az login failed: RuntimeError: RuntimeError: WsTrust server returned error in RSTR: {'reason': 'Authentication failed', 'code': 'wst:FailedAuthentication'}

[haguilar3]

This is autogenerated. Please review and update as needed.

Describe the bug

Command Name
az login

Errors:

The command failed with an unexpected error. Here is the traceback:
WsTrust server returned error in RSTR: {'reason': 'Authentication failed', 'code': 'wst:FailedAuthentication'}
Traceback (most recent call last):
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/knack/cli.py", line 231, in invoke
    cmd_result = self.invocation.execute(args)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 658, in execute
    raise ex
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 721, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 692, in _run_job
    result = cmd_copy(params)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 328, in __call__
    return self.handler(*args, **kwargs)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
    return op(**command_args)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/command_modules/profile/custom.py", line 149, in login
    subscriptions = profile.login(
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/_profile.py", line 158, in login
    user_identity = identity.login_with_username_password(username, password, scopes=scopes, **kwargs)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/azure/cli/core/auth/identity.py", line 186, in login_with_username_password
    result = self._msal_app.acquire_token_by_username_password(username, password, scopes, **kwargs)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/msal/application.py", line 1401, in acquire_token_by_username_password
    response = _clean_up(self._acquire_token_by_username_password_federated(
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/msal/application.py", line 1428, in _acquire_token_by_username_password_federated
    wstrust_result = wst_send_request(
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/msal/wstrust_request.py", line 59, in send_request
    return parse_response(resp.text)
  File "/usr/local/Cellar/azure-cli/2.32.0/libexec/lib/python3.10/site-packages/msal/wstrust_response.py", line 49, in parse_response
    raise RuntimeError("WsTrust server returned error in RSTR: %s" % (error or body))
RuntimeError: WsTrust server returned error in RSTR: {'reason': 'Authentication failed', 'code': 'wst:FailedAuthentication'}

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here...
• az login -u {}

Expected Behavior

Environment Summary

macOS-10.15.7-x86_64-i386-64bit, Darwin 19.6.0
Python 3.10.1
Installer: HOMEBREW

azure-cli 2.32.0

Additional Context

[yonzhan]

@jiasli for awareness

[jiasli]

@rayluo, could you please help with this issue?

[rayluo]

RuntimeError: WsTrust server returned error in RSTR: {'reason': 'Authentication failed', 'code': 'wst:FailedAuthentication'}

I tried using a wrong password with 4 different ADFS versions in our lab: v2, v3, v4, v2019. I cannot exactly reproduce the issue. The error message I got was:

RuntimeError: WsTrust server returned error in RSTR: {'reason': 'ID3242: The security token could not be authenticated or authorized.', 'code': 'a:FailedAuthentication'}

Regardless, it seems like ADFS was rejecting @haguilar3 's auth request. @haguilar3 , was the password you used correct?

For what it's worth, a workaround would be to remove that -u your_username -p your_password part and only run az login, so that az would use a browser-based interactive way to auth. That might work.