ADAL package, which is EOL, included in latest az-cli

[virtualjack]

ADAL package, which is EOL, included in latest az-cli

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AzureAppServiceCLI, @antcp.

[ADBjester]

I note that MSAL has been used since CLI v2.30.0:

https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#november-02-2021

Since ADAL hasn't been used for authentication in the CLI since 2021, it seems safe to remove the python ADAL package entirely.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @adamedx.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AzureAppServiceCLI, @antcp.

[virtualjack]

Does the fact that Microsoft is installing a vulnerable library change the priority?

[virtualjack]

If az-cli isn't being updated to remove EOL libraries, I guess it means that it is effectively unsupported. I've leave this open for a bit in case anyone has any follow-up comments, and then close it.

[jiasli]

Azure CLI Core removed the dependency on ADAL in #19853.

However, adal is indeed installed. pipdeptree shows it is installed by azure-datalake-store and msrestazure:

> pipdeptree --reverse --packages adal
adal==1.2.7
├── azure-datalake-store==0.0.49 [requires: adal>=0.4.2]
│   └── azure-cli==2.62.0 [requires: azure-datalake-store~=0.0.49]
└── msrestazure==0.6.4 [requires: adal>=0.6.0,<2.0.0]
    ├── azure-batch==14.2.0 [requires: msrestazure>=0.4.32,<2.0.0]
    │   └── azure-cli==2.62.0 [requires: azure-batch~=14.2.0]
    ├── azure-cli-core==2.62.0 [requires: msrestazure~=0.6.4]
    │   └── azure-cli==2.62.0 [requires: azure-cli-core==2.62.0]
    ├── azure-graphrbac==0.60.0 [requires: msrestazure>=0.4.32,<2.0.0]
    │   └── azure-cli==2.62.0 [requires: azure-graphrbac~=0.60.0]
    ├── azure-mgmt-datalake-store==0.5.0 [requires: msrestazure>=0.4.27,<2.0.0]
    ├── azure-mgmt-devtestlabs==4.0.0 [requires: msrestazure>=0.4.32,<2.0.0]
    │   └── azure-cli==2.62.0 [requires: azure-mgmt-devtestlabs~=4.0]
    ├── azure-mgmt-kusto==0.3.0 [requires: msrestazure>=0.4.32,<2.0.0]
    │   └── azure-cli==2.62.0 [requires: azure-mgmt-kusto~=0.3.0]
    └── azure-mgmt-managedservices==1.0.0 [requires: msrestazure>=0.4.32,<2.0.0]
        └── azure-cli==2.62.0 [requires: azure-mgmt-managedservices~=1.0]

For azure-datalake-store, I will contact the service team to move to the latest 0.0.53 which already uses MSAL.

For msrestazure, it is required by Track 1 SDKs and azure-cli-core:

• Dropping Track 1 SDKs is tracked by #20462.
• Azure CLI uses msrestazure to support managed identity. Dropping msrestazure is tracked by #20460.

However, adal is installed merely as a dependency. No functionality from adal is used.

[jiasli]

A code search shows azure.datalake.store is used by dls module:

azure-cli/src/azure-cli/azure/cli/command_modules/dls/_client_factory.py

Line 32 in acec6c3

from azure.datalake.store import core

owned by service team @akharit @rahuldutta90

azure-cli/.github/CODEOWNERS

Line 39 in 9e3ce99

/src/azure-cli/azure/cli/command_modules/dls/ @akharit @rahuldutta90 @jsntcy @yonzhan @evelyn-ys