Cant Add Account 1.41.1 and 1.41.2 #22227

ncapito · 2023-03-08T17:21:54Z

I was having issues this morning with my Active Directory Universal MFA so i "removed the account." It now wont let me add it back. I've tried newer versions of ADS, I've restarted, i've cleared out he Library/Application Support/azuredatastudio directory. Nothing seems to work.

Version info:
Version: 1.41.2 (Universal)
Commit: 0f0960d
Date: 2023-02-08T20:15:24.215Z (3 wks ago)
VS Code: 1.67.0
Electron: 19.1.8
Chromium: 102.0.5005.167
Node.js: 16.14.2
V8: 10.2.154.15-electron.0
OS: Darwin x64 22.3.0

When i go to Linked Accounts -> Add an account i get errors with: "TypeError: Cannot read properties of undefined (reading 'authLibrary')"

notificationsAlerts.ts:42 error
onDidChangeNotification @ notificationsAlerts.ts:42
(anonymous) @ notificationsAlerts.ts:28
invoke @ event.ts:575
deliver @ event.ts:779
fire @ event.ts:740
addNotification @ notifications.ts:206
notify @ notificationService.ts:137
(anonymous) @ mainThreadMessageService.ts:86
ZoneAwarePromise @ /Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:1351
_showMessage @ mainThreadMessageService.ts:44
$showMessage @ mainThreadMessageService.ts:38
_doInvokeHandler @ rpcProtocol.ts:475
_invokeHandler @ rpcProtocol.ts:460
_receiveRequest @ rpcProtocol.ts:374
_receiveOneMessage @ rpcProtocol.ts:296
(anonymous) @ rpcProtocol.ts:161
invoke @ event.ts:575
deliver @ event.ts:779
fire @ event.ts:740
fire @ ipc.net.ts:638
_receiveMessage @ ipc.net.ts:958
(anonymous) @ ipc.net.ts:831
invoke @ event.ts:575
deliver @ event.ts:779
fire @ event.ts:740
acceptChunk @ ipc.net.ts:382
(anonymous) @ ipc.net.ts:338
L @ ipc.net.ts:60
emit @ node:events:526
addChunk @ node:internal/streams/readable:315
readableAddChunk @ node:internal/streams/readable:289
Readable.push @ node:internal/streams/readable:228
onStreamRead @ node:internal/stream_base_commons:190
Show 3 more frames
log.ts:313 ERR TypeError: Cannot read properties of undefined (reading 'providerId')
at Pi.findAccountByKey (accountStore.ts:105:15)
at accountStore.ts:31:63
at Array.findIndex ()
at accountStore.ts:31:29
at _ZoneDelegate.invoke (/Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:409:30)
at Zone.run (/Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:169:47)
at /Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:1326:38
at _ZoneDelegate.invokeTask (/Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:443:35)
at Zone.runTask (/Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:214:51)
at drainMicroTaskQueue (/Applications/Azure Data Studio.app/Contents/Resources/app/node_modules.asar/zone.js/dist/zone.js:632:39)
at process.processTicksAndRejections (node:internal/process/task_queues:96:5)
log.ts:313 ERR adding account failed
log.ts:313 ERR Error while adding account: Error: Adding account failed, check Azure Accounts log for more info.

The text was updated successfully, but these errors were encountered:

cheenamalhotra · 2023-03-08T18:02:43Z

This looks related to the recent bug we fixed here: #22140

@ncapito

Can you add this setting in settings.json and try again?

    "azure.authenticationLibrary": "MSAL"

ncapito · 2023-03-08T18:11:44Z

@cheenamalhotra It's currently set to MSAL (when i try with this setting i get the error above). When i toggled to ADAP it opened chrome and then locked up waiting https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&response_mode=query&client_id=removed&redirect_uri=http%3A%2F%2Flocalhost%3A49783%2Fredirect&state=49783%2CcGt742e0w%252BjfKr2Owo619Q%253D%253D&prompt=select_account&code_challenge_method=S256&code_challenge=removed&resource=https%3A%2F%2Fmanagement.core.windows.net%2F

In case its useful this is what those settings look like:

cheenamalhotra · 2023-03-08T19:08:51Z

It may not be set in the settings.json as it's default. Please try adding explicitly by opening settings.json:

Open command pallete (Ctrl+Shift+P)
Run command: Preferences: Open Default Settings (JSON) (workbench.action.openRawDefaultSettings)

When i toggled to ADAL it opened chrome and then locked up waiting...

