`acquire_token_interactive` cannot open web browser on WSL2 + Ubuntu 22.04 #627

jiasli · 2023-11-16T09:50:45Z

jiasli
Nov 16, 2023

Describe the bug
acquire_token_interactive cannot open web browser on WSL2 + Ubuntu 22.04. The upstream issue is microsoft/WSL#8892.

To Reproduce

$ az login
A web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.
/usr/bin/xdg-open: 882: x-www-browser: not found
/usr/bin/xdg-open: 882: firefox: not found
/usr/bin/xdg-open: 882: iceweasel: not found
/usr/bin/xdg-open: 882: seamonkey: not found
/usr/bin/xdg-open: 882: mozilla: not found
/usr/bin/xdg-open: 882: epiphany: not found
/usr/bin/xdg-open: 882: konqueror: not found
/usr/bin/xdg-open: 882: chromium: not found
/usr/bin/xdg-open: 882: chromium-browser: not found
/usr/bin/xdg-open: 882: google-chrome: not found
/usr/bin/xdg-open: 882: www-browser: not found
/usr/bin/xdg-open: 882: links2: not found
/usr/bin/xdg-open: 882: elinks: not found
/usr/bin/xdg-open: 882: links: not found
/usr/bin/xdg-open: 882: lynx: not found
/usr/bin/xdg-open: 882: w3m: not found
xdg-open: no method available for opening 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?...'

Additional context
Windows Terminal supports Ctrl+Click to open hyperlinks, so the user can Ctrl+Click the URL after xdg-open: no method available for opening to open the web browser and the rest steps work as usual.

Answered by rayluo

Nov 20, 2023

The Ubuntu 22.04 on my another computer doesn't have xdg-utils installed, or if I uninstall xdg-utils explicitly:
sudo apt remove xdg-utils
On Python 3.10, webbrowser.open returns False:
$ /usr/bin/python3 -V
Python 3.10.12
$ /usr/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
False
This makes 8d86917 kick in, triggering the logic we added for Ubuntu 18.04 (#333).

But on Python 3.11 (which Azure CLI 2.54.0 DEB package bundles), webbrowser.open returns True and prints an error:
$ /opt/az/bin/python3 -V
Python 3.11.5
$ /opt/az/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
True
gio: https://l…

View full answer

rayluo · 2023-11-16T20:19:25Z

rayluo
Nov 16, 2023
Maintainer

Thanks for bringing this to our attention.

If the end user is aware that they are using "WSL2 + Ubuntu22.04", installing wslu package or setting up a proper BROWSER env var will allegedly work.

From Azure CLI's perspective, it is lucky that last line of error provides a visible URL:

xdg-open: no method available for opening 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?...'

So, perhaps Azure CLI can reword the first line in your screenshot:

A web browser ~~has been~~ will be opened ~~at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize~~. Please continue ... If no web browser is available or if the web browser fails to open, you can manually open the link shown in an error message below, or use device code flow ...

0 replies

bgavrilMS · 2023-11-17T13:27:25Z

bgavrilMS
Nov 17, 2023
Maintainer

Btw, MSAL.NET added support for several other tools for opening browser on Linux, apart from xdg-open: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/src/client/Microsoft.Identity.Client/Platforms/netcore/NetCorePlatformProxy.cs#L236

Not sure it'll fix the issue here, as xdg-open does seem to exist on the box. But I wonder if wslview will work.

0 replies

rayluo · 2023-11-17T18:56:21Z

rayluo
Nov 17, 2023
Maintainer

@bgavrilMS , is there an MSAL .Net test app for @jiasli to test the MSAL .Net behavior and see if that helps?

Regardless, I do not think this is a bug. At least not in MSAL Python.

Python has a built-in module webbrowser which was designed and implemented to support multiple browsers. But in this case, not even a python -m webbrowser -t "https://www.python.org" would work, according to @jiasli 's report here. MSAL Python is designed and implemented to rely on Python's webbrowser behavior.

This was working before, so it feels like a regression on WSL.

