Document core.allow_broker=true and the AAD Broker plugin is not supported for non-commercial clouds
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62
**Related command**
az cloud set --name AzureUSGovernment
az config set core.allow_broker=true
az login
**Describe the bug**
If the cloud is set to any other cloud besides the default commercial cloud the AAD Broker plugin will fail to authenticate with the message below during login. The error is not intuitive indicating that the issue is usage of the AAD broker plugin.
Request Id: xyz
Correlation Id: xyz
Timestamp: 2023-03-28T15:14:12Z
Message: AADSTS50011: The redirect URI 'ms-appx-web://Microsoft.AAD.BrokerPlugin/04b07795-8ddb-461a-bbee-02f9e1bf7b46' specified in the request does not match the redirect URIs configured for the application '04b07795-8ddb-461a-bbee-02f9e1bf7b46'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.
**To Reproduce**
Use the following commands to try and login from a GCC High tenant.
az cloud set --name AzureUSGovernment
az config set core.allow_broker=true
az login
To mitigate, you need to disable the Broker using az config set core.allow_broker=false
Contributor guide
Assessment
This issue has not been assessed yet.