Are you in proxy enabled env by any chance? If yes, you may want to configure proxy in http.proxy setting:

"http.proxy": "https://userName@fqdn:yourPassword@yourProxyURL.com:8080"

ncapito · 2023-03-08T20:16:33Z

@cheenamalhotra I'm not in a proxy enabled environment.

I edited

settings.json and added "azure.authenticationLibrary": "MSAL"
restarted ADS
tried to connect account and got an error but the message was different.

I did check with my colleagues. They are all on 141.2 but dont have an issue because they did not remove the account.

ncapito · 2023-03-08T20:57:04Z

@cheenamalhotra I have an update on this one. I was able to get ADAL returning and throwing the same error now. My firewall was blocking access to Azure Data Studio (since i removed the app and reinstalled it). Once I allowed connections i now get the same error:

the console had this in it:

cpirtea-bun · 2023-03-09T00:04:59Z

I have the same problem. Went as far as remove all traces of Azure Data Studio and reinstalled clean. Nothing works. MSAL or ADAL both end up in the same 2 errors:
"TypeError: Cannot read properties of undefined (reading 'authLibrary')"
"Error: Adding account failed, check Azure Accounts log for more info."

github-actions · 2023-03-09T01:14:29Z

We need more info to debug your Azure Active Directory issue. If you could attach your logs to the issue (ensure no private data is in them), it would help us fix the issue much faster.

In the settings menu, find the setting titled Azure: Logging Level and select the Verbose option
Run the process that produces your error
Open command palette (Click View -> Command Palette)
Run the command: Developer: Open Logs Folder
Follow this path to find the Azure Accounts log file: [default log folder]/exthost1/output_logging_[earliest timestamp]/#-Azure Acounts.log
Please attach the Azure-Accounts.log file to the issue.

cheenamalhotra · 2023-03-09T01:17:24Z

@ncapito

Can you please fetch Azure account logs as per above comment?

@cpirtea-bun

Please verify if you've added this in settings.json (as I mentioned above: #22227 (comment), #22227 (comment))
If that's done and issue persists, please enable detailed logs and upload logs here.

cpirtea-bun · 2023-03-09T01:19:29Z

@cheenamalhotra will upload logs.
Just wanted to mention I installed the insider build and same outcome, however if I switch back to ADAL I get:
"Error: certificate has expired"

cheenamalhotra · 2023-03-09T01:22:15Z

Please upload for both ADAL and MSAL, so I can help for both.

eduardofontes · 2023-03-09T01:23:26Z

Hi Everyone!

Same problem here!

Two logs for you.

renderer2.log
1-Azure Accounts.log

eduardofontes · 2023-03-09T01:37:09Z

[Error]: MSAL: Error requesting auth code - [{"errorCode":"endpoints_resolution_error","errorMessage":"Error: could not resolve endpoints. Please check network and try again. Detail: ClientAuthError: openid_config_error: Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints. Attempted to retrieve endpoints from: https://undefined/organizations/v2.0/.well-known/openid-configuration","subError":"","name":"ClientAuthError"}]

cpirtea-bun · 2023-03-09T01:39:25Z

$onExtensionRuntimeError @ mainThreadExtensionService.ts:79
mainThreadExtensionService.ts:80 SyntaxError: Unexpected token < in JSON at position 0
at JSON.parse ()
at IncomingMessage. (c:\Users\cpirtea\AppData\Local\Programs\Azure Data Studio - Insiders\resources\app\extensions\azurecore\node_modules@azure\msal-node\dist\msal-node.cjs.development.js:321:22)
at IncomingMessage.emit (node:events:538:35)
at endReadableNT (node:internal/streams/readable:1345:12)
at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
$onExtensionRuntimeError @ mainThreadExtensionService.ts:80

cheenamalhotra · 2023-03-09T03:09:51Z

Thank you for the logs.

