[Bug] Broker token acquisition fails on macOS (Intel) with error code -42000

Abierto

#908 abierto el 7/5/2026 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad: 4/5
Tiempo estimado: 3-5 días
Aptitud para principiantes: 43/100

Tipo de issue: Error
Claridad: Bastante claro
Estado de actividad: Tranquilo
Stack tecnológico: macos, python
Área: authentication, backend

Línea de trabajo

Start by tracing how msal[broker] builds the macOS broker request for PublicClientApplication with allow_broker=True, then inspect the broker logs showing empty sourceApp and the SouceApplication is invalid error during redirect URI validation. Compare the request path on Intel macOS with the working Apple Silicon path. Done means silent broker acquisition succeeds or falls back to interactive authentication on the reported Intel setup.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs attention public-client Similar-Issue untriaged

Describe the bug
When using MSAL Python with the broker (msal[broker]) on macOS Tahoe 26.4.1 (Intel), silent token acquisition via the SSO broker consistently fails with error code -42000 and domain MSALErrorDomain. The error is thrown in sourceArea: Broker with Status: Response_Status.Status_Unexpected.

From the Company Portal logs, the broker appears to be reachable (keychain lookups succeed, PSSO/secondary broker is selected), but the silent flow ultimately fails. No fallback to interactive auth occurs.

To Reproduce
Steps to reproduce the behavior:
We are not using an off-the-shelf sample. This is a CLI tool that uses msal[broker] for authentication. The relevant auth flow is:

Create a PublicClientApplication with allow_broker=True on macOS Tahoe 26.4.1 (Intel)
Call acquire_token_interactive() or acquire_token_silent() targeting an A2A scope
MSAL routes the request to the macOS SSO broker
Broker returns error code -42000

We can provide the CLI package privately (via Teams) if needed.

Expected behavior
Broker-based token acquisition should succeed, or MSAL should cleanly fall back to interactive browser-based authentication.

What you see instead
Paste the sample output, or add screenshots to help explain your problem.

Error from MSAL Python:

Failed to acquire token: Description: (pii), Domain: MSALErrorDomain.
Error was thrown in sourceArea: Broker.
Status: Response_Status.Status_Unexpected,
Error code: -42000, Tag: 508638916

Native broker logs (from Company Portal):

2026-05-07 13:26:11:691 | I | ADB v3.16.5/WPJ v3.14.1 | Beginning authorization request
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] New Browser SSO state machine handler will be used
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag enable_js_platform_authentication, value in config 1, value type __NSCFNumber, this feature is disabled by default
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Feature flag enable_js_platform_authentication is enabled
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag browser_sso_interaction_enabled, value in config (null), value type (null), this feature is enabled by default
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag browