Enable broker support on Linux for WSL

[Dharshan BJ (DharshanBJ)]

No description provided.

[Dharshan BJ (DharshanBJ)]

/azp run MSAL-Python-SDL-CI

[fengga]

Thanks, this PR looks good to me. And please make sure get an approval from Ray.

[Ray Luo (rayluo)]

Thanks for a clean PR! Implementation wise, it looks good. I added some suggestions above, mostly in terms of our workflow. Please make corresponding changes and then wait for the PyMsalRuntime release.

[Ray Luo (rayluo)]

We will also need to change the precise dependency version error message here and a approximate version hint there

[Dharshan BJ (DharshanBJ)]

We will also need to change the precise dependency version error message here and a approximate version hint there

updated

[Thomas Aarholt (thomasaarholt)]

Dharshan BJ (@DharshanBJ), I would love to see this wrapped up.

I arrived here after trying to debug errors with using msal on WSL. This PR worked "as-advertised" and made my life a whole lot easier.

Before your PR, the following snippet kept returning a browser window with The redirect URI 'http://localhost:<some port number>' specified in the request does not match the redirect URIs configured for the application.

Testing with enable_broker_on_linux=True "just worked". 🚀

    app = PublicClientApplication(
        <client_id>,
        authority=<authority>,
        enable_broker_on_linux=True,
    )
    app.acquire_token_interactive(...)

[Ray Luo (rayluo)]

Thanks for your effort all this time! Approving now, and I'll follow up with the merge and then the release shortly after.

[Jiashuo Li (jiasli)]

Tested the code in Azure/azure-cli#31169, but can't get it working.

The behavior is different from enable_broker_on_windows where an account selection window is opened. In WSL, no account selection window is opened. It fails to acquire access token even for the home tenant (Microsoft).

$ az login
...
Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136

Retrieving tenants and subscriptions for the selection...
Authentication failed against tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft': Can't find token from MSAL cache.

[Jiashuo Li (jiasli)]

Doesn't launch account selection window.

[Ray Luo (rayluo)]

Doesn't launch account selection window.

Please upgrade to WSL 2.4.13+

It fails to acquire access token even for the home tenant (Microsoft).

Dharshan BJ (@DharshanBJ) , can you investigate this one?

[Dharshan BJ (DharshanBJ)]

Doesn't launch account selection window.

Please upgrade to WSL 2.4.13+

It fails to acquire access token even for the home tenant (Microsoft).

Dharshan BJ (@DharshanBJ) , can you investigate this one?

Checked with jiasli, the issue is due to not having WSL 2.4.13+, since the user is not able to acquire the token interactively(due to not having the account picker changes), the error message "Authentication failed against tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft': Can't find token from MSAL cache." is for that same reason.

[Jiashuo Li (jiasli)]

I checked update in both Windows Store and Windows Update, but WSL is still on an old version

> wsl --version
WSL version: 2.1.5.0
Kernel version: 5.15.146.1-2
WSLg version: 1.0.60
MSRDC version: 1.2.5105
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version: 10.0.26100.3476

wsl --update is only mentioned by

• https://learn.microsoft.com/en-us/windows/wsl/basic-commands#update-wsl
• https://learn.microsoft.com/en-us/windows/wsl/install#want-to-try-the-latest-wsl-preview-features

https://learn.microsoft.com/en-us/windows/wsl/install should contain a section on "How to update WSL".

Also, we can't force or expect the users to update WSL to the latest version manually. It is better to have WSL updated by Windows Store or Windows Update automatically.

Besides this, the interface of this functionality looks good to me.

[Jiashuo Li (jiasli)]

I cannot use pymsalruntime 0.18.1 (Azure/azure-cli#31563) right now as this line has not been released.

[Ray Luo (rayluo)]

True. Please subscribe/watch this repo to receive its release notification. We aim for each of the Azure CLI code freeze (minus 2 weeks) as checkpoint. Until then, you would have to manually install from MSAL's dev branch and test.