Refresh token expires daily on WSL Ubuntu installation

[austintolani]

Describe the bug

I use Az CLI inside of Ubuntu 22.04.3 inside of a Windows machine running WSL. After ~12 hours or so, my refresh token will expire and I will have to run az login and authenticate again.

On the same machine, I have Az CLI installed in Windows. With the same Azure account, I am only prompted to re-authenticate every couple of months.

My understanding is that refresh token expiry time is set by organizational policy. What explains the difference in behavior between the installation of Azure CLI on Windows and within Ubuntu is WSL? Is there any configuration change I can make to fix the behavior within the Ubuntu installation?

Related command

az login

Errors

n/a

Issue script & Debug output

n/a

Expected behavior

I expect that the frequency at which I am prompted to login is consistent across installations.

Environment Summary

azure-cli                         2.53.1 *

core                              2.53.1 *
telemetry                          1.1.0

Dependencies:
msal                            1.24.0b2
azure-mgmt-resource             23.1.0b2

Python location '/opt/az/bin/python3'
Extensions directory '/home/austintolani/.azure/cliextensions'

Python (Linux) 3.10.10 (main, Oct 24 2023, 06:10:14) [GCC 11.4.0]

Additional context

No response

[azure-client-tools-bot-prd]

Hi @austintolani,

2.53.1 is not the latest Azure CLI(2.55.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[jiasli]

@austintolani, could you share the error message you get? Also, are you using device code flow in WSL? We got cases reported before that the refresh token retrieved using device code only works for ~12h in Microsoft tenant.

[austintolani]

Hi @jiasli, this is the error message I get:

AADSTS70043: The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on 2023-12-15T18:47:01.3682670Z and the maximum allowed lifetime for this request is 43200. Trace ID: aa7c2530-83e4-4387-8080-67fc52e30800 Correlation ID: 3d344d49-6798-41da-b560-2b6a34b26b3c Timestamp: 2023-12-18 16:00:23Z
Interactive authentication is needed. Please run:
az login --scope https://management.core.windows.net//.default

I was using device code flow in WSL as I was having issues using the browser but was able to fix it using this solution. I will let you know tomorrow if using the browser flow fixes this issue.