[Error]: MSAL: Error requesting auth code - 
[{
    "errorCode":"endpoints_resolution_error",
    "errorMessage":"Error: could not resolve endpoints. Please check network and try again. 
        Detail: ClientAuthError: openid_config_error: Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints. 
        Attempted to retrieve endpoints from: https://undefined/organizations/v2.0/.well-known/openid-configuration",
    "subError":"",
    "name":"ClientAuthError"
}]

About this error, I recall seeing that when I was implementing MSAL support in vscode-mssql extension, that I also reported here: AzureAD/microsoft-authentication-library-for-js#4879 but hadn't seen that in ADS yet. Now it makes me think if it's related to some other factors too. I'm going to try updating to latest MSAL.js v1.16.0 if that helps resolve this issue, as it seems to contain a proper fix.

onExtensionRuntimeError @ mainThreadExtensionService.ts:79
mainThreadExtensionService.ts:80 SyntaxError: Unexpected token < in JSON at position 0
  at JSON.parse ()
  at IncomingMessage. (c:\Users\cpirtea\AppData\Local\Programs\Azure Data Studio - Insiders\resources\app\extensions\azurecore\node_modules@azure\msal-node\dist\msal-node.cjs.development.js:321:22)
  at IncomingMessage.emit (node:events:538:35)
  at endReadableNT (node:internal/streams/readable:1345:12)
  at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
  $onExtensionRuntimeError @ mainThreadExtensionService.ts:80

This seems related to a corrupted cache file leading to runtime error in MSAL, can you please try deleting cache file:

C:\Users\~\AppData\Roaming\azuredatastudio\Azure Accounts\azureTokenCacheMsal-azure_publicCloud (Windows)
or /Users/~/Library/Application Support/azuredatastudio/Azure Accounts/azureTokenCacheMsal-azure_publicCloud (Mac OS)

cpirtea-bun · 2023-03-09T04:11:03Z

I deleted the cache and same error appeared

cpirtea-bun · 2023-03-09T04:11:49Z

Just looking at the code the error comes from parsing the response so it should not have anything to do with the cache.

cpirtea-bun · 2023-03-09T04:13:37Z

After you update to latest MSAL do I wait for next insider build?

cheenamalhotra · 2023-03-09T04:26:46Z

Yes, it'll be available in the next update.

ncapito · 2023-03-09T11:09:07Z

We need more info to debug your Azure Active Directory issue. If you could attach your logs to the issue (ensure no private data is in them), it would help us fix the issue much faster.

In case this is still needed. Logs are below. I'm using this with Azure Active Directory + Azure SQL.

Here was the first log from adding account using ADAL.
2-Azure Accounts.log

Here is the log from the MSAL
2-Azure Accounts.log

StacyCMay · 2023-03-09T17:52:00Z

I am also seeing this behaviour using Azure Data Studio v1.41.2.

cheenamalhotra · 2023-03-09T18:46:48Z

Yes, it'll be available in the next update.

Just FYI, MSAL-Node update needs more work in insiders and has been postponed, but we're actively investigating on issues with the stable release.

StacyCMay · 2023-03-09T18:50:25Z

Yes, it'll be available in the next update.

Hotfix or May release?

ncapito · 2023-03-11T11:50:36Z

Quick update. I did file a ticket with Azure Support. I will let you know once i hear back from them.

I'm using visual studio code versions are below but both failed for me (MSAL and ADAL). It looks like the same error.

=

VS Code Version:

Version: 1.76.1
Commit: 5e805b79fcb6ba4c2d23712967df89a089da575b
Date: 2023-03-08T16:32:09.831Z (2 days ago)
Electron: 19.1.11
Chromium: 102.0.5005.196
Node.js: 16.14.2
V8: 10.2.154.26-electron.0
OS: Darwin x64 22.3.0
Sandboxed: No

cpirtea-bun · 2023-03-12T23:36:31Z

Hi everyone,
I've learned from an internal thread, v1.39.1 of ADS seems to work in this use-case, can someone who's affected confirm the same? Also please try with v1.40.2 as that would be useful for us to diagnose the problem. If it does, you may use the same to stay unblocked, while we continue with investigations.

1.39.1 works, but 1.40.2 does not. The error logs from 1.40.2 are:

Same thing here. 1.39.1 works, 1.40.2 does not.

ncapito · 2023-03-13T17:54:46Z

@cheenamalhotra i found another work around. I disabled this setting "System Certificates".

Once i did that i was able to authorize using ADAL and MSL.

To verify it actually fixed the error i then turned that setting back on, removed my account, and tried to add it again (and it did fail).

Please let me know if this info helps in any way or if there is anything you would like me to check on myside. The good news is i have a workaround.

cheenamalhotra · 2023-03-13T22:01:28Z

Interesting! Could you also test with the latest insiders build and let us know if that helps in this case?

