search

AzureAD / azure-activedirectory-library-for-python

ADAL for Python
http://adal-python.readthedocs.io
Other
259 stars 94 forks source link

ProxyError in python with API #241

Closed fatimamb closed 4 years ago

fatimamb commented 4 years ago

I am trying to use power bi API with python

and I have seen this helpful video

https://www.youtube.com/watch?v=wUzZChTlzdE

but I get this error when I am trying to get the token as shown below

import adal
import requests
import json
import pandas

authority_url = 'https://login.windows.net/common'
resource_url = 'https://analysis.windows.net/powerbi/api'
client_id = 'myclient_id '
username = 'myusername'
password = 'mypassword'

context = adal.AuthenticationContext(authority=authority_url,
                                     validate_authority=True,
                                     api_version=None)
token = context.acquire_token_with_username_password(resource=resource_url,
                                                     client_id=client_id,
                                                     username=username,
                                                     password=password)

and this is the error

ProxyError: HTTPSConnectionPool(host='login.windows.net', port=443): Max retries exceeded with url: /common/UserRealm/name%40urlname?api-version=1.0 (Caused by ProxyError('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x00000253557DA748>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed')))

notice : I did some edit on the error message (URL) for privacy reason

I have tried to run it as an administrator but still the same error any help?

rayluo commented 4 years ago

If you happen to be running the script in a different cloud, the legacy login.windows.net domain may not be reachable. We have long been switched to login.microsoftonline.com instead, for example, here.

Either way, if you have a proxy in your network environment, you may also need to check there to ensure you can physically reach a domain name like https://login.windows.net/common/UserRealm/johndoe@contoso.com?api-version=1.0 or https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0.

fatimamb commented 4 years ago

@rayluo thank you for your response, the first solution hasn't worked for me, and for the second I am sorry but it is not clear for me, I do not know how to use it specifically, could you please add more details.
also, I have proxy Id and IP but I do not know how to pass it and use it

rayluo commented 4 years ago

Our authentication process would need to make some calls to our servers. https://login.windows.net/common/UserRealm/johndoe@contoso.com?api-version=1.0 or https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0 are among them.

Roughly speaking, if you copy either of that URL and paste it to your browser and still see the same error, it would mean some network connection issues from within your network. (If your script would be running on a machine different than your current laptop/desktop, your network troubleshooting would need to happen there.) Do you have your network admin to talk to?

fatimamb commented 4 years ago

@rayluo if I need to check I by this URL (https://login.windows.net/common/UserRealm/johndoe@contoso.com?api-version=1.0) I have to change the email to my email right? also, I tried with this URL in the browser (https://login.windows.net/common) the response: (login.windows.net page can’t be found) and with (https://login.microsoftonline.com/common) the response: (This login.microsoftonline.com page can’t be found) and yes for the network admin sorry if I don't understand you the whole concept new for me

rayluo commented 4 years ago

You can use your real email, although that is not yet necessary for this preliminary network troubleshooting step. Just literally paste this https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0 into your browser addredss bar, visit it, will you be able to see something like this?

{"ver":"1.0","account_type":"Managed","domain_name":"contoso.com","cloud_instance_name":"microsoftonline.com","cloud_audience_urn":"urn:federation:MicrosoftOnline"}
fatimamb commented 4 years ago

@rayluo yes this is my output: {"ver":"1.0","account_type":"Managed","domain_name":"contoso.com","cloud_instance_name":"microsoftonline.com","cloud_audience_urn":"urn:federation:MicrosoftOnline"}

rayluo commented 4 years ago

Then the next step is to figure out why your script can not connect to that address. Is your script running on the same machine you use your browser? I still think the error in your first message, the ProxyError​, should probably be answered from your network administrator.

From: Fatimah Albesais notifications@github.com Sent: Friday, October 16, 2020 2:56 PM To: AzureAD/azure-activedirectory-library-for-python azure-activedirectory-library-for-python@noreply.github.com Cc: Ray Luo rayluo@microsoft.com; Mention mention@noreply.github.com Subject: Re: [AzureAD/azure-activedirectory-library-for-python] ProxyError in python with API (#241)

@rayluohttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Frayluo&data=04%7C01%7Crayluo%40microsoft.com%7Cfcf469a0c882413c2d5b08d8721e5a16%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637384821965614745%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ACYYxttjBoRP0dSwSBjanIXUmtCa5Am0Uxr1DL8euU4%3D&reserved=0 yes this is my output: {"ver":"1.0","account_type":"Managed","domain_name":"contoso.com","cloud_instance_name":"microsoftonline.com","cloud_audience_urn":"urn:federation:MicrosoftOnline"}

