`acquire_token_interactive` cannot open web browser on WSL2 + Ubuntu 22.04

[jiasli]

Describe the bug
acquire_token_interactive cannot open web browser on WSL2 + Ubuntu 22.04. The upstream issue is microsoft/WSL#8892.

To Reproduce

$ az login
A web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.
/usr/bin/xdg-open: 882: x-www-browser: not found
/usr/bin/xdg-open: 882: firefox: not found
/usr/bin/xdg-open: 882: iceweasel: not found
/usr/bin/xdg-open: 882: seamonkey: not found
/usr/bin/xdg-open: 882: mozilla: not found
/usr/bin/xdg-open: 882: epiphany: not found
/usr/bin/xdg-open: 882: konqueror: not found
/usr/bin/xdg-open: 882: chromium: not found
/usr/bin/xdg-open: 882: chromium-browser: not found
/usr/bin/xdg-open: 882: google-chrome: not found
/usr/bin/xdg-open: 882: www-browser: not found
/usr/bin/xdg-open: 882: links2: not found
/usr/bin/xdg-open: 882: elinks: not found
/usr/bin/xdg-open: 882: links: not found
/usr/bin/xdg-open: 882: lynx: not found
/usr/bin/xdg-open: 882: w3m: not found
xdg-open: no method available for opening 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?...'

Additional context
Windows Terminal supports Ctrl+Click to open hyperlinks, so the user can Ctrl+Click the URL after xdg-open: no method available for opening to open the web browser and the rest steps work as usual.

[rayluo]

Thanks for bringing this to our attention.

If the end user is aware that they are using "WSL2 + Ubuntu22.04", installing wslu package or setting up a proper BROWSER env var will allegedly work.

From Azure CLI's perspective, it is lucky that last line of error provides a visible URL:

xdg-open: no method available for opening 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?...'

So, perhaps Azure CLI can reword the first line in your screenshot:

A web browser has been will be opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue ... If no web browser is available or if the web browser fails to open, you can manually open the link shown in an error message below, or use device code flow ...

[bgavrilMS]

Btw, MSAL.NET added support for several other tools for opening browser on Linux, apart from xdg-open: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/src/client/Microsoft.Identity.Client/Platforms/netcore/NetCorePlatformProxy.cs#L236

Not sure it'll fix the issue here, as xdg-open does seem to exist on the box. But I wonder if wslview will work.

[rayluo]

Bogdan Gavril (@bgavrilMS) , is there an MSAL .Net test app for Jiashuo Li (@jiasli) to test the MSAL .Net behavior and see if that helps?

Regardless, I do not think this is a bug. At least not in MSAL Python.

Python has a built-in module webbrowser which was designed and implemented to support multiple browsers. But in this case, not even a python -m webbrowser -t "https://www.python.org" would work, according to @jiasli 's report here. MSAL Python is designed and implemented to rely on Python's webbrowser behavior.

This was working before, so it feels like a regression on WSL.

Anyway, the "p2" and "bug" labels got my attention. Jiashuo Li (@jiasli) , you can ping me offline for an alternative solution, which will still be in the direction of my earlier suggestion of refining Azure CLI's error message. But I can tell you an undocumented API that would be triggered only when browser is unavailable.

[jiasli]

The Ubuntu 22.04 on my another computer doesn't have xdg-utils installed, or if I uninstall xdg-utils explicitly:

sudo apt remove xdg-utils

On Python 3.10, webbrowser.open returns False:

$ /usr/bin/python3 -V
Python 3.10.12
$ /usr/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
False

This makes 8d86917 kick in, triggering the logic we added for Ubuntu 18.04 (#333).

But on Python 3.11 (which Azure CLI 2.54.0 DEB package bundles), webbrowser.open returns True and prints an error:

$ /opt/az/bin/python3 -V
Python 3.11.5
$ /opt/az/bin/python3 -c "import webbrowser; print(webbrowser.open('https://login.microsoftonline.com/'))"
True
gio: https://login.microsoftonline.com/: Operation not supported

I can tell you an undocumented API that would be triggered only when browser is unavailable.

If you are referring to auth_uri_callback, it actually relies on _browse returning False:

microsoft-authentication-library-for-python/msal/oauth2cli/authcode.py

Lines 289 to 311 in 3702816

	browser_opened = False
	try:
	browser_opened = _browse(_uri, browser_name=browser_name)
	except: # Had to use broad except, because the potential
	# webbrowser.Error is purposely undefined outside of _browse().
	# Absorb and proceed. Because browser could be manually run elsewhere.
	logger.exception("_browse(...) unsuccessful")
	if not browser_opened:
	if not auth_uri_callback:
	logger.warning(
	"Found no browser in current environment. "
	"If this program is being run inside a container "
	"which either (1) has access to host network "
	"(i.e. started by `docker run --net=host -it ...`), "
	"or (2) published port {port} to host network "
	"(i.e. started by `docker run -p 127.0.0.1:{port}:{port} -it ...`), "
	"you can use browser on host to visit the following link. "
	"Otherwise, this auth attempt would either timeout "
	"(current timeout setting is {timeout}) "
	"or be aborted by CTRL+C. Auth URI: {auth_uri}".format(
	auth_uri=_uri, timeout=timeout, port=self.get_port()))
	else: # Then it is the auth_uri_callback()'s job to inform the user
	auth_uri_callback(_uri)

but the tricky thing is that in my above examples, you can see webbrowser.open returns True but prints an error. This leaves MSAL no way to know it has failed to open the browser, so auth_uri_callback will never be hit.

[jiasli]

So, perhaps Azure CLI can reword the first line in your screenshot:

A web browser has been will be opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue ... If no web browser is available or if the web browser fails to open, you can manually open the link shown in an error message below, or use device code flow ...

1. We can't delete the https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize as the user must know which tab in the browser is for login. The warning message was added back in [Profile] az login: Add back the warning that a browser is opened Azure/azure-cli#14505
2. Currently, I prefer not to change the warning message specially for a WSL issue that will likely be fixed in the future.