search

microsoft / vscode-azure-account

Common Azure Login extension for VS Code
https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account
Other
138 stars 130 forks source link

Azure Account Authentication Extension Fails To Acquire Token And To Authenticate User. #699

Closed klawrawkz closed 1 year ago

klawrawkz commented 1 year ago

Hi there. My name is klawrawkz. I am fine. How are you? I'll be sure to remove any info that may be sensitive.

The AA(Ex) (Azure Account (Extension)) is reliably not working correctly. On a few occasions I got it to authenticate, but it was flakey as hell and didn't return all our subscriptions. That's odd.

Q: ??Does this occur consistently?? A: Yes

Repro steps:

  1. Attempt to log on automatically when VS Code launches on a Win 2022 Svr dev box.

  2. Verify TLS/Cipher updated as per guidance e.g. https://go.microsoft.com/fwlink/?linkid=2161187

  3. Employ the $Env:NO_PROXY += Solution as per the "Troubleshooting" guidance.

  4. Attempt to login via vs Code F1 > Azure: Sign In and Azure authenticates me for sure.

  5. image

  6. AA(Ex) does not get the memo, failing to accept the authentication.

  7. image YUP.

  8. Same scenario using alternate "log in with a code" method.

  9. Does AA(Ex) need to specify TLS version? I'd think no, it doesn't do that. Perhaps the failure is due to AA(Ex) sending an invalid login request? Or AA(Ex) misreading the auth claim that produced when an end user completes the login via HTTPS Form post? It's unclear to me where TLS/Cipher settings are determined to be incorrect or unsafe and therefore rejected. It appears as though we conduct an otherwise valid authentication process. Clearly the auth server is not receiving (or believes it's not receiving) data via the expected TLS/CIPHER. This is confusing because we have it enabled. However, vs Code (PowerShell) does succeed in authentication with its auth server. This is a different auth server though. Does this server not require TLS 1.2/1.3? I'd need to run WireShark to dig into this further. I'm confused as to where this error originates b/c I don't understand the AA(Ex)'s logic nor how the request is issued. It seems to me that it's probably a standard HTTP(S) client framework.

  10. Below are comprehensive traces of the event. I include a successful authentication from vs Code Powershell Extension. See below traces of the AA(Ex) failure event and contrasting success event from vsCode Powershell.

REQUEST:

POST https://login.microsoftonline.com/<REDACTED>/oauth2/token?api-version=1.0 HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Accept-Charset: utf-8
client-request-id: <REDACTED>
return-client-request-id: true
x-client-SKU: Node
x-client-Ver: 0.2.3
x-client-OS: win32
x-client-CPU: x64
User-Agent: axios/0.21.4
Content-Length: 1160
host: login.microsoftonline.com
Connection: close

grant_type=refresh_token&scope=openid&client_id=<REDACTED>&resource=https%3A%2F%2Fgraph.windows.net%2F&refresh_token=<REDACTED>

RESPONSE:

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: 1d620a30-<REDACTED>-30008475cda0
x-ms-request-id: 2eade739-fc61-<REDACTED>-4b7aa1859200
x-ms-ests-server: 2.1.14357.8 - NCUS ProdSlices
x-ms-clitelem: 1,0,0,1503.8747,
Set-Cookie: fpc=AkrYs5I0jW9DrrVfOJC9lFocvTSvAQAAAKEtXdsOAAAA; expires=Mon, 20-Feb-2023 00:49:38 GMT; path=/; secure; HttpOnly; SameSite=None
Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Sat, 21 Jan 2023 00:49:38 GMT
Connection: close
Content-Length: 3668

{"token_type":"Bearer","scope":"user_impersonation","expires_in":"3761","ext_expires_in":"3761","expires_on":"1674265940","not_before":"1674261878","resource":"https://graph.windows.net/","access_token":"<REDACTED>","refresh_token":"<REDACTED>"}

