Auth fails on headless Linux (codespaces): no device-code fallback when broker and browser auth both fail

Auth fails on headless Linux (codespaces): no device-code fallback when broker and browser auth both fail

Environment

• OS: Ubuntu 22.04 (GitHub Codespace / headless Linux)
• Node.js: v22.x
• WorkIQ version: latest via npx -y @microsoft/workiq@latest
• MSAL version: 4.81.0.0 (MSAL.NetCore)

Problem

WorkIQ authentication fails completely on headless Linux environments (e.g. GitHub Codespaces) because:

1. WAM broker fails — MsalRuntime initialization failed — expected on headless Linux with no display server
2. OS browser fallback fails — the app is registered with redirect URI https://login.microsoftonline.com/common/oauth2/nativeclient, but MSAL requires http://localhost for the OS browser flow, throwing:

   ErrorCode: loopback_redirect_uri
   Only loopback redirect uri is supported, but
   https://login.microsoftonline.com/common/oauth2/nativeclient was found.
   

3. No device-code fallback — after both broker and browser fail, there is no fallback to device-code flow, so auth is completely impossible.

Steps to Reproduce

1. Open a GitHub Codespace (or any headless Linux environment)
2. Run:

#!/usr/bin/env bash
# test-workiq.sh — Reproduce WorkIQ auth failure on headless Linux

set -euo pipefail

WORKIQ_VERSION="0.4.0"  # Pin to a known version — avoid @latest in shared scripts

# The native MSAL runtime library (libmsalruntime.so) is bundled inside the WorkIQ npx cache
# but isn't on the default library search path. Resolve and display it so you can verify.
MSAL_LIB_DIR="$(find ~/.npm/_npx -name libmsalruntime.so 2>/dev/null -exec dirname {} \; | head -1)"

if [ -z "$MSAL_LIB_DIR" ]; then
  echo "WARNING: libmsalruntime.so not found in npm cache. Running npx to populate it first..."
  npx -y "@microsoft/workiq@${WORKIQ_VERSION}" --help >/dev/null 2>&1 || true
  MSAL_LIB_DIR="$(find ~/.npm/_npx -name libmsalruntime.so 2>/dev/null -exec dirname {} \; | head -1)"
fi

if [ -z "$MSAL_LIB_DIR" ]; then
  echo "ERROR: Could not locate libmsalruntime.so. Exiting."
  exit 1
fi

echo "INFO: Adding to LD_LIBRARY_PATH: $MSAL_LIB_DIR"
export LD_LIBRARY_PATH="${MSAL_LIB_DIR}:${LD_LIBRARY_PATH:-}"

# Run WorkIQ with a simple identity query to test authentication.
# On headless Linux this currently fails because:
#   1. WAM broker cannot initialize (no display server)
#   2. Browser fallback fails (redirect URI mismatch — needs http://localhost)
#   3. No device-code fallback exists
npx -y "@microsoft/workiq@${WORKIQ_VERSION}" ask -q "Who am I?"

Security note: This script modifies LD_LIBRARY_PATH to load native .so files from the npm cache; this is to attempt a workaround and make the underlying issue more apparent, and is not standard usage. The script prints the resolved path so you can inspect it before it runs. The WorkIQ version is pinned to avoid surprises from @latest.

3. Auth fails with the loopback redirect URI error. And without the attempt with a workaround LD_LIBRARY_PATH, it fails earlier with:

Unable to load shared library 'msalruntime' or one of its dependencies.

Expected Behavior

When both WAM broker and OS browser auth are unavailable (headless Linux), WorkIQ should fall back to device-code flow — printing a URL and code for the user to authenticate in any external browser.

Trace Log (relevant excerpts)

[MSAL Info] [RuntimeBroker] MsalRuntime initialization failed.
[MSAL Info] Broker is required but is not installed or not available on the current platform.
[MSAL Info] Broker attempt did not complete. Attempting to use a browser / web UI.
[MSAL Error] ErrorCode: loopback_redirect_uri

Suggested Fix

Add device-code auth as a final fallback in InteractiveAuthProvider when:

• Broker is unavailable (headless Linux)
• OS browser flow fails (no loopback redirect URI configured)

This would print something like:

To sign in, use a web browser to open https://microsoft.com/devicelogin
and enter the code XXXXXXXX to authenticate.

Start with the InteractiveAuthProvider entry point and reproduce the failure with the supplied test-workiq.sh script in a headless Linux environment. Trace the broker and OS-browser failures, then verify that authentication falls back to printing a device-login URL and code and completes successfully.