't know. But that is probably fine. After the auto-recover mentioned above, subsequent successful "az login" and "az logout" would reach eventual consistency in WAM.