REQUEST

POST https://login.microsoftonline.com/80d<REDACTED>06/oauth2/token?api-version=1.0 HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Accept-Charset: utf-8
client-request-id: d8c5ca3e-5deb-40ab-a35c-50ce828cbf70
return-client-request-id: true
x-client-SKU: Node
x-client-Ver: 0.2.3
x-client-OS: win32
x-client-CPU: x64
User-Agent: axios/0.21.4
Content-Length: 1155
host: login.microsoftonline.com
Connection: close

grant_type=refresh_token&scope=openid&client_id=aeb<REDACTED>56&resource=https%3A%2F%2Fvault.azure.net&refresh_token=0.AVIAzRzctsRGYkiX4qyMphRKAUNkvK5tmcJFkPA4j_lvqla6ABY.AgABAAEAAAD--DLA3VO7QrddgJg7WevrAgDs_wQA9P-sYD1b6-3ta9Rgk0tEcXwofaaj4ZtME1EsltsvJDGeToqB1cty6KoeidtIQMi28FDOXsTerLSSHFIvZvvzu78RAqBWl-F9I21az6rLdODVhPq7mqNpXklyz7kvxksLcc490vVzdMh5xUHgaza8_1FtJGLkBXttMy4-ComBTAdECMHzlYg05NoNMPwJesTu_yl2iy-dP-IsEsFA93gRstYJShW50q3SBMS7vLRN8s03JLtqqeL0J4I5ceP8uUerV7Cug-XvgUvgsJRM7_OwVFnk7YJIqvZaIdYNxCzikMx1yGdDntna5UUcd4ZaOmeoAfPzleQY89kr994benvu-taMVkGB0ZZeykVNFzjMnX0ws6ILeZ1O0diRV0Xc1jOAAzExdTtD4RHKaOm-h6oBrW_L1IiyPba--QQfGcPYQnNY6MTMz4RjBCccOhOkZ3dP-TPRga5L7yb24D8RAVBy99IusZ9Rw6rNUbg3it02kE85sV_WGjtHwJ-X6iCayvjUWjXrlBbERcotMXNA1a8Sj739hdisod56IMdSj4QbxBUSNEzdd6rd_b8S3dFanZrl-lR1ngcLNWYW5JD071mB1QQtRrgqzrvs5J7S6HkC-dfb9eIg-Pg894Nl_1efX8vYNdVL0PG0sWMclXT_jioAYV_ZQVNVsTzhW_x-WybOvYIGc-XKQ2773T15Y8Jz8hHFpiW-zOnn3RjGPmJh0W4nM087mx3yxjHp6uMc1MF6mbYxWgBD4GRSqOL-N3EgBEmenMHB19GZ1ALH-yL2jKRukMtIJPuplnrPHPv1I2UKF09IVLYmTerWAALfxIv_UZTbyYuUHgCuIy_YM4XTYzzHawZjbuCAClczKkIfxBjwIbIKi8mAl1AhWikcTG-x-njQj08QgIXwU1N4BoWSCAqmqd8jOQ8

RESPONSE

HTTP/1.1 400 Bad Request
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: d8c5ca3e-5deb-40ab-a35c-50ce828cbf70
x-ms-request-id: 8e6b8370-25e8-4609-a3b5-058042d58800
x-ms-ests-server: 2.1.14357.8 - SCUS ProdSlices
x-ms-clitelem: 1,1002016,0,1658.5227,
Set-Cookie: fpc=Ar6J2psURIBHgnUStIyHkiHTfYd5AQAAAKItXdsOAAAA; expires=Mon, 20-Feb-2023 00:49:38 GMT; path=/; secure; HttpOnly; SameSite=None
Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Sat, 21 Jan 2023 00:49:38 GMT
Connection: close
Content-Length: 719

{"error":"invalid_request","error_description":"AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD. Your TenantID is: 80<REDACTED>206. Please refer to https://go.microsoft.com/fwlink/?linkid=2161187 and conduct needed actions to remediate the issue. For further questions, please contact your administrator.\r\nTrace ID: 8e6b8370-25e8-4609-a3b5-058042d58800\r\nCorrelation ID: d8c5ca3e-5deb-40ab-a35c-50ce828cbf70\r\nTimestamp: 2023-01-21 00:49:38Z","error_codes":[1002016],"timestamp":"2023-01-21 00:49:38Z","trace_id":"8e6b8370-25e8-4609-a3b5-058042d58800","correlation_id":"d8c5ca3e-5deb-40ab-a35c-50ce828cbf70"}
  1. I'm calling BS on the invalid TLS/CIPHER claim in the response as we have updated our settings as per the guidance in the link in the above. Note, as demonstrated from examining the registry settings via powershell below. Recall that I have gotten the Account Authentication Extension to process my logon, and it works sporadically, reliably sporadically, as it fails more often than succeeds to authenticate. 
    
