Skip to content

feat(auth): add multi-account session management#207

Open
Mathf18 wants to merge 4 commits intomicrosoft:mainfrom
Mathf18:feature/multi-account-auth
Open

feat(auth): add multi-account session management#207
Mathf18 wants to merge 4 commits intomicrosoft:mainfrom
Mathf18:feature/multi-account-auth

Conversation

@Mathf18
Copy link
Copy Markdown

@Mathf18 Mathf18 commented Apr 7, 2026

Closes #206

Summary

  • Add fab auth list to display all stored user sessions (active, valid, tenant, last used)
  • Add fab auth switch to switch between stored sessions - direct (-u, -t) or interactive prompt
  • Extend fab auth logout with per-session removal (-u, -t) and bulk clear (--all)
  • Username matching is case-insensitive across all session commands
  • Session switching is blocked with a clear error when env var auth (FAB_TOKEN, etc.) is active
  • Force interactive re-login on fab auth login so new accounts are always stored as distinct sessions
  • Fix the Windows WAM login regression by preserving the broker-backed MSAL app for the full multi-scope login flow and using the legacy account lookup while OneLake and Azure tokens are warmed up

Use case

Consultants and developers working across multiple Fabric tenants (e.g. Client A production, Client B dev, internal corporate) currently need a full logout/login cycle to switch context. This PR lets them authenticate once per account and switch instantly:

fab auth login          # log in as alice@clientA.com
fab auth login          # log in as bob@clientB.com

fab auth list           # see both sessions
fab auth switch -u alice@clientA.com   # switch directly
fab auth switch         # toggle (2 accounts) or prompt (3+)
fab auth logout -u bob@clientB.com     # remove one session

Verification

  • uv run pytest tests/test_core/test_fab_auth.py tests/test_commands/test_auth.py

Test plan

  • fab auth login with interactive browser - stores session correctly
  • fab auth login with a second account - both sessions visible in fab auth list
  • fab auth switch -u <name> - switches directly (case-insensitive)
  • fab auth switch with 2 sessions - auto-toggles
  • fab auth switch with 3+ sessions - shows interactive prompt
  • fab auth switch with FAB_TOKEN set - returns clear error
  • fab auth logout -u <name> - removes only that session
  • fab auth logout --all - clears everything
  • fab auth status - reflects the active session
  • SPN and managed identity flows remain unaffected
  • Unit tests pass

Mathieu Turcotte and others added 3 commits April 7, 2026 16:17
- Replace deprecated datetime.utcnow() with datetime.now(timezone.utc)
- Add case-insensitive username matching in session resolution
- Cache MSAL app per tenant in list_accounts to avoid redundant creation
- Log TypeError instead of silently swallowing in _get_matching_account
- Add clarifying comments on acquire_token branching logic
- Only reset MSAL app when tenant actually changes (set_tenant, _sync)
- Expand docs with parameter descriptions and behavior details
- Add edge case tests: env var block, case-insensitive switch, 3+ account
  prompt, cancelled prompt, empty list, app preservation on tenant match

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Mathf18 Mathf18 requested a review from a team as a code owner April 7, 2026 21:22
@Mathf18
Copy link
Copy Markdown
Author

Mathf18 commented Apr 7, 2026

@microsoft-github-policy-service agree

@Mathf18 Mathf18 changed the title feat(auth): add multi-account session management feat: add multi-account session management Apr 7, 2026
@Mathf18 Mathf18 changed the title feat: add multi-account session management feat(auth): add multi-account session management Apr 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEATURE] Multi-account session management

1 participant