Anyway, the "p2" and "bug" labels got my attention. @jiasli , you can ping me offline for an alternative solution, which will still be in the direction of my earlier suggestion of refining Azure CLI's error message. But I can tell you an undocumented API that would be triggered only when browser is unavailable.

0 replies

jiasli · 2023-11-20T08:15:27Z

jiasli
Nov 20, 2023
Author

The Ubuntu 22.04 on my another computer doesn't have xdg-utils installed, or if I uninstall xdg-utils explicitly:

sudo apt remove xdg-utils

On Python 3.10, webbrowser.open returns False:

$ /usr/bin/python3 -V
Python 3.10.12
$ /usr/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
False

This makes 8d86917 kick in, triggering the logic we added for Ubuntu 18.04 (#333).

But on Python 3.11 (which Azure CLI 2.54.0 DEB package bundles), webbrowser.open returns True and prints an error:

$ /opt/az/bin/python3 -V
Python 3.11.5
$ /opt/az/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
True
gio: https://login.microsoftonline.com/: Operation not supported

I can tell you an undocumented API that would be triggered only when browser is unavailable.

If you are referring to auth_uri_callback, it actually relies on _browse returning False:

microsoft-authentication-library-for-python/msal/oauth2cli/authcode.py

Lines 289 to 311 in 3702816

    
           browser_opened = False 
        
           try: 
        
               browser_opened = _browse(_uri, browser_name=browser_name) 
        
           except:  # Had to use broad except, because the potential 
        
                    # webbrowser.Error is purposely undefined outside of _browse(). 
        
               # Absorb and proceed. Because browser could be manually run elsewhere. 
        
               logger.exception("_browse(...) unsuccessful") 
        
           if not browser_opened: 
        
               if not auth_uri_callback: 
        
                   logger.warning( 
        
                       "Found no browser in current environment. " 
        
                       "If this program is being run inside a container " 
        
                       "which either (1) has access to host network " 
        
                       "(i.e. started by `docker run --net=host -it ...`), " 
        
                       "or (2) published port {port} to host network " 
        
                       "(i.e. started by `docker run -p 127.0.0.1:{port}:{port} -it ...`), " 
        
                       "you can use browser on host to visit the following link. " 
        
                       "Otherwise, this auth attempt would either timeout " 
        
                       "(current timeout setting is {timeout}) " 
        
                       "or be aborted by CTRL+C. Auth URI: {auth_uri}".format( 
        
                           auth_uri=_uri, timeout=timeout, port=self.get_port())) 
        
               else:  # Then it is the auth_uri_callback()'s job to inform the user 
        
                   auth_uri_callback(_uri)

but the tricky thing is that in my above examples, you can see webbrowser.open returns True but prints an error. This leaves MSAL no way to know it has failed to open the browser, so auth_uri_callback will never be hit.

0 replies

jiasli · 2023-11-20T09:19:38Z

jiasli
Nov 20, 2023
Author

So, perhaps Azure CLI can reword the first line in your screenshot:

A web browser ~~has been~~ will be opened ~~at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize~~. Please continue ... If no web browser is available or if the web browser fails to open, you can manually open the link shown in an error message below, or use device code flow ...

We can't delete the https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize as the user must know which tab in the browser is for login. The warning message was added back in [Profile] az login: Add back the warning that a browser is opened Azure/azure-cli#14505
Currently, I prefer not to change the warning message specially for a WSL issue that will likely be fixed in the future.

0 replies

rayluo · 2023-11-20T18:33:56Z

rayluo
Nov 20, 2023
Maintainer

The Ubuntu 22.04 on my another computer doesn't have xdg-utils installed, or if I uninstall xdg-utils explicitly:
sudo apt remove xdg-utils
On Python 3.10, webbrowser.open returns False:
$ /usr/bin/python3 -V
Python 3.10.12
$ /usr/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
False
This makes 8d86917 kick in, triggering the logic we added for Ubuntu 18.04 (#333).

But on Python 3.11 (which Azure CLI 2.54.0 DEB package bundles), webbrowser.open returns True and prints an error:
$ /opt/az/bin/python3 -V
Python 3.11.5
$ /opt/az/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
True
gio: https://login.microsoftonline.com/: Operation not supported
I can tell you an undocumented API that would be triggered only when browser is unavailable.

