az login does not work in GitHub Codespaces

[jongio]

Describe the bug

az login with default options doesn't work with GitHub Codespaces. It fails when trying to hit localhost on response.

To Reproduce

Open GitHub Codespaces.
run az upgrade to get to 2.30
run az login in GitHub Codespaces, the default codespace is fine.

This is printed:

The default web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.

**Workaround **

1. Use --use-device-code option
2. Detect if user is in Codespaces by checking CODESPACES=true env var and call az login with --use-device-code

Expected behavior

It should work in GitHub Codespaces with default options.

Environment summary

GitHub Codespaces
Linux-5.4.0-1062-azure-x86_64-with-debian-bullseye-sid, Ubuntu 20.04.3 LTS
Python 3.6.10
Installer: DEB

azure-cli 2.30.0

Additional context

[yonzhan]

@jiasli for awareness

[jongio]

This should be a workaround

Add to devcontainer.json

"forwardPorts": [
		8400
],

But would be nice if CLI defaulted to --use-device-code if in CODESPACES

[noelbundick-msft]

I hit this regularly and have to use az login --use-device-code to login - which works, but is cumbersome and not a great experience.

The CLI + Codespaces correctly opens a new browser tab and I'm able to authenticate with AAD. After auth, I am redirected to http://localhost:38891/?code=<snip>&client_info=<snip>&state=<snip>&session_state=<snip>, which doesn't exist when I'm inside a codespace in my browser

If I take that localhost url that fails and run curl <redirect URI> inside my codespace terminal, I'm able to complete a normal login flow

It also works if I replace localhost with my auto-forwarded port for that url. Ex: https://my-repo-5grrrp47jhpg9p-45271.githubpreview.dev/?code=<snip>&client_info=<snip>&state=<snip>&session_state=<snip>

My desired experience is that azure-cli would detect if I'm running it in a codespace terminal session by inspecting the CODESPACES=true environment variable. And then continue to launch the localhost server on a random port, but instead of redirecting from AAD to http://localhost - have the AAD redirect flow send me to my public codespace url, which is a private url/port forward only accessible to me. This value can be found in the CODESPACE_NAME env var. Ex: redirectUri = f"https://{CODESPACE_NAME}-{AZURE_CLI_PORT}.githubpreview.dev"

[jongio]

@yonzhan - Did the redirect port change? I was able to do this before with forwardPorts, but the az cli redirect to localhost port changed recently

[jiasli]

Azure CLI 2.30.0 uses MSAL which let the system choose a random available port, instead of fixing to 8400. @rayluo

@jongio, in Azure CLI < 2.30.0, it uses ADAL and a fixed 8400 port.

[jongio]

Can we configure it to be a static port for the codespace scenario?

[jongio]

Maybe a solution is to add --redirectPort to az login so we can call expose that port from codespaces devcontainer and then pass that port to az login

[vhvb1989]

@jongio , the port always changes.
See this workaround: Azure/azure-dev#1006 (comment)

This is also the case on ssh-remote connection. The port-redirect needs to be set just before launching the browser to authenticate, as the url should contains a call back url that is used to return the auth token back to the az cli. That call back url should be different if az is running on codespaces, or using ssh-remote connection to a VM