Using VCR.py with MSAL
Once upon a time I decided to write some integration tests with help of VCR.py. VCR.py simplifies and speeds up tests that make HTTP requests. It records all HTTP interactions in a cassette file. When you run the same code again, it will replay all HTTP interactions from a cassette file. Sounds great for writing tests! Little did I know.
My HTTP requests involved authentication to Azure AD. I am using MSAL library. By the time I started with VCR, I have already spent some time trying to authenticate in an easy-for-user manner. In the end, integrated windows authentication beat me hard requiring two factor authentication. I felt frustrated, but at the same time happy that running
tox resulted in all green colors. Until I committed the code and then run the tests some time later.
Oh, ah! What's going on?!
======== short test summary info ========= FAILED test_application.py::TestApplication::test_application_list - AssertionError: The command failed. Exit code: 1 ======== 1 failed in 6.67s =============== ERROR: InvocationError for command 'C:\some\.tox\py37\Scripts\pytest.EXE' test_application.py --junitxml=.tox/junit.py37.xml (exited with code 1) ______ summary ___________________________ ERROR: py37: commands failed
There was an actual error message
9. The current time MUST be before the time represented by the exp Claim. id_token was. It gave me a hint, but since I normally do not deal with authentication on a low level, I spent some time trying various things.
To spare your time, here is a recipe. The problem was in
id_token saved in HTTP response.
id_token is a string like this
This is a JWT token, consisting of 3 parts separated by
. character. The decoded data contains expiration date, which of course is in the past for a pre-recorded interaction.
Since I am in Python, I studied the code of MSAL library that deals with the token and found out that it only decodes the payload part (at least in the function that fails). My wild attempt would be to adjust expiration time, create a new token based on the current one and hope that MSAL will accept it.
Here is the code that does just that
import time import json import base64 from msal.oauth2cli.oidc import decode_part def adjust_token_time(id_token: str) -> str: header_enc = id_token.split('.') payload = json.loads(decode_part(id_token.split('.'))) signature_enc = id_token.split('.') payload["exp"] = round(time.time() + 80) # seconds payload = json.dumps(payload).encode("utf-8") paylod_enc = base64.urlsafe_b64encode(payload).decode().strip('=') token = ".".join([header_enc, paylod_enc, signature_enc]) return token
New expiration time must not exceed 2 minutes. Otherwise one gets a different MSAL error. You can see that my new token is a very dirty forgery. Nevertheless it works and I am happy for now.
This function must be executed as part of pre-processing when VCR.py plays the cassette.