PhilHannent · 2023-03-14T08:57:31Z

Good morning, I can confirm that unticking the system certificates solved the issue in both Production and the latest Insider build. Reticking the box causes the issue to come back.

Version: 1.43.0-insider
Commit: ef99e67
Date: 2023-03-14T05:34:10.238Z
VS Code: 1.67.0
Electron: 19.1.8
Chromium: 102.0.5005.167
Node.js: 16.14.2
V8: 10.2.154.15-electron.0
OS: Darwin arm64 22.3.0

and

Version: 1.41.2
Commit: 0f0960d
Date: 2023-02-08T20:15:24.215Z
VS Code: 1.67.0
Electron: 19.1.8
Chromium: 102.0.5005.167
Node.js: 16.14.2
V8: 10.2.154.15-electron.0
OS: Darwin x64 22.3.0

StacyCMay · 2023-03-15T02:56:11Z

Confirmed here as well. Unchecking System Certificates setting works in 1.41.2

ncapito · 2023-03-21T00:07:17Z

@ncapito if possible, it would be helpful to have an Azure Support case for this, so we can get details on the user identities and times of the auth attempts (to try to correlate with errors in the service telemetry). And to be able to request more detailed logs that we can't collect over GitHub due to potential for PII data.

What would you like me to ask Azure to do? They are asking me to do some random stuff, i would like to help guide the convo.

cheenamalhotra · 2023-03-21T16:48:21Z

Hi @ncapito

It does seem like a certificate is involved when this error occurs, if you could investigate which certificate is contributing to this error with Azure support that would be helpful.

johnborges · 2023-03-23T16:42:55Z

Unchecking Http: System Certs and switching to ADAL default connection works for me.

cheenamalhotra · 2023-03-23T16:51:01Z

@johnborges

Unchecking Http: System Certs and switching to ADAL default connection works for me.

What error do you get when using MSAL and "Http: System Certificates" unchecked?

johnborges · 2023-03-23T17:02:03Z

Same error as @ncapito above. Error adding account. I was also unable to edit my previous connections.

cheenamalhotra · 2023-03-23T17:36:00Z

It's strange, since others were able to unblock with MSAL too..

Could you also test adding account with VSCode-MSSQL extension in VS Code as well? You can find Azure related logs in the bottom Output pane: Azure Logs when using extension.

Please open a new issue and attach any errors that you notice when adding account.

cheenamalhotra · 2023-03-24T21:51:19Z

Hi Everyone,

We were able to find the expired Trusted Root Certificate Authority that caused this issue with one of the affected customers.

You can navigate to: "Manage Computer Certificates" > Trusted Root Certification Authorities > Certificates
Find the DigiCert certificate expired on March 8, 2023, e.g. "DigiCert SHA2 Secure Server CA"

It's likely that due to organization policies this certificate wasn't updated in your case. You can find more info in the article from DigiCert: https://knowledge.digicert.com/generalinformation/digicert-root-and-intermediate-ca-certificate-updates-2023.html (March 8, 2023, ICA/Root Replacements) - that explains how the issue started on March 8, 2023.

You would likely need to install the updated DigiCert Trusted Root CA Certificates. Please contact your organization or DigiCert support for official guidance on the same.

cheenamalhotra · 2023-03-24T22:16:25Z

I will proceed to close the issue as external.

ncapito · 2023-04-01T00:35:04Z

@cheenamalhotra I work somewhere where we have relatively loose controls around this. I've experienced this in Azure Data Studio and VS code (today). I'm not understanding how this is an organizational issue. Do you have instructions or guidance on how i can check this on a mac?

cheenamalhotra · 2023-04-03T17:46:27Z

@ncapito

Do you see an expired/not trusted DigiCert certificate in Keychain Access?
ref: https://support.apple.com/en-ca/guide/keychain-access/kyca2794/11.0/mac/13.0

ncapito changed the title ~~Cant Add Account~~ Cant Add Account 1.41.1 and 1.41.2 Mar 8, 2023

