`az login` fails: OSError: [WinError -2146892987]

[jiasli]

Describe the bug

When running Azure CLI on Microsoft.AzureStackHCI/clusters, az login fails:

> az login --use-device-code
az : WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code xxx to authenticate.
    + CategoryInfo          : NotSpecified: (WARNING: To sig...o authenticate.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
ERROR: The command failed with an unexpected error. Here is the traceback:
ERROR: [WinError -2146892987] : ''
Traceback (most recent call last):
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/cli.py', line 231, in invoke
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 658, in execute
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 721, in _run_jobs_serially
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 692, in _run_job
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 328, in __call__
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/command_operation.py', line 121, in handler
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/command_modules/profile/custom.py', line 149, in login
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/_profile.py', line 153, in login
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/auth/identity.py', line 158, in login_with_device_code
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/application.py', line 1608, in acquire_token_by_device_flow
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oauth2.py', line 384, in obtain_token_by_device_flow
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oauth2.py', line 346, in _obtain_token_by_device_flow
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oidc.py', line 115, in _obtain_token
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oauth2.py', line 789, in _obtain_token
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/application.py', line 581, in lambda
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/token_cache.py', line 307, in add
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/token_cache.py', line 113, in add
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/token_cache.py', line 184, in __add
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal_extensions/token_cache.py', line 49, in modify
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal_extensions/persistence.py', line 163, in save
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal_extensions/windows.py', line 82, in protect
OSError: [WinError -2146892987] : ''
To open an issue, please run: 'az feedback'

Email: AKS on HCI | az login failing with unexpected error, probably known issue

[jiasli]

The workaround is to turn off token encryption: #20231 (comment)

[rayluo]

To be honest, the DPAPI failure is not actionable for MSAL. I believe Bogdan Gavril (@bgavrilMS) also observed similar issues on MSAL .Net too. Is there a contact for DPAPI to report these issues to?

[bgavrilMS]

Yes, indeed, after many struggles with token encryption on both Windows and Mac (for Linux we always knew there is a problem), we decided to allow apps to store tokens in plaintext as a fallback. We recommend that the app makes it very clear to the user that tokens are stored in plaintext.

[bgavrilMS]

By the way, that error code means:

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation

(on corpnet, you can go to http://errors to understand windows errors).

This is pretty standard error in some cases of virtualization, see here. Although there are workarounds, these seem to be "too complex" for most orgs (complex admin policies etc.)

[rayluo]

By the way, that error code means:

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation

(on corpnet, you can go to http://errors to understand windows errors).

This is pretty standard error in some cases of virtualization, see here. Although there are workarounds, these seem to be "too complex" for most orgs (complex admin policies etc.)

Thanks for the details, Bogdan! I am inspired to work out this PR in MSAL EX to hopefully help Azure CLI and/or its users to troubleshoot.

[jiasli]

Workaround

First, you may try to clear the credential cache and re-login:

az account clear
az login

If this still doesn't help, you may temporarily turn off token cache encryption. (⚠ This is an internal experimental config option. We may change it or drop it anytime.)

az config set core.encrypt_token_cache=false
az login