az login - OAuth2Client:Get Device Code request failed

[mtarkowski1]

Installed Azure CLI 2.0 on Windows 10. When I run "az login" with PowerShell 5.x from corporate network it fails. Works fine from home with same laptop.

PS C:\Users\mt> az login --debug
az : DEBUG: Command arguments: ['login', '--debug']
At line:1 char:1

• az login --debug

•   + CategoryInfo          : NotSpecified: (DEBUG: Command ...in', '--debug']:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
  
  

DEBUG: Event: Cli.PreExecute []
DEBUG: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x030422B8>, <function
OutputProducer.on_global_arguments at 0x030B3030>, <function CLIQuery.on_global_arguments at 0x030D3B28>]
DEBUG: Event: CommandInvoker.OnPreCommandTableCreate [<function CLILogging.remove_logger_flags at 0x03042300>]
DEBUG: Installed command modules ['acr', 'acs', 'advisor', 'appservice', 'backup', 'batch', 'batchai', 'billing', 'cdn', 'cloud',
'cognitiveservices', 'configure', 'consumption', 'container', 'cosmosdb', 'dla', 'dls', 'eventgrid', 'eventhubs', 'extension', 'feedback',
'find', 'interactive', 'iot', 'keyvault', 'lab', 'monitor', 'network', 'profile', 'rdbms', 'redis', 'reservations', 'resource', 'role',
'servicebus', 'servicefabric', 'sql', 'storage', 'vm']
DEBUG: Loaded module 'acr' in 0.008 seconds.
DEBUG: Loaded module 'acs' in 0.008 seconds.
DEBUG: Loaded module 'advisor' in 0.006 seconds.
DEBUG: Loaded module 'appservice' in 0.010 seconds.
DEBUG: Loaded module 'backup' in 0.008 seconds.
DEBUG: Event: CommandLoader.OnLoadCommandTable []
DEBUG: Loaded module 'batch' in 0.046 seconds.
DEBUG: Loaded module 'batchai' in 0.010 seconds.
DEBUG: Loaded module 'billing' in 0.024 seconds.
DEBUG: Event: CommandLoader.OnLoadCommandTable []
DEBUG: Loaded module 'cdn' in 0.012 seconds.
DEBUG: Loaded module 'cloud' in 0.008 seconds.
DEBUG: Loaded module 'cognitiveservices' in 0.010 seconds.
DEBUG: Loaded module 'configure' in 0.006 seconds.
DEBUG: Loaded module 'consumption' in 0.016 seconds.
DEBUG: Loaded module 'container' in 0.011 seconds.
DEBUG: Loaded module 'cosmosdb' in 0.015 seconds.
DEBUG: Loaded module 'dla' in 0.013 seconds.
DEBUG: Loaded module 'dls' in 0.009 seconds.
DEBUG: Loaded module 'eventgrid' in 0.007 seconds.
DEBUG: Loaded module 'eventhubs' in 0.012 seconds.
DEBUG: Loaded module 'extension' in 0.008 seconds.
DEBUG: Loaded module 'feedback' in 0.004 seconds.
DEBUG: Loaded module 'find' in 0.006 seconds.
DEBUG: Loaded module 'interactive' in 0.002 seconds.
DEBUG: Loaded module 'iot' in 0.013 seconds.
DEBUG: Loaded module 'keyvault' in 0.017 seconds.
DEBUG: Loaded module 'lab' in 0.013 seconds.
DEBUG: Loaded module 'monitor' in 0.015 seconds.
DEBUG: Loaded module 'network' in 0.049 seconds.
DEBUG: Loaded module 'profile' in 0.013 seconds.
DEBUG: Loaded module 'rdbms' in 0.016 seconds.
DEBUG: Loaded module 'redis' in 0.011 seconds.
DEBUG: Loaded module 'reservations' in 0.011 seconds.
DEBUG: Loaded module 'resource' in 0.017 seconds.
DEBUG: Loaded module 'role' in 0.010 seconds.
DEBUG: Loaded module 'servicebus' in 0.017 seconds.
DEBUG: Loaded module 'servicefabric' in 0.011 seconds.
DEBUG: Loaded module 'sql' in 0.015 seconds.
DEBUG: Event: CommandLoader.OnLoadCommandTable []
DEBUG: Loaded module 'storage' in 0.082 seconds.
DEBUG: Loaded module 'vm' in 0.038 seconds.
DEBUG: Loaded all modules in 0.608 seconds. (note: there's always an overhead with the first module loaded)
DEBUG: Extensions directory: 'C:\Users\mt.azure\cliextensions'
DEBUG: Event: CommandInvoker.OnPreCommandTableTruncate []
DEBUG: Event: CommandInvoker.OnPostCommandTableCreate [<function add_id_parameters at 0x0368B078>]
DEBUG: Event: CommandInvoker.OnCommandTableLoaded []
DEBUG: Event: CommandInvoker.OnPreParseArgs [<function _documentdb_deprecate at 0x037CAC00>]
DEBUG: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x030B3078>, <function
CLIQuery.handle_query_parameter at 0x030D3B70>, <function handler at 0x03843CD8>]
DEBUG: attempting to read file C:\Users\mt.azure\accessTokens.json as utf-8-sig
DEBUG: adal-python : 7b2598a9-9606-47f5-b399-4609271aa25g - Authority:Performing instance discovery: ...
DEBUG: adal-python : 7b2598a9-9606-47f5-b399-4609271aa25g - Authority:Performing static instance discovery
DEBUG: adal-python : 7b2598a9-9606-47f5-b399-4609271aa25g - Authority:Authority validated via static instance discovery
INFO: adal-python : 7b2598a9-9606-47f5-b399-4609271aa25g - CodeRequest:Getting user code info.
DEBUG: urllib3.connectionpool : Starting new HTTPS connection (1): login.microsoftonline.com
ERROR: adal-python : 7b2598a9-9606-47f5-b399-4609271aa25g - OAuth2Client:Get Device Code request failed
Traceback (most recent call last):
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connection.py", line 141, in _new_conn
(self.host, self.port), self.timeout, **extra_kw)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\util\connection.py", line 60, in create_connection
for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\socket.py", line 743, in getaddrinfo
for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno 11001] getaddrinfo failed
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connectionpool.py", line 601, in urlopen
chunked=chunked)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connectionpool.py", line 346, in _make_request
self._validate_conn(conn)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connectionpool.py", line 850, in _validate_conn
conn.connect()
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connection.py", line 284, in connect
conn = self._new_conn()
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connection.py", line 150, in _new_conn
self, "Failed to establish a new connection: %s" % e)
urllib3.exceptions.NewConnectionError: <urllib3.connection.VerifiedHTTPSConnection object at 0x046167B0>: Failed to establish a new connection:
[Errno 11001] getaddrinfo failed
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\requests\adapters.py", line 440, in send
timeout=timeout
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\connectionpool.py", line 639, in urlopen
_stacktrace=sys.exc_info()[2])
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\urllib3\util\retry.py", line 388, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url:
/common/oauth2/devicecode?api-version=1.0 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x046167B0>:
Failed to establish a new connection: [Errno 11001] getaddrinfo failed',))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\adal\oauth2_client.py", line 301, in get_user_code_info
timeout=self._call_context.get('timeout', None))
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\requests\api.py", line 112, in post
return request('post', url, data=data, json=json, **kwargs)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\requests\api.py", line 58, in request
return session.request(method=method, url=url, **kwargs)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\requests\sessions.py", line 508, in request
resp = self.send(prep, **send_kwargs)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\requests\sessions.py", line 618, in send
r = adapter.send(request, **kwargs)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\requests\adapters.py", line 508, in send
raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url:
/common/oauth2/devicecode?api-version=1.0 (Cause
d by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x046167B0>: Failed to establish a new connection: [Errno 11001]
getaddrinfo failed',))
ERROR: Please ensure you have network connection. Error detail: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries
exceeded with url: /common/oauth2/devicecode?api-version=1.0 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object
at 0x046167B0>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',))

