az login fails when -u option used

[GSuggitt]

This is autogenerated. Please review and update as needed.

Describe the bug

If I login with sz login -u gsuggitt@imstsvc.com I will get the following error. This happens if
(a) i enter the password with the -p option
(b) i enter an invalid password with the -p option
(c) i do not use the -p option and I enter the password at the "Password" promt
(d) i do not use the -p option and I enter an invalid passowrd at the "Password" prompt

If I just login with az login, I get the webpage to select the user to use. And this works.
I have two users logged in - my personal name and a name used by my corportation.

Command Name
az login

Errors:

The command failed with an unexpected error. Here is the traceback:
no element found: line 1, column 0
Traceback (most recent call last):
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 231, in invoke
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 663, in execute
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 697, in _run_job
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 333, in __call__
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/profile/custom.py", line 139, in login
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/_profile.py", line 157, in login
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/identity.py", line 156, in login_with_username_password
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/application.py", line 1460, in acquire_token_by_username_password
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/application.py", line 1487, in _acquire_token_by_username_password_federated
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/wstrust_request.py", line 60, in send_request
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/wstrust_response.py", line 48, in parse_response
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/wstrust_response.py", line 52, in parse_error
  File "xml\etree\ElementTree.py", line 1350, in XML
xml.etree.ElementTree.ParseError: no element found: line 1, column 0

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here...
• az login -u {} -p {}

(see above in description of problem)

Expected Behavior

I get logged in!

Environment Summary

Windows-10-10.0.19044-SP0
Python 3.10.4
Installer: MSI

azure-cli 2.37.0

Additional Context

[yonzhan]

@jiasli for awareness

[jiasli]

Duplicate of #20221

MSA (Microsoft Account) doesn't allow signing with username + password. Please just use az login.

@rayluo, the error message seems a little bit weird.

[rayluo]

File "xml\etree\ElementTree.py", line 1350, in XML
xml.etree.ElementTree.ParseError: no element found: line 1, column 0

@rayluo, the error message seems a little bit weird.

That error message was the XML parser complaining that there is no payload to consume. The problem here for MSAL is MSAL does not really know what caused this situation. MSAL could catch it and convert it into something like "The WsTrust server returned an empty response", which is arguably less weird, but not really more helpful. Do you really want MSAL to do that?

Regardless, perhaps Azure CLI can add a generic suggestion to any "az login -u ... -p ..." failure, and suggest to use "az login" instead.

[jiasli]

@rayluo, are you suggesting we should capture xml.etree.ElementTree.ParseError? This falls back again into the topic of AzureAD/microsoft-authentication-library-for-python#482.

[GSuggitt]

Sems to me it is easy to check if -u is used without --service-principal or --identity then print out the informative message. I am assuming the -u can only be used with --service-principal or --identity But from the documentation https://docs.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest#az-login it seems that -u -p is a valid option. If not, fix the documentation [cid:1ca653e9-08c7-40e6-9f59-3d48a1b01b51]

…

________________________________ From: Jiashuo Li ***@***.***> Sent: Wednesday, June 29, 2022 4:07 AM To: Azure/azure-cli ***@***.***> Cc: Gerry Suggitt ***@***.***>; Author ***@***.***> Subject: Re: [Azure/azure-cli] az login fails when -u option used (Issue #23036) @rayluo<https://github.com/rayluo>, are you suggesting we should capture xml.etree.ElementTree.ParseError? This falls back again into the topic of AzureAD/microsoft-authentication-library-for-python#482<AzureAD/microsoft-authentication-library-for-python#482>. — Reply to this email directly, view it on GitHub<#23036 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AB4O6UEYLVQKD2ZLIKTQYBTVRP75XANCNFSM5Z664GCQ>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[rayluo]

@jiasli ,

@rayluo, are you suggesting we should capture xml.etree.ElementTree.ParseError? This falls back again into the topic of AzureAD/microsoft-authentication-library-for-python#482.

Not exactly. #482 is about providing more specific exceptions, which we may do so. But, the xml.etree.ElementTree.ParseError here is already a specific exception. Even if MSAL catches that and throws a new MsalAdfsResponseError, it doesn't really change the error trace (if Azure CLI chooses to let it bubble up) or the Azure CLI error handling (if Azure CLI chooses to catch it).

What I suggested was conceptually like this:

try:
    app.acquire_token_by_username_password(...)
except Exception as e:
    print("Something went wrong. Please consider use an interactive 'az login' (without -u and -p) instead. The error was: %s" % e)

@GSuggitt , yes, -u and -p are valid option. It is just that they have limitations, so we would recommend use "az login" without -u and -p whenever possible.

[jiasli]

MSAL could catch it and convert it into something like "The WsTrust server returned an empty response", which is arguably less weird, but not really more helpful.

I agree with this. Capturing xml.etree.ElementTree.ParseError seems a little bit weird for a client to handle since the client needs to know how MSAL works internally.

Something went wrong.

This is definitely a no-go. I can't forget how frustrated I got when I see Windows shows this to me. 🤣

[rayluo]

MSAL could catch it and convert it into something like "The WsTrust server returned an empty response", which is arguably less weird, but not really more helpful.

I agree with this. Capturing xml.etree.ElementTree.ParseError seems a little bit weird for a client to handle since the client needs to know how MSAL works internally.

Fair enough. But my point remains valid that, regardless of whether MSAL would throw MsalBlahBlahError, Azure CLI could use a "catch all" and then show the generic suggestion "please use interactive 'az login'".

Something went wrong.

This is definitely a no-go. I can't forget how frustrated I got when I see Windows shows this to me. rofl

That was just an example to make a point that "Azure CLI could catch all error". You can change the wording, for example, print("Please consider use an interactive 'az login' (without -u and -p) to avoid this error: %s" % e).