[Bug] Issue with MSAL 4.16.0 library when using Integrated Windows Authentication

[hiteshdasikamw]

Which Version of MSAL are you using ?
MSAL 4.16.0

Platform
netcore

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)
• Web App
  • Authorization code
  • OBO
• Web API
  • OBO

Other? - please describe;

Is this a new or existing app?
c. This is a new app or experiment

Repro

            app = PublicClientApplicationBuilder.Create(clientId).WithTenantId(tenant).WithAuthority(authority).Build();
            try
            {
                Task<AuthenticationResult> result = app.AcquireTokenByIntegratedWindowsAuth(scopes).WithUsername(username).ExecuteAsync();
                Console.Write(result.Result.AccessToken);
                Console.ReadLine();
            }
            catch (Exception exc)
            {
                Console.WriteLine(exc);
                MsalException x = exc.InnerException as MsalException;
                Console.WriteLine(x);
                MsalClientException ex = exc.InnerException as MsalClientException;
                Console.WriteLine(ex);
            }

The exception I get is shown below

Expected behavior
Expected to write access token onto the console.

Actual behavior
Below is the exception that occurs

System.AggregateException: One or more errors occurred. (Federated service at <Organization URL> returned error: ) ---> Microsoft.Identity.Client.MsalClientException: Federated service at <Organization URL> returned error:  ---> Microsoft.Identity.Client.MsalServiceException: Federated service at <Organization URL> returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
   --- End of inner exception stack trace ---
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.PerformWsTrustMexExchangeAsync(String federationMetadataUrl, String cloudAudienceUrn, UserAuthType userAuthType, String username, SecureString password)
   at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest.FetchAssertionFromWsTrustAsync()
   at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByIntegratedWindowsAuthParameters integratedWindowsAuthParameters, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
   at MSALTest.Program.Main(String[] args) in source\repos\MSALTest\MSALTest\Program.cs:line 40
---> (Inner Exception #0) MSAL.NetCore.4.16.0.0.MsalClientException:
        ErrorCode: parsing_wstrust_response_failed
Microsoft.Identity.Client.MsalClientException: Federated service at <Organization URL> returned error:  ---> Microsoft.Identity.Client.MsalServiceException: Federated service at <Organization URL> returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
   --- End of inner exception stack trace ---
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.PerformWsTrustMexExchangeAsync(String federationMetadataUrl, String cloudAudienceUrn, UserAuthType userAuthType, String username, SecureString password)
   at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest.FetchAssertionFromWsTrustAsync()
   at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByIntegratedWindowsAuthParameters integratedWindowsAuthParameters, CancellationToken cancellationToken)
Inner Excception: MSAL.NetCore.4.16.0.0.MsalServiceException:
        ErrorCode: federated_service_returned_error
Microsoft.Identity.Client.MsalServiceException: Federated service at <Organization URL> returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
        StatusCode: 401
        ResponseBody:
        Headers: Date: Mon, 10 Aug 2020 20:24:54 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
WWW-Authenticate: Negotiate
Set-Cookie: PF=QSEPNWjNTF0s1lakkLKluT;Path=/;Secure;HttpOnly;SameSite=None
Transfer-Encoding: chunked
<---

MSAL.NetCore.4.16.0.0.MsalClientException:
        ErrorCode: parsing_wstrust_response_failed
Microsoft.Identity.Client.MsalClientException: Federated service at <Organization URL> returned error:  ---> Microsoft.Identity.Client.MsalServiceException: Federated service at <Organization URL> returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
   --- End of inner exception stack trace ---
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.PerformWsTrustMexExchangeAsync(String federationMetadataUrl, String cloudAudienceUrn, UserAuthType userAuthType, String username, SecureString password)
   at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest.FetchAssertionFromWsTrustAsync()
   at Microsoft.Identity.Client.Internal.Requests.IntegratedWindowsAuthRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenByIntegratedWindowsAuthParameters integratedWindowsAuthParameters, CancellationToken cancellationToken)
Inner Excception: MSAL.NetCore.4.16.0.0.MsalServiceException:
        ErrorCode: federated_service_returned_error
Microsoft.Identity.Client.MsalServiceException: Federated service at <Organization URL> returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
        StatusCode: 401
        ResponseBody:
        Headers: Date: Mon, 10 Aug 2020 20:24:54 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
WWW-Authenticate: Negotiate
Set-Cookie: PF=QSEPNWjNTF0s1lakkLKluT;Path=/;Secure;HttpOnly;SameSite=None
Transfer-Encoding: chunked