[derekbekoe]

@Azure/azure-cli

[yugangw-msft]

@mtarkowski1, can you cross check whether you have the network? This doesn't appear as a CLI issue

ERROR: Please ensure you have network connection. Error detail: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries
exceeded with url: /common/oauth2/devicecode?api-version=1.0 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object
at 0x046167B0>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',))

[mtarkowski1]

Yes, I do have network but inside corporate network. I know CLI uses Python, is there some way to tell Python to use the proxy?

[yugangw-msft]

You can set through HTTP_PROXY environment variable, if your proxy server has unsigned certificate, then you should set REQUESTS_CA_BUNDLE to a cert file
But regardless, blocking this basic AAD endpoint seems a bit overkill to me.

[sptramer]

@derekbekoe - We've had several people report proxy issues at this point, so I think we may need to document any available proxy settings as part of login, or at least in a troublehsooting FAQ.

[yugangw-msft]

Suggest cover for both windows and linux users

[mtarkowski1]

Making some progress here . . .

Under my system environment I added the following.
http_proxy=http://username:password@proxy.example.com
https_proxy=http://username:password@proxy.example.com

PS C:\Users\mtarkow3\Desktop> netsh winhttp show proxy
Current WinHTTP proxy settings:
Direct access (no proxy server).

Running the following I now get this. It appears to be working but I get this warning.

PS C:\Users\mtarkow3> az login
az : WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code EHDTSTE3V to
authenticate.
At line:1 char:1

• az login

•   + CategoryInfo          : NotSpecified: (WARNING: To sig...o authenticate.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
  
  

[
{
"cloudName": "AzureCloud",
"id": "1aca50c4-c447-4f02-a6d3-ebe9770ced59",
"isDefault": true,
"name": "COMPANY-NAME",
"state": "Enabled",
"tenantId": "60986bc4-78a6-4b4b-af58-6bc104cca352",
"user": {
"name": "my_email@company.com",
"type": "user"
}
}
]

Thank you everyone for looking into this.

[yugangw-msft]

@mtarkowski1 you are welcome.
Sort of unrelated, but since we are at it, did you see the following warning in red error text font?

+ CategoryInfo          : NotSpecified: (WARNING: To sig...o authenticate.:String) [], RemoteException
 + FullyQualifiedErrorId : NativeCommandError

Feel it odd why PowerShell would render a regular warning as error? I am not familiar with PowerShell, but did you configure some policy which would affect the output?

[derekbekoe]

It may be similar to this Azure/azure-cli#6139

[yugangw-msft]

Thanks @derekbekoe
@mtarkowski1, FYI, the warning is expected for CLI to tell you the code to login, but the text itself gets rendered a bit crappy in PowerShell which we are trying to figure out

[yugangw-msft]

@mtarkowski1, for the warning thing, it is not a CLI issue, please checkout Azure/azure-cli#6139 for details.
With this, we should wrap up all non-doc issues here.