Path  : HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319
Name  : SystemDefaultTlsVersions
Value : 1

Path : HKLM:\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v4.0.30319 Name : SchUseStrongCrypto Value : 1

Path : HKLM:\SOFTWARE\Microsoft.NETFramework\v4.0.30319 Name : SystemDefaultTlsVersions Value : 1

Path : HKLM:\SOFTWARE\Microsoft.NETFramework\v4.0.30319 Name : SchUseStrongCrypto Value : 1

Path : HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server Name : Enabled Value : 1

Path : HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server Name : DisabledByDefault Value : 0

Path : HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client Name : Enabled Value : 1

Path : HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client Name : DisabledByDefault Value : 0

12. **_By comparison, when I authenticate using vsCode powershell/bash the results are authentication success as expected. If there is an actual issue with TLS/Cipher, then wouldn't we expect that any authentication would fail because the system is not hardened properly? See below for the traces of a successful authentication (right, though not using the Authentication Extension)_**

REQUEST

GET https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=&redirect_uri=https%3A%2F%2Fvscode.dev%2Fredirect&state=http%3A%2F%2F127.0.0.1%3A52308%2Fcallback?nonce=gAxJh3e1mX%2FMQEk4ALy8vA%3D%3D&prompt=select_account HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9,he-IL;q=0.8,he;q=0.7 Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; esctx=AQABAAAAAAD--; brcap=0; ESTSSSOTILES=1; AADSSOTILES=1; flight-githubsi=true; flight-msaoauth2=true; ESTSLOGOUTREDIRECT=MDtodHRbC5henVyZS5jb20vP3NlbGVjdEFjY291bnQ9dHJ1ZTtUcnVl; CCState=RWhJS0VFMZnJiRG0zSkVzPQ==; MSFPC=GUID=5579137fa3e50&HASH=5579&LV=202212&V=4&LU=1670386001812; wlidperf=FR=L&ST=1672437674796; ESTSSC=10; ESTSWCTXFLOWTOKEN=AQABAAEAAAD--DLA; clrc={%22%3a[%229Ou+MAjD%22]%2c%222%3a[%228gfwFLor%22]%2c%2219378%22%3a[%223mgup1q/%22%2c%22ecR17i36%22%2c%2kI%22%2c%22+SjF/0ga%22%2c%22dMtbH4Ix%22]}; ESTSAUTHPERSISTENT=0.ARcA3ljRgAe1U0; ch=oixTbk; buid=0.ARcA3ljRgAe1U0CUfDWmaRZyBpV3sATbjRpGu-4C-eG_e0YXABY.AQABAAEAAAD--DLA3VO7QrddgJg7WevrClVdGQk4mn4-mxTYvm8vh87_i6j7mBqn3JILIBJceQ7NS9SD0S2shTo_NldNW85GSqlv2ylf2FvoDoL7QOKckunKWWhlKa0BPSxp0CbO0i9N784dPpKX9STN53ZWoFEDEEmxsw0NRUSksgv256B-2vRZzfgVcYmRd0TIhUmxKnQgAA; SignInStateCookie=CAgA; fpc=AgA-3I_Y53FLnIN5-249YjT_SEScAQAAAIYtXdsOAAAAYyF3ZAIAAACaLF3bDgAAAHkQkgcBAAAAgy1d2w4AAAA


RESPONSE

HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 X-Frame-Options: DENY Link: https://aadcdn.msftauth.net; rel=preconnect; crossorigin Link: https://aadcdn.msftauth.net; rel=dns-prefetch Link: https://aadcdn.msauth.net; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 95263139-5bc7-482a-b9f5-01e179c66d00 x-ms-ests-server: 2.1.14357.8 - SCUS ProdSlices Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: ESTSAUTHPERSISTENT=0.ARcA3ljRgDZlM; domain=.login.microsoftonline.com; expires=Fri, 21-Apr-2023 00:49:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: ESTSAUTH=0XyA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: ESTSAUTHLIGHT=+a7ff01a5a; path=/; secure; SameSite=None Set-Cookie: ch=Hhe_Y9vpjHstBY1TVrzHOcVG4pk5DKP_6wvTIYvLUOE; domain=.login.microsoftonline.com; expires=Fri, 21-Apr-2023 00:49:32 GMT; path=/; secure; SameSite=None Set-Cookie: ESTSSC=10; expires=Fri, 21-Apr-2023 00:49:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: buid=0.ARcA3ljRgAe1U0CUfDWmaRZyBpV3sATbjRpGu-4C-eG_e0YXABY.AQABAAEAAAD--DLA3VO7QrddgJg7WevrvZCbEbJ7rJkOTORNxbjQa5wIqU5Lphbp54DRrUb3zLR2tT3DIVd8nvMC-xLIb328mbvmqvOB-1S8mLUFRF5IeUVwV6egvo61Lr6crNVE8AgD3z4wEzGZBdTe2nu5tDh5o-lUOK3BHfupnt5JZSm0HjVoBTgl7TGFCAtDyITKSt4gAA; expires=Mon, 20-Feb-2023 00:49:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AgA-3I_Y53FLnIN5-249YjT_SEScAQAAAIYtXdsOAAAADmKToAEAAACbLV3bDgAAAHkQkgcBAAAAgy1d2w4AAAA; expires=Mon, 20-Feb-2023 00:49:33 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Sat, 21 Jan 2023 00:49:32 GMT Content-Length: 43528