cheenamalhotra added Bug Area - Azure Triage: Done labels Mar 8, 2023

cheenamalhotra added the Needs Logs - Azure label Mar 9, 2023

cheenamalhotra mentioned this issue Mar 9, 2023

Update @azure/msal-node to 1.16.0 #22255

Merged

cheenamalhotra added this to the May 2023 Release milestone Mar 9, 2023

cheenamalhotra mentioned this issue Mar 9, 2023

Null & Error handling in Azure core #22259

Merged

cheenamalhotra mentioned this issue Mar 12, 2023

Upgrade http(s)-proxy-agent dependent npm packages #22306

Merged

cheenamalhotra mentioned this issue Mar 13, 2023

A non-MSALJS error on MS 365 sign in OfficeDev/TeamsFx#7995

Open

kburtram unpinned this issue Mar 14, 2023

cheenamalhotra added the External Impacted by external factors label Mar 14, 2023

kburtram modified the milestones: April 2023 Release, March 2023 Release Mar 14, 2023

xiaolang124 mentioned this issue Mar 15, 2023

Proxy: System Certificates will block VsCode extension msal login microsoft/vscode#177175

Open

kburtram modified the milestones: March 2023 Release, April 2023 Release Mar 16, 2023

cheenamalhotra closed this as completed Mar 24, 2023

cheenamalhotra mentioned this issue Mar 30, 2023

Failure to Sign in to Azure... #22536

Closed

cheenamalhotra mentioned this issue Apr 4, 2023

Azure Account adding not working #9885

Closed

cheenamalhotra mentioned this issue Apr 14, 2023

Error while adding Account #22710

Closed

cheenamalhotra mentioned this issue Sep 11, 2023

Unable to link Azure Account after 1.45.1 Upgrade #24370

Closed

Cant Add Account 1.41.1 and 1.41.2 #22227

Cant Add Account 1.41.1 and 1.41.2 #22227

Comments

ncapito commented Mar 8, 2023 • edited

cheenamalhotra commented Mar 8, 2023

ncapito commented Mar 8, 2023 • edited

cheenamalhotra commented Mar 8, 2023 • edited

ncapito commented Mar 8, 2023

ncapito commented Mar 8, 2023

cpirtea-bun commented Mar 9, 2023

github-actions bot commented Mar 9, 2023

cheenamalhotra commented Mar 9, 2023 • edited

cpirtea-bun commented Mar 9, 2023 • edited

cheenamalhotra commented Mar 9, 2023

eduardofontes commented Mar 9, 2023 • edited

eduardofontes commented Mar 9, 2023

cpirtea-bun commented Mar 9, 2023 • edited

cheenamalhotra commented Mar 9, 2023

cpirtea-bun commented Mar 9, 2023

cpirtea-bun commented Mar 9, 2023 • edited

cpirtea-bun commented Mar 9, 2023

cheenamalhotra commented Mar 9, 2023

ncapito commented Mar 9, 2023 • edited

StacyCMay commented Mar 9, 2023

cheenamalhotra commented Mar 9, 2023

StacyCMay commented Mar 9, 2023

ncapito commented Mar 11, 2023

cpirtea-bun commented Mar 12, 2023

ncapito commented Mar 13, 2023 • edited

cheenamalhotra commented Mar 13, 2023

PhilHannent commented Mar 14, 2023

StacyCMay commented Mar 15, 2023

ncapito commented Mar 21, 2023

cheenamalhotra commented Mar 21, 2023

johnborges commented Mar 23, 2023

cheenamalhotra commented Mar 23, 2023

johnborges commented Mar 23, 2023

cheenamalhotra commented Mar 23, 2023 • edited

cheenamalhotra commented Mar 24, 2023

cheenamalhotra commented Mar 24, 2023

ncapito commented Apr 1, 2023 • edited

cheenamalhotra commented Apr 3, 2023 • edited

ncapito commented Mar 8, 2023 •

edited

ncapito commented Mar 8, 2023 •

edited

cheenamalhotra commented Mar 8, 2023 •

edited

cheenamalhotra commented Mar 9, 2023 •

edited

cpirtea-bun commented Mar 9, 2023 •

edited

eduardofontes commented Mar 9, 2023 •

edited

cpirtea-bun commented Mar 9, 2023 •

edited

cpirtea-bun commented Mar 9, 2023 •

edited

ncapito commented Mar 9, 2023 •

edited

ncapito commented Mar 13, 2023 •

edited

cheenamalhotra commented Mar 23, 2023 •

edited

ncapito commented Apr 1, 2023 •

edited

cheenamalhotra commented Apr 3, 2023 •

edited