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzureAD%2Fazure-activedirectory-library-for-python%2Fissues%2F241%23issuecomment-710671275&data=04%7C01%7Crayluo%40microsoft.com%7Cfcf469a0c882413c2d5b08d8721e5a16%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637384821965614745%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=goN9D8WyWUBOCShoMZQHaGkE06SLRDJ5StWNDMPNi9A%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAGISLXEXHOIRE3JKJZBVUDSLC6RHANCNFSM4SSHYDUA&data=04%7C01%7Crayluo%40microsoft.com%7Cfcf469a0c882413c2d5b08d8721e5a16%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637384821965624741%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=6eXxikrJV%2Fko155vmcXFMCrGp3%2F7PC85M4mus4pl9%2Fc%3D&reserved=0.

fatimamb commented 4 years ago

@rayluo yes they all on the same computer. my last question if this a proxy error, is there any way to pass the proxy through the URL?

also, there is a step in the azure portal by click on (Grant admin for...) but it is disabled for me I can not click on it, do you think that is what causes the error?

thank you for helping me.

rayluo commented 4 years ago

If you already know your machine needs some proxy for it to connect to Internet, you need to tell ADAL which proxy to use. See the proxies parameter document here, or you can probably create environment variables for it, as described here.

PS: In case you need a simple python script to test whether your environment variable are setup correctly, the following code snippet roughly mimics how this ADAL library tries to connect to that URL. If it would work, ADAL will also work.

import requests
print(requests.get("https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0").text)

P.P.S: I'm running out of tricks up my sleeve. :-)

fatimamb commented 4 years ago

@rayluo I will try and see what happen, thank you for your time and help

fatimamb commented 4 years ago

@rayluo as you suggested I tried this code line 

import requests
print(requests.get("https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0").text)

but get the same error, also I tried to pass the proxy on get function but get the same error too. so I thought to apply the same code in another laptop (outside the network environment) to avoid proxy error, and I got another error as shown below.

print(requests.get("https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0").text)

{"ver":"1.0","account_type":"Managed","domain_name":"contoso.com","cloud_instance_name":"microsoftonline.com","cloud_audience_urn":"urn:federation:MicrosoftOnline"}

token = context.acquire_token_with_username_password(resource=resource_url,
                                                     client_id=client_id,
                                                     username=username,
                                                     password=password)

AdalError: Get Token request returned http error: 400 and server response: {"error":"invalid_request","error_description":"AADSTS90002: Tenant 'domen name' not found. This may happen if there are no active subscriptions for the tenant. Check to make sure you have the correct tenant ID. Check with your subscription administrator.\r\nTrace ID: num-num-num-num-num\r\nCorrelation ID: num-num-num-num-num\r\nTimestamp: 2020-10-18 17:02:34Z","error_codes":[90002],"timestamp":"2020-10-18 17:02:34Z","trace_id":"num-num-num-num-num","correlation_id":"num-num-num-num-num","error_uri":"https://login.microsoftonline.com/error?code=90002"}

notice : I did some edit on the error message (URL) for privacy reason any ideas what is that mean?

rayluo commented 4 years ago

OK so we confirmed that the firsts hypothesis on the ProxyError, quoted below.

if you have a proxy in your network environment, you may also need to check there to ensure you can physically reach a domain name like https://login.windows.net/common/UserRealm/johndoe@contoso.com?api-version=1.0 or https://login.microsoftonline.com/common/UserRealm/johndoe@contoso.com?api-version=1.0.

So, we now consider this Proxy topic came to a conclusion.

For your follow-up question, it seems that error message suggests a possible cause:

AdalError: Get Token request returned http error: 400 and server response: {"error":"invalid_request","error_description":"AADSTS90002: Tenant 'domen name' not found. This may happen if there are no active subscriptions for the tenant. Check to make sure you have the correct tenant ID. Check with your subscription administrator.\r\nTrace ID: num-num-num-num-num\r\nCorrelation ID: num-num-num-num-num\r\nTimestamp: 2020-10-18 17:02:34Z","error_codes":[90002],"timestamp":"2020-10-18 17:02:34Z","trace_id":"num-num-num-num-num","correlation_id":"num-num-num-num-num","error_uri":"https://login.microsoftonline.com/error?code=90002"}

P.S.: