Open reillysiemens opened 10 months ago
Hello! A quick search for those WAM error codes seems to indicate there may be a problem with your network access, possibly access through a proxy or via a firewall.
Do you have any proxies or restrictive firewalls in the way? Does this affect other applications that use the Windows broker (WAM) such as Office/Teams etc?
Error Code: 3399942148
Error Message: NoNetwork
WAM Error Message: (pii)
Internal Error Code: 557973641
@mjcheetham: At the time of the report the user did not have any obvious restrictive configurations and was actively using many other networked applications (such as Teams, Edge, etc.) without issue, which is part of why this was so confusing. 😕
@reillysiemens - is this something that happens frequently or was it a one off?
@bgavrilMS - do you know of a way for us to get more detailed WAM logs to help diagnose this issue?
@ldennington: This is something we've seen happen a handful of times before, but never had a consistent repro for or this level of debugging output. This is the first time we've been able to capture this much detail about the surrounding circumstances.
As far as we can tell it doesn't happen frequently or to a large swath of users, but it's also not been a completely isolated event. We're working with the user now to understand if we can still consistently repro this for them.
This particular issue was further complicated by the fact that the user's environment was configured to use
credential.msauthUseBroker true
credential.msauthUseDefaultAccount true
Per the GCM docs on credential.msauthFlow
it sounds like if broker use is enabled then other flows won't be tried. In this case we unblocked the user by having them run
git config --local credential.msauthUseBroker false
git config --local credential.msauthUseDefaultAccount false
, but I'm not sure that's the ideal long-term solution. Is there a reason why other flows wouldn't be tried if the broker fails? Or am I misunderstanding the logic there?
This particular issue was further complicated by the fact that the user's environment was configured to use
This is not the default configuration. One of the many reasons we don't enable broker by default is because of problems like this (vague failure modes and errors).
Is there a reason why other flows wouldn't be tried if the broker fails? Or am I misunderstanding the logic there?
We always expect the broker to work, or at least show some sort of user-visible and actionable error messages. Could we catch errors like this and fall-back to a non-broker flow? Yes, but since we do not include telemetry in GCM this sort of error would go unnoticed and then we'd no doubt be getting questions like "why didn't GCM use the broker even though I set the config? it's using a different flow?".
@bgavrilMS any clues as to what this error is? It appears to be coming from WAM/MSAL Runtime.
We have some users having this same issue:
WAM Error
Error Code: 3399942148
Error Message: NoNetwork
WAM Error Message: (pii)
Internal Error Code: 557973641
Possible cause: no Internet connection
The current conclusion is that it's a client side error?
Hi team, we got the exact same error when trying to simulate a user's network environment which has SSL decryption in their firewall with Fiddler.
The network path is something like this:
Fiddler proxy configured at Windows OS level + Fiddler root CA trusted <--> Fiddler proxy with SSL decryption enabled <--> Internet
It is worth noting that the silent token requests are successful, but it fails whenever it involves an interactive token request.
WAM Error
Error Code: 3399942148
Error Message: NoNetwork
WAM Error Message: (pii)
Internal Error Code: 557973641
Possible cause: no Internet connection
Other network requests in the same app work well with the same proxy + trusted CA settings. Any idea if any extra configs are required in this setup? A lot of enterprise users have this kind of network configuration, so we are getting quite a few customer complains WRT this issue.
Version
2.1.2.0
Operating system
Windows
OS version or distribution
Windows 11 Build 22621
Git hosting provider(s)
Azure DevOps
Other hosting provider
No response
(Azure DevOps only) What format is your remote URL?
https://dev.azure.com/{org}
Can you access the remote repository directly in the browser?
Yes, I can access the repository
Expected behavior
The user is authenticated and their Git operation completes successfully. If their Git operation does not complete successfully it is at least somewhat obvious what failed and what they might be able to do about it.
Actual behavior
The Git operation failed and the reasons were not obvious. The error code cannot be found in the current list of known error codes associated with WAM.
Logs
A redacted stack trace of what the user encountered follows. These environment variables were set.
GIT_TRACE=1
GCM_TRACE=1
GCM_TRACE_MSAUTH=1