<!DOCTYPE html>

Sign in to your account 

REQUEST

GET https://login.microsoftonline.com/common/reprocess?ctx=rAA2&sessionid=a722 HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=&redirect_uri=https%3A%2F%2Fvscode.dev%2Fredirect&state=http%3A%2F%2F127.0.0.1%3A52308%2Fcallback?nonce=gAxJh3e1mX%2FMQEk4ALy8vA%3D%3D&prompt=select_account Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9,he-IL;q=0.8,he;q=0.7 Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; esctx=AQABggAA; brcap=0; ESTSSSOTILES=1; AADSSOTILES=1; flight-githubsi=true; flight-msaoauth2=true; ESTSLOGOUTREDIRECT=MDtodHRnVl; CCState=RWhPQ==; MSFPC=GUID=5579137f4e774a59a7ac041309da3e50&HASH=5579&LV=202212&V=4&LU=1670386001812; wlidperf=FR=L&ST=1672437674796; ESTSSC=10; ESTSWCTXFLOWTOKEN=; buid=0.ARcA3ljRgAe1U0CUfDWmaRZyBpV3sATbjRpGu-4C-eG_e0YXABY.AQABAAEAAAD--DLA3VO7QrddgJg7WevrvZCbEbJ7rJkOTORNxbjQa5wIqU5Lphbp54DRrUb3zLR2tT3DIVd8nvMC-xLIb328mbvmqvOB-1S8mLUFRF5IeUVwV6egvo61Lr6crNVE8AgD3z4wEzGZBdTe2nu5tDh5o-lUOK3BHfupnt5JZSm0HjVoBTgl7TGFCAtDyITKSt4gAA; fpc=AgA-3I_Y53FLnIN5-249YjT_SEScAQAAAIYtXdsOAAAADmKToAEAAACbLV3bDgAAAHkQkgcBAAAAgy1d2w4AAAA


RESPONSE

HTTP/1.1 302 Found Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://vscode.dev/redirect?code=&state=http%3a%2f%2f127.0.0.1%3a52308%2fcallback%3fnonce%3d%3d%3d&session_state=a7ff0158-6c2c-4eb1-aef4-97faed707922 P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 2508d35a-0b75-4990-9527-c8e426d9b500 x-ms-ests-server: 2.1.14357.8 - WUS2 ProdSlices Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: ESTSAUTHPERSISTENT=; domain=.login.microsoftonline.com; expires=Fri, 21-Apr-2023 00:49:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: ESTSAUTH=0.ARcA3ljRgAe1U0CUfDWmaRZyBkNkvK5tmcJFkPA4j_lvqlYXABY.AgABAAQAAAD--DLA3VO7QrddgJg7WevrAgDs_wQA9P-JJzDcaqNRHzR-kJk3VMeK2pEuJDEfM3QuCQu0aXZBJz46eGyuUSjvOl2jBhYDLDzwn47LNcE6BQ; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: ESTSAUTHLIGHT=; path=/; secure; SameSite=None Set-Cookie: ch=FmIhCvZWlU5fGntnvl2Kjjq-cswYX3cFhTZzgTeNyng; domain=.login.microsoftonline.com; expires=Fri, 21-Apr-2023 00:49:35 GMT; path=/; secure; SameSite=None Set-Cookie: ESTSSC=10; expires=Fri, 21-Apr-2023 00:49:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: buid=0.ARcA3ljRgAe1U0CUfDWmaRZyBkNkvK5tmcJFkPA4j_lvqlYXABY.AQABAAEAAAD--DLA3VO7QrddgJg7WevroT55pFFtijvbLSmobbwo4UP1kUztbRcBxCMz5sqJmo51LCZQt8FdZEeQXumW6CdF_lQolTOfT2uNn7lnrrJmlKKS-V0yM5Eobl5rl1NmhOQoyCX3HupbnBxi8BBwNNcIj6t1f2Yb48bI_wOHKhUk4bUZejHJriGgackrlfc33tggAA; expires=Mon, 20-Feb-2023 00:49:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: CCState===; domain=.login.microsoftonline.com; expires=Tue, 31-Jan-2023 00:49:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SignInStateCookie=; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AgA-3I_Y53FLnIN5-249YjT_SEScAQAAAIYtXdsOAAAADmKToAEAAACbLV3bDgAAAGMhd2QBAAAAny1d2w4AAAA; expires=Mon, 20-Feb-2023 00:49:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Sat, 21 Jan 2023 00:49:35 GMT Content-Length: 1022