Additional context/ Logs / Screenshots
Point to note here is that when I use MSAL 4.15.0 or below version, it works fine. It only happens from MSAL 4.16.0 and above versions.

[bgavrilMS]

I think you are using some sort of federation and the federated server is refusing the connection. Are you maybe behind a proxy that requires auth?

Federated service at <Organization URL> returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
        StatusCode: 401

It migth help to capture the traffic using Fiddler/

[hiteshdasikamw]

I am not behind any proxy actually. This works fine when I use MSAL 4.15.0. (The same code that I showed). I am trying to understand what is going wrong here.

[jabbera]

We started receiving this error randomly beginning around Saturday and we didn't change what was in production. Its the reason why I submitted PR #1984 so hopefully I can figure out what's going on. Not having the body is an issue. We are unfederated with Seamless SSO.

[bgavrilMS]

@jabbera - we plan to release MSAL 4.18 end of next week, but I've built a preview package that has your change - see attached (I had to rename to zip, but it's a nupkg).

Microsoft.Identity.Client.4.18.0-preview1.nupkg.zip

[jabbera]

Thanks!

[KrothuTheCoder]

I have had the same error with 4.17.1 when upgrading from 4.6.0 where the exact same code was working.

MSAL.NetCore.4.17.1.0.MsalClientException:
        ErrorCode: parsing_wstrust_response_failed
Microsoft.Identity.Client.MsalClientException: Federated service at https://<insert company dns>/adfs/services/trust/2005/windowstransport returned error:
 ---> MSAL.NetCore.4.17.1.0.MsalServiceException:
        ErrorCode: federated_service_returned_error
Microsoft.Identity.Client.MsalServiceException: Federated service at https://<insert company dns>/adfs/services/trust/2005/windowstransport returned error:
   at Microsoft.Identity.Client.WsTrust.WsTrustWebRequestManager.GetWsTrustResponseAsync(WsTrustEndpoint wsTrustEndpoint, String wsTrustRequest, RequestContext requestContext)
   at Microsoft.Identity.Client.WsTrust.CommonNonInteractiveHandler.GetWsTrustResponseAsync(UserAuthType userAuthType, String cloudAudienceUrn, WsTrustEndpoint endpoint, String username, SecureString securePassword)
        StatusCode: 401
        ResponseBody:
        Headers: Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: Negotiate
Date: Mon, 17 Aug 2020 16:09:10 GMT

[moanrose]

I am experiencing the same issue on MSAL 4.17.1

But I only see the issue on .NET core (3.1), if i run the exact same code on .NET framework (4.7.2) - it works as intended

If I downgrade MSAL to v. 4.15 the token acquisition works as intended

[trwalke]

Was able to reproduce. Investigating solution

[fstugren]

I have noticed the same change in behavior for AcquireTokenByIntegratedWindowsAuth when switching from Microsoft.Identity.Client version 4.15.0 to any of the newer versions. 4.15.0 is the last package version where my code works with AcquireTokenByIntegratedWindowsAuth. Older versions work too. As soon as I switch to 4.16.0 up to 4.18.0 (most recent version at the time I write this) the parsing_wstrust_response_failed error is thrown. This is for an application on .Net Core 3.1.

[bgavrilMS]

This is the root cause: dotnet/runtime#26397 i.e. UseDefaultCredentials is broken.