azure cli credential is broken on Windows

[weinong]

Bug Report

• azidentity, latest

• What happened?
  azure_cli_credential on Windows lauches az cli using cmd.exe under %SYSTEMROOT% which is actually wrong. cmd.exe is under %SYSTEMROOT%\system32 instead.

this issue causes Azure/kubelogin#129

[jhendrixMSFT]

Changed in #15928

[chlowell]

AzureCLICredential doesn't exec %SYSTEMROOT%\cmd.exe. It execs cmd.exe with %SYSTEMROOT% as the working directory:

azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go

Lines 112 to 117 in 5e92ba5

	dir := os.Getenv("SYSTEMROOT")
	if dir == "" {
	return nil, newCredentialUnavailableError(credNameAzureCLI, "environment variable 'SYSTEMROOT' has no value")
	}
	cliCmd = exec.CommandContext(ctx, "cmd.exe", "/c", commandLine)
	cliCmd.Dir = dir

So, the requirement is that cmd.exe be somewhere on %PATH%, not necessarily in %SYSTEMROOT%.

This makes the error message in the linked issue pretty puzzling. I don't see how AzureCLICredential could trigger that error, and it doesn't on my machine, which has the same environment as described in the linked issue in that %SYSTEMROOT% is C:\WINDOWS and cmd.exe is not present in that directory but is on %PATH%.

@weinong are you able to reproduce this? Have any other users reported it?

[weinong]

@chlowell you are right. I actually cannot repro it, either. Though, my setup is Win 11.
@DaleyKD thoughts?

[DaleyKD]

I can't explain it, but the idea that cmd.exe be somewhere in your %PATH% is not fully accurate. My machine most definitely has cmd.exe there, but that's not what it was thinking. (I don't know how Go works, so I can't comment as to what it's supposedly doing with CommandContext.)

I'm testing this on Windows 10.

[chlowell]

Sorry for the delay, I was out on vacation. I'm superstitious enough to try this on Windows 10 and it works for me there as well. As I showed above, we rely on exec.CommandContext to find cmd.exe on the path. I'm at a loss to explain how it could resolve cmd.exe to a nonexistent path but perhaps there's some quirk of the environment that causes it to behave incorrectly (I don't know what that would be).

I'm uncertain we can do anything in the Azure SDK to fix this, since we're using the standard library straightforwardly here, but we can collect more information and see whether anything comes to light. @weinong, if I put together a debug version of AzureCLICredential that prints details such as the path as seen by the application and the state of the command returned by exec.CommandContext, could you vendor it into a private build for @DaleyKD?

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

[DaleyKD]

Waiting on a response from @weinong .

I don't know anything about Go, and have no idea why exec.CommandContext isn't looking in the proper path. I'll do whatever to help you guys out.

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!