[Bug] Impossible to Login into External Identities

[MatteoCalabro-TomTom]

Which version of MSAL Go are you using?

github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2

Where is the issue?

• Public client
  • [ ] Device code flow
  • [ ] Username/Password (ROPC grant)
  • [X] Authorization code flow
  • [X] Interactive Login
• Confidential client
  • [ ] Authorization code flow
  • [ ] Client credentials:
    • [ ] client secret
    • [ ] client certificate
• Token cache serialization
  • [ ] In-memory cache
• Other (please describe)

Is this a new or an existing app? New App

What version of Go are you using (go version)?

1.23, this is irrelevant.

What operating system and processor architecture are you using (go env)?

MacOS Arm

Expected behavior

A successful login using the correct authority for External Identities: https://<name>.ciamlogin.com

Actual behavior

Trying to use the actual authority, doesn't even start the authorization flow:

http call(https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=https%3A%2F%2F<name>.ciamlogin.com%2F<tenant-id>%2Foauth2%2Fv2.0%2Fauthorize)(GET) error: reply status code was 400:
{
  "error": "invalid_instance",
  "error_description": "AADSTS50049: Unknown or invalid instance. Trace ID: *** Correlation ID: *** Timestamp: 2024-09-18 14:47:11Z",
  "error_codes": [
    50049
  ],
  "timestamp": "2024-09-18 14:47:11Z",
  "trace_id": "***",
  "correlation_id": "***",
  "error_uri": "https://login.microsoftonline.com/error?code=50049"
}

Replacing the authority https://<name>.ciamlogin.com/<tenant-id> with the more common https://login.microsoftonline.com/<tenant-id> brings forth the authentication screen (browser) but fails with:

could not retrieve token from auth code: http call(https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token)(POST) error: reply status code was 401:
{
  "error": "invalid_client",
  "error_description": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: *** Correlation ID: *** Timestamp: 2024-09-18 14:50:18Z",
  "error_codes": [
    7000218
  ],
  "timestamp": "2024-09-18 14:50:18Z",
  "trace_id": "***",
  "correlation_id": "***",
  "error_uri": "https://login.microsoftonline.com/error?code=7000218"
}

Possible solution

Still investigating...

Additional context / logs / screenshots Add any other context about the problem here, such as logs and screenshots.

[MatteoCalabro-TomTom]

Additional info: disabling instance discovery (public.WithInstanceDiscovery(false)) seems to work better, but still ends in an error:

could not retrieve token from auth code: http call(https://***.ciamlogin.com/***/oauth2/v2.0/token)(POST) error: reply status code was 401:
{
  "error": "invalid_client",
  "error_description": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: *** Correlation ID: *** Timestamp: 2024-09-18 15:17:48Z",
  "error_codes": [
    7000218
  ],
  "timestamp": "2024-09-18 15:17:48Z",
  "trace_id": "***",
  "correlation_id": "***",
  "error_uri": "https://***.ciamlogin.com/error?code=7000218"
}

[MatteoCalabro-TomTom]

I am closing the issue as I think I solved it but will leave my findings for the records.

Adding public.WithInstanceDiscovery(false) client option indeed fixes the MSAL issue, but as of today there are other issues on External Identities side.

So far, I have found that:

• using public client with instance discovery enabled does not work - MSAL & ExtID
• requesting offline_access in the scopes (although supported and configured in the app registration), breaks authentication flow - ExtID
• using a multi-tenant app authority (https://<name>.ciamlogin.com/organizations) does not work - ExtID

  http call(https://<name>.ciamlogin.com/organizations/v2.0/.well-known/openid-configuration)(GET) error: reply status code was 400: AADSTS500209: Unspecific Tenant is not supported in this domain.

  Note: still MUST have instance discovery disabled.

• sometimes login does and does not work: The AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. error was quite erratic yesterday.