If you are referring to auth_uri_callback, it actually relies on _browse returning False:

Thanks for your investigation, @jiasli !

Admittedly, Python's webbrowser.open() did not even document its return value. We just used it that way based on empirical observation.

Currently, I prefer not to change the warning message specially for a WSL issue that will likely be fixed in the future.

If necessary, MSAL Python could add a mechanism to return the full url via some callback, for downstream app to unconditionally print it, so that the end user would have a chance to know thus manually open it. But the user experience would be really bad, because the url is lengthy and being displayed all the time.

So, overall, I agree with your assessment that MSAL not changing the behaviors specially for an upstream WSL issue that will likely be fixed in the future.

Shall we close this issue (as Not Planned), then?

0 replies

jiasli · 2023-11-21T06:15:38Z

jiasli
Nov 21, 2023
Author

Shall we close this issue (as Not Planned), then?

Well. That depends on you. I am opening this issue only for tracking purpose and increasing the visibility of microsoft/WSL#8892. I also created one for Azure CLI: Azure/azure-cli#27879.

0 replies

rayluo · 2023-11-21T16:38:13Z

rayluo
Nov 21, 2023
Maintainer

So, we already have a triage conclusion as above. Now, in terms of keep an issue open for indefinite time for tracking purpose, I think in this MSAL Repo we have been experimenting using Github Discussion Q&A for this kind of purpose. I'm converting this issue into a Q&A.

1 reply

bgavrilMS Nov 22, 2023
Maintainer

Let's keep bugs open in the MSAL repo please, as this is what we do in other MSALs. External bugs (e.g. AAD needs changes, WSL needs a bug fix) can be marked with "External". If an "External" bug is not fixed in some time, we can re-triage it to add a fix in MSAL itself, if possible (for example this one is a fairly easy fix)

scott-doyland-burrows · 2023-11-22T10:03:58Z

scott-doyland-burrows
Nov 22, 2023

I don't understand all the above - however it all worked until a few days ago.

I could issue az login in WSL and a browser automatically opened and automatically logged me in.

Now I have to use az login --use-device-code and click on the browser link shown in the output (to manually open the browser) and then add the code into the browser.

1 reply

bgavrilMS Nov 22, 2023
Maintainer

Agreed, let's keep the bug open. #628

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`acquire_token_interactive` cannot open web browser on WSL2 + Ubuntu 22.04 #627

{{title}}

Replies: 9 comments 2 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

acquire_token_interactive cannot open web browser on WSL2 + Ubuntu 22.04 #627

jiasli Nov 16, 2023

Replies: 9 comments · 2 replies

rayluo Nov 16, 2023 Maintainer

bgavrilMS Nov 17, 2023 Maintainer

rayluo Nov 17, 2023 Maintainer

jiasli Nov 20, 2023 Author

jiasli Nov 20, 2023 Author

rayluo Nov 20, 2023 Maintainer

jiasli Nov 21, 2023 Author

rayluo Nov 21, 2023 Maintainer

bgavrilMS Nov 22, 2023 Maintainer

scott-doyland-burrows Nov 22, 2023

bgavrilMS Nov 22, 2023 Maintainer

`acquire_token_interactive` cannot open web browser on WSL2 + Ubuntu 22.04 #627

jiasli
Nov 16, 2023

Replies: 9 comments 2 replies

rayluo
Nov 16, 2023
Maintainer

bgavrilMS
Nov 17, 2023
Maintainer

rayluo
Nov 17, 2023
Maintainer

jiasli
Nov 20, 2023
Author

jiasli
Nov 20, 2023
Author

rayluo
Nov 20, 2023
Maintainer

jiasli
Nov 21, 2023
Author

rayluo
Nov 21, 2023
Maintainer

bgavrilMS Nov 22, 2023
Maintainer

scott-doyland-burrows
Nov 22, 2023

bgavrilMS Nov 22, 2023
Maintainer