Object moved

Object moved to here.


REQUEST

POST https://login.microsoftonline.com/common/oauth2/token?api-version=1.0 HTTP/1.1 Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded Accept-Charset: utf-8 client-request-id: f868af5a-f389-4ec0-b7b4-8495b5b184d8 return-client-request-id: true x-client-SKU: Node x-client-Ver: 0.2.3 x-client-OS: win32 x-client-CPU: x64 User-Agent: axios/0.21.4 Content-Length: 1058 host: login.microsoftonline.com Connection: close

grant_type=refresh_token&scope=openid&client_id=aeb56&resource=https%3A%2F%2Fmanagement.core.windows.net%2F&refresh_token=


RESPONSE

HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: f868af5a-f389-4ec0-b7b4-8495b5b184d8 x-ms-request-id: 3530e18a-230b-4f51-b4fa-070e65949700 x-ms-ests-server: 2.1.14357.8 - EUS ProdSlices x-ms-clitelem: 1,0,0,140.7506, Set-Cookie: fpc=; expires=Mon, 20-Feb-2023 00:49:36 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Sat, 21 Jan 2023 00:49:36 GMT Connection: close Content-Length: 5561

{"token_type":"Bearer","scope":"user_impersonation","expires_in":"3804","ext_expires_in":"3804","expires_on":"1674265981","not_before":"1674261876","resource":"https://management.core.windows.net/","access_token":"eyJ0eXAiOiJKnTd9avg","refresh_token":"0.ARcA3ljRgAe1U0CUfD6IjEuMCJ9."}


REQUEST (Note that this is successful and we are receiving data from the azure management api.)

GET https://management.azure.com/tenants?api-version=2016-06-01 HTTP/1.1 content-type: application/json; charset=utf-8 accept-language: en-US x-ms-client-request-id: 12fbad2576660781 authorization: Bearer eyJ0eXAiOiJKV1QWiqSqNUHwnqHANoGnTd9avg user-agent: @azure/arm-subscriptions/3.1.2 ms-rest-azure-js/2.1.0 ms-rest-js/2.6.0 Node/v16.14.2 OS/(x64-Windows_NT-10.0.20348) cookie: Accept: / Accept-Encoding: gzip,deflate Host: management.azure.com Connection: close


RESPONSE

HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 x-ms-ratelimit-remaining-tenant-reads: 11999 x-ms-request-id: 0bce750c-e173-41ef-bcf8-3693c2a71d2e x-ms-correlation-request-id: 0bce750c-e173-41ef-bcf8-3693c2a71d2e x-ms-routing-request-id: EASTUS:20230121T004937Z:0bce750c-e173-41ef-bcf8-3693c2a71d2e Date: Sat, 21 Jan 2023 00:49:36 GMT Connection: close Content-Length: 221

{"value":[{"id":"/tenants/80d15206","tenantId":"80d206"},{"id":"/tenants/b6d4a01","tenantId":"b6d4a01"}]}



<!-- TODO: Share the steps needed to reliably reproduce the problem. Please include actual and expected results. -->

1. Launch theAA(Ex) that creates a web page login UI and login (successfully) only to be rejected by the AA(Ex) (javascript?) code in vsCode. 

Version: 0.11.3
OS: win32
OS Release: 10.0.20348
Product: Visual Studio Code
Product Version: 1.74.3
Language: en

It sure would be swell if we could find a fix for this issue because, well, what's the point of using vsCode if I can't um, CODE?? As I develop cloud solutions to earn my bread, it seems clear: **_a vsCode environment that doesn't allow me to connect to azure is in a word useless. lol._**

Thanks for the help with this.
John-Vance commented 1 year ago

Seeing the same starting within the past few days. Behavior is that sign-in to Azure Account extension via browser Window looks normal and appears to be successful, but VS Code isn't aware, can't view any Azure resources using any extension.

