Azure / Azure/azure-devops-cli-extension

[Bug] Error AADSTS50076 when using az login to login to Azure DevOps

Open
#1,106 0 comments 0 reactions 0 assignees View on GitHub
Area: ProToCol bug
Dominant language
Python
Stars
682
Forks
278
Avg merge
3d 23h
Merged PRs (30d)
3

Description

**Describe the bug**
We get the following error when using `az login` to login to Azure DevOps:
`AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '*****'.`

Additional details from out Microsoft PSfP contact:
> ...it would require a code change to the extension to handle the case where **a token is present but not valid due to the requirement for MFA**. At present the extension executes `get_token_from_az_login` which in turn relies on the profile function `get_access_token_for_resource` in the Azure CLI.

**MFA setup**
There are 2 conditional access policies set up for Azure DevOps vs. other cloud services under normal corporate usage:
* `az login` defaults to our domain one, which would be using a risk based policy (using MS to define that) and you won’t get MFA prompted unless your connection is flagged with e.g. “impossible travel” or “bad IP range”.
* `az devops login` has a separate condition set up and isn’t using a risk based policy - MFA is required unless you are in an excluded group (AAD group).

**Workaround**
Using `az devops login` with a PAT works just fine, but the setup would be simplified if users could instead use `az login` and not having to generate PATs.

**To Reproduce**
Azure Cli Version: 2.12.0
```
{
"azure-cli": "2.12.0",
"azure-cli-core": "2.12.0",
"azure-cli-telemetry": "1.0.6",
"extensions": {
"azure-devops": "0.18.0"
}
}
```

Azure-Devops extension version: 0.18.0

Steps to reproduce the behavior:
1. With our MFA setup, login using `az login`
2. Run e.g. command `az devops project list --org ... --top 1 --debug`
3. See error

**Expected behavior**
Logging in with `az login` should also properly log you in to Azure DevOps.

**Debug logs**
```
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - Authority:Performing instance discovery: ...
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - Authority:Performing static instance discovery
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - Authority:Authority validated via static instance discovery
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - TokenRequest:Getting token from cache with refresh if necessary.
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:finding with query keys: {'_clientId': '...', 'userId': '...'}
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:Looking for potential cache entries: {'_clientId': '...', 'userId': '...'}
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:Found 1 potential entries.
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:No resource specific cache entries found.
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:Found an MRRT token.
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:Returning token from cache lookup, AccessTokenId: b'*****', RefreshTokenId: b'*****'
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - CacheDriver:Acquiring new access token from MRRT token.
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - TokenRequest:called to refresh a token from the cache
adal-python : 327fe545-75ce-401d-913e-dd94f0c7fca0 - TokenRequest:Getting a new token from a refresh token
urllib3.connectionpool : Starting new HTTPS connection (1): http://login.microsoftonline.com:443
urllib3.connectionpool : https://login.microsoftonline.com:443 "POST /*****/oauth2/token HTTP/1.1" 400 651
not able to get token from az login
Get Token request returned http error: 400 and server response: {"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '*****'.\r\nTrace ID: f57c1f4b-57c8-4888-9ebd-d249ca71de00\r\nCorrelation ID: 327fe545-75ce-401d-913e-dd94f0c7fca0\r\nTimestamp: 2020-10-06 08:42:50Z","error_codes":[50076],"timestamp":"2020-10-06 08:42:50Z","trace_id":"f57c1f4b-57c8-4888-9ebd-d249ca71de00","correlation_id":"327fe545-75ce-401d-913e-dd94f0c7fca0","error_uri":"https://login.microsoftonline.com/error?code=50076","suberror":"basic_action"}
Traceback (most recent call last):
File "C:\Users\*****\.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 157, in get_token_from_az_login
auth_token = profile.get_access_token_for_resource(user, tenant, '*****')
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-cep_dxyk\azure\cli\core\_profile.py", line 525, in get_access_token_for_resource
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-cep_dxyk\azure\cli\core\_profile.py", line 1019, in retrieve_token_for_user
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\authentication_context.py", line 145, in acquire_token
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\authentication_context.py", line 128, in _acquire_token
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\authentication_context.py", line 143, in token_func
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\token_request.py", line 347, in get_token_from_cache_with_refresh
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\token_request.py", line 127, in _find_token_from_cache
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\cache_driver.py", line 199, in find
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\cache_driver.py", line 184, in _refresh_entry_if_necessary
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\cache_driver.py", line 160, in _acquire_new_token_from_mrrt
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\token_request.py", line 137, in _get_token_with_token_response
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\token_request.py", line 339, in _get_token_with_refresh_token
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\token_request.py", line 112, in _oauth_get_token
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mu_8y5v2\adal\oauth2_client.py", line 289, in get_token
...
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.