[Bug] Public Client with Broker Cannot Acquire Token Silently from the Token Cache on a Machine Never Login With WAM #4786

msJinLei · 2024-05-24T05:15:07Z

Library version used

Microsoft.Identity.Client
Microsoft.Identity.Client.Extensions.Msal
Microsoft.Identity.Client.Broker

version 4.60.3.0

.NET version

.netstandards 2.0

Scenario

PublicClient - desktop app

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

The user never login with a WAM on the machine

create a public client with broker
run AcquireTokenWithDeviceCodeAsync
run AcquireTokenSilentAsync

Or

login interactively with browser before
create a public client with broker
run AcquireTokenSilentAsync

Relevant code snippets

No response

Expected behavior

AcquireTokenSilentAsync returns an access token successfully but acctually returns an error

Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/', UserId:'niranjanb@xxxxx'
DEBUG: SharedTokenCacheCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
136389b4-bf6a-4417-8559-aa9451eac8b8] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
136389b4-bf6a-4417-8559-aa9451eac8b8] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
136389b4-bf6a-4417-8559-aa9451eac8b8] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
136389b4-bf6a-4417-8559-aa9451eac8b8] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
136389b4-bf6a-4417-8559-aa9451eac8b8] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [Runtime] WAM supported OS.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [RuntimeBroker]
ListWindowsWorkAndSchoolAccounts option was not enabled.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
7caefd13-8142-4f4a-b4fb-a57f546d77f9] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] Found 1 cache accounts and 0
broker accounts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] Returning 1 accounts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] MSAL MSAL.CoreCLR with assembly version '4.60.3.0'. CorrelationId(68e20a0f-67d0-4258-92a8-5cbb42f9911f)
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] === AcquireTokenSilent Parameters ===
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] LoginHint provided: False
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] Account provided: True
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] ForceRefresh: False
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - True
HomeAccountId - False
CorrelationId - 68e20a0f-67d0-4258-92a8-5cbb42f9911f
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] === Token Acquisition (SilentRequest) started:
  Scopes: https://management.core.windows.net//.default
 Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] Broker is configured and enabled, attempting to use broker instead.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [Runtime] WAM supported OS.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] Can invoke broker. Will attempt to acquire token with broker.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0001] WARNING
SetAuthorityString:98 Initializing authority from string 'https://login.microsoftonline.com/$tenantId/' without authority
type, defaulting to MsSts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] ERROR
ErrorInternalImpl:134 Created an error: 5vt4a, StatusInternal::AccountNotFound, InternalEvent::None, Error Code 0, Context 'Account with id '(pii)' not
found'
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:393 Printing Telemetry for Correlation ID: 68e20a0f-67d0-4258-92a8-5cbb42f9911f
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: start_time, Value: 2024-05-21T11:14:02.000Z
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: api_name, Value: ReadAccountById
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: was_request_throttled, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: authority_type, Value: Unknown
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: msal_version, Value: 1.1.0+local
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: correlation_id, Value: 68e20a0f-67d0-4258-92a8-5cbb42f9911f
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: broker_app_used, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: stop_time, Value: 2024-05-21T11:14:02.000Z
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: all_error_tags, Value: 5vt4a
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: msalruntime_version, Value: 0.16.0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: api_error_code, Value: 0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: api_error_tag, Value: 5vt4a
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: api_status_code, Value: StatusInternal::AccountNotFound
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: api_error_context, Value: Account with id '(pii)' not found
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: is_successful, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [MSAL:0002] INFO
LogTelemetryData:401 Key: request_duration, Value: 0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z] [RuntimeBroker] Could not find a
WAM account for the selected user. Error: Status: AccountNotFound
Context: Account with id '(pii)' not found
Tag: 0x1f553780
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET Framework 4.8.4645.0 Microsoft Windows 10.0.20348  [2024-05-21 11:14:02Z -
68e20a0f-67d0-4258-92a8-5cbb42f9911f] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: wam_no_account_for_id
HTTP StatusCode 0
CorrelationId 68e20a0f-67d0-4258-92a8-5cbb42f9911f
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.<ExecuteAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Utils.StopwatchService.<MeasureCodeBlockAsync>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<RunAsync>d__11.MoveNext()
DEBUG: SharedTokenCacheCredential.GetToken was unable to retrieve an access token. Scopes: [ https://management.core.windows.net//.default ]
ParentRequestId:  Exception: Azure.Identity.CredentialUnavailableException (0x80131500): SharedTokenCacheCredential authentication unavailable. Token
acquisition failed for user [email protected]. Ensure that you have authenticated with a developer tool that supports Azure single sign on.
 ---> Microsoft.Identity.Client.MsalUiRequiredException (0x80131500): Could not find a WAM account for the selected user. Error: Status: AccountNotFound
Context: Account with id '(pii)' not found
Tag: 0x1f553780

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

No response

The related issue reported before AzureAD/microsoft-authentication-library-for-python#563

The text was updated successfully, but these errors were encountered:

bgavrilMS · 2024-05-24T11:25:45Z

I think this is similar to the issue reported by Azure CLI and fixed in MSAL Py, where device code flow doesn't use the broker.

rayluo · 2024-05-24T18:45:21Z

I think this is similar to the issue reported by Azure CLI and fixed in MSAL Py, where device code flow doesn't use the broker.

Indeed. It can be fixed by the accout_source behavior implemented in this MSAL Python PR.

alaahusseiny · 2024-05-26T10:52:48Z

Hello, do we have someone taking care of this bug ?

daga05 · 2024-05-26T16:52:37Z

Hi, just following up on Alaa's reply. Do we have a contact for this bug or can we get an update? Thanks

isra-fel · 2024-05-27T00:27:15Z

I think this is similar to the issue reported by Azure CLI and fixed in MSAL Py, where device code flow doesn't use the broker.