VS Code Version: 1.74.3 (user setup) Extension Version: 0.11.3 OS: Windows_NT x64 10.0.22621

alexweininger commented 1 year ago

@klawrawkz Could you try editing the NO_PROXY environment variable to contain login.microsoftonline.com instead of login.microsoft.com and try again? There was a typo in the workaround doc which has been fixed now. Sorry about that.

Also, if you are using a Microsoft-associated account to sign in, then I would also try switching the authentication library to MSAL and see if that fixes it.

You can change this by going to Settings and searching for "Authentication Library"

image

Also, what method did you use to capture these network requests? I'm still searching for the best way to ask users to capture them.

John-Vance commented 1 year ago

No proxies in use. I was actually able to get it to work by installing the system-wide version and running as a different user, one not currently logged into a different M365 account in the default browser. Seems the issue was credential caching in the browser (even though I was selecting the correct account when prompted). Should be good for now, thanks!

From: Alex Weininger @.> Sent: Thursday, January 26, 2023 17:25 To: microsoft/vscode-azure-account @.> Cc: John Vance @.>; Comment @.> Subject: Re: [microsoft/vscode-azure-account] Azure Account Authentication Extension Fails To Acquire Token And To Authenticate User. (Issue #699)

Could you try editing the NO_PROXY environment variable to contain login.microsoftonline.com instead of login.microsoft.com and try again? There was a typo in the workaround doc which has been fixed now. Sorry about that.

— Reply to this email directly, view it on GitHubhttps://github.com/microsoft/vscode-azure-account/issues/699#issuecomment-1405753010, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUCZQVEQ36SKPUZGYEJNLKLWUL2VLANCNFSM6AAAAAAUCEGZ7Q. You are receiving this because you commented.Message ID: @.***>

alexweininger commented 1 year ago

No proxies in use. I was actually able to get it to work by installing the system-wide version and running as a different user, one not currently logged into a different M365 account in the default browser. Seems the issue was credential caching in the browser (even though I was selecting the correct account when prompted). Should be good for now, thanks!

@John-Vance thanks for following up. Since this is an issue we see a lot, I'd like to know more about your particular fix.

When you say

installing the system-wide version and running as a different user,

are you referring to installing a system-wide version of VS Code. And running VS Code as a different user?

John-Vance commented 1 year ago

Yes, correct. I need to use VS Code with a different AAD account than the one I'm signed into Windows and Edge with. When the Azure Account extension was launching the login picker in the browser, I could choose to sign in with a different account, but that resulted in the reported behavior. Uninstalling VS Code from my user profile and reinstalling system-wide allowed me to 'run as' the correct user, and opened a new browser session as that user when prompting for Azure credentials. Works fine this way, but not sure why it wasn't tolerant of multiple credential sets in a single browser session.

From: Alex Weininger @.> Sent: Thursday, January 26, 2023 17:46 To: microsoft/vscode-azure-account @.> Cc: John Vance @.>; Mention @.> Subject: Re: [microsoft/vscode-azure-account] Azure Account Authentication Extension Fails To Acquire Token And To Authenticate User. (Issue #699)

No proxies in use. I was actually able to get it to work by installing the system-wide version and running as a different user, one not currently logged into a different M365 account in the default browser. Seems the issue was credential caching in the browser (even though I was selecting the correct account when prompted). Should be good for now, thanks!

@John-Vancehttps://github.com/John-Vance thanks for following up. Since this is an issue we see a lot, I'd like to know more about your particular fix.

When you say

installing the system-wide version and running as a different user,

are you referring to installing a system-wide version of VS Code. And running VS Code as a different user?

— Reply to this email directly, view it on GitHubhttps://github.com/microsoft/vscode-azure-account/issues/699#issuecomment-1405772238, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUCZQVGFWMSQKNZAIQHXRVLWUL5DTANCNFSM6AAAAAAUCEGZ7Q. You are receiving this because you were mentioned.Message ID: @.***>

klawrawkz commented 1 year ago

@alexweininger, The MSAL auth worked for me. Thanks.

As an aside I was able to recreate the symptoms by using a proxy server with support for TLS 1.0 rather than TLS 1.0, 1.2, and 1.3. So it seems that a misconfigured proxy server could trigger the issue if the auth endpoint does not accept the TLS version supported by the proxy server.

alexweininger commented 1 year ago

Thanks for letting us know that fix worked!