az login on headless vm opens w3m due to a regression.

[temporaer]

Describe the bug
In a headless linux VM, doing az login opens www-browser and that in turn opens w3m, a text-only browser that does not support the device login flow.

To Reproduce
ssh into headless VM without X forwarding. run az login.

Expected behavior
Device code flow should get initiated, ie, i should see a URL and a code to enter there after opening it in a javascript-capable browser.

Environment summary
I used the script install on linux to get the newest version.

Additional context
This is a regression, which was introduced by this commit. Ie, it doesn't check DISPLAY envvar anymore.

[temporaer]

Note: since az cli code gets vendored by azureml, the same issue occurs in the azureml sdk's InteractiveLoginAuthentication, but can't be worked around using the --use-device-code flag.

[yonzhan]

@jiasli for awareness

[jiasli]

This is indeed a tricky topic. Previously in ADAL-based Azure CLI, we did prevent launching a www-browser browser:

azure-cli/src/azure-cli-core/azure/cli/core/util.py

Line 710 in 0a1edd5

if getattr(default_browser, 'name', None) == 'www-browser': # text browser won't work

And we use powershell.exe to launch the Windows host browser on WSL:

azure-cli/src/azure-cli-core/azure/cli/core/util.py

Lines 654 to 661 in 0a1edd5

	if is_wsl(): # windows 10 linux subsystem
	try:
	# https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe
	# Ampersand (&) should be quoted
	return subprocess.Popen(
	['powershell.exe', '-NoProfile', '-Command', 'Start-Process "{}"'.format(url)]).wait()
	except OSError: # WSL might be too old # FileNotFoundError introduced in Python 3
	pass

But later on, WSL supports www-browser which launches the Windows host browser so MSAL uses www-browser to do auth code flow. The tricky part is that we can't know whether www-browser is a text browser or GUI browser:

• www-browser is a text browser on some Linux distributions
• www-browser is Windows host browser on WSL

@temporaer, is it possible that on some Linux distribution besides WSL www-browser is also a GUI browser?

BTW, after CLI tries to open a browser, it will show a warning and tell the user to do device code flow in case of failure:

> az login
The default web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. 
Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, 
use device code flow with `az login --use-device-code`.

We are actually opening more opportunity to www-browser as it may be a GUI browser, so I don't think is necessarily a "regression".

[rayluo]

But later on, WSL supports www-browser which launches the Windows host browser so MSAL uses www-browser to do auth code flow. The tricky part is that we can't know whether www-browser is a text browser or GUI browser:

• www-browser is a text browser on some Linux distributions
• www-browser is Windows host browser on WSL

I concur with @jiasli's triage. In fact, there is another situation (other than WSL) that the www-browser would still work. That is the Azure Cloud Shell (although that one would require more ingredient - it would require Azure CLI to adjust its app registration a little bit - @jiasli & @yonzhan, we tested that proof-of-concept before.) Anyway, my point is "we can't know whether www-browser would eventually launch a real browser". So, the current approach is to still attempt the www-browser, but provide a hint for the user to manually switch to az login --use-device-code as plan B.

[temporaer]

I tend to disagree with the assessment from an outside point of view. It would be better to explicitly detect wsl or cloud shell rather than providing the confusing experience with w3m. Also in the vendored code in azureml, there's no way to use the flag you suggest since users may not even have az installed. The only way to fix that for me was to rename system executables www-browser and w3m.

I would rather have slightly more complex code than a bad user experience.

[temporaer]

One could also argue that this is a bug in wsl since it should provide x-www-browser, not www-Browser (re: @jiasli's question, one should expect www-browser to be text-only on all distros.)

[jiasli]

One could also argue that this is a bug in wsl since it should provide x-www-browser, not www-Browser

For this, do you mind opening an issue at https://github.com/microsoft/WSL/issues ?

[temporaer]

@jiasli i can but it won't solve the problem here. Even if they fix wsl, and all users somehow obtain the fix, az behavior on VMs will still be broken.