Yeah, except for device code, we also have customers using username+password (ROPC) flow getting impacted. Supposedly all the flows that don't involve in the broker should still be able to acquire token silently.

DeviJagannadh-TechDevp · 2024-05-27T10:08:41Z

Hello team, any update on this issue?

Thanks

mbukovich · 2024-05-28T16:36:38Z

Hi team; I'm checking to see if there is any update on this issue.

manuel-falcao-magalhaes · 2024-05-29T13:30:50Z

Hi team, just wanted to check if there's an update on this issue, please.

bgavrilMS · 2024-05-29T15:43:38Z

@iulico-1 to comment

iulico-1 · 2024-05-29T18:21:02Z

It seems to be a behavior that existed for quite some time (since broker integration was enabled). This is a feature ask to support device code flow outside the broker. A change to support ROPC with the broker is also being considered.

msJinLei · 2024-05-30T03:06:03Z

It seems to be a behavior that existed for quite some time (since broker integration was enabled). This is a feature ask to support device code flow outside the broker. A change to support ROPC with the broker is also being considered.

@iulico-1
We don't find it earlier the as the issue can be find only on the machine without WAM login but with WAM option enabled.
We usually test in the following process and so it is the limitation of the test.

Login with WAM
Test subsequent operations

But we don't expect the behavior that we cannot acquire token silent with broker option when there is a valid token in the cache and so we don't test it in the direction.

The issue is a blocking issue for our product. Actually the customers using "ROPC and device code" flows cannot use Azure PowerShell when the issue is not fixed. The only way to workaround is to close WAM option.

ashok672 · 2024-05-30T22:58:50Z

@msJinLei - The issue is understood now and we are actively working on the fix. Will update around mid next week on the progress and ETA for the final fix.

msJinLei · 2024-05-31T07:50:26Z

@ashok672 Thanks for letting us know! We are waiting for your progress.

msJinLei · 2024-06-05T00:11:56Z

@ashok672 Could you update the progress of the item? Thanks

ashok672 · 2024-06-07T20:39:03Z

I am actively working on the fix. ETA for the fix to be checked in is by 06/14. I will see if I can release the fix as well within this time. If not, the release might take some more time, probably another 2 or 3 days.

msJinLei added needs attention Delete label after triage untriaged Do not delete. Needed for Automation labels May 24, 2024

msJinLei changed the title ~~[Bug] Public Client with Broker Cannot Acquire Token Silently Successfully on a Machine Never Login With WAM~~ [Bug] Public Client with Broker Cannot Acquire Token Silently from the Token Cache on a Machine Never Login With WAM May 24, 2024

bgavrilMS added bug public-client and removed untriaged Do not delete. Needed for Automation needs attention Delete label after triage labels May 24, 2024

bgavrilMS assigned iulico-1 May 29, 2024

ashok672 added the tracked-ado label May 30, 2024

isra-fel mentioned this issue Jun 1, 2024

The Known Issues of Az.Accounts 3.0.0 and Their Workarounds Azure/azure-powershell#25005

Open

msJinLei mentioned this issue Jul 1, 2024

Disable WAM When UseDeviceAuthentication is true or paramterset is UserWithCredential Azure/azure-powershell#25404

Merged

6 tasks

ashok672 mentioned this issue Jul 17, 2024

Device code flow fixes when broker is enabled #4846

Merged

ashok672 closed this as completed in #4846 Jul 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Bug] Public Client with Broker Cannot Acquire Token Silently from the Token Cache on a Machine Never Login With WAM #4786

[Bug] Public Client with Broker Cannot Acquire Token Silently from the Token Cache on a Machine Never Login With WAM #4786

msJinLei commented May 24, 2024 •

edited

Loading

bgavrilMS commented May 24, 2024

rayluo commented May 24, 2024

alaahusseiny commented May 26, 2024

daga05 commented May 26, 2024

isra-fel commented May 27, 2024

DeviJagannadh-TechDevp commented May 27, 2024

mbukovich commented May 28, 2024

manuel-falcao-magalhaes commented May 29, 2024

bgavrilMS commented May 29, 2024

iulico-1 commented May 29, 2024

msJinLei commented May 30, 2024 •

edited

Loading

ashok672 commented May 30, 2024

msJinLei commented May 31, 2024

msJinLei commented Jun 5, 2024

ashok672 commented Jun 7, 2024 •

edited

Loading

[Bug] Public Client with Broker Cannot Acquire Token Silently from the Token Cache on a Machine Never Login With WAM #4786

[Bug] Public Client with Broker Cannot Acquire Token Silently from the Token Cache on a Machine Never Login With WAM #4786

Comments

msJinLei commented May 24, 2024 • edited Loading

Library version used

.NET version

Scenario

Is this a new or an existing app?

Issue description and reproduction steps

Relevant code snippets

Expected behavior

Identity provider

Regression

Solution and workarounds

bgavrilMS commented May 24, 2024

rayluo commented May 24, 2024

alaahusseiny commented May 26, 2024

daga05 commented May 26, 2024

isra-fel commented May 27, 2024

DeviJagannadh-TechDevp commented May 27, 2024

mbukovich commented May 28, 2024

manuel-falcao-magalhaes commented May 29, 2024

bgavrilMS commented May 29, 2024

iulico-1 commented May 29, 2024

msJinLei commented May 30, 2024 • edited Loading

ashok672 commented May 30, 2024

msJinLei commented May 31, 2024

msJinLei commented Jun 5, 2024

ashok672 commented Jun 7, 2024 • edited Loading

msJinLei commented May 24, 2024 •

edited

Loading

msJinLei commented May 30, 2024 •

edited

Loading

ashok672 commented Jun 7, 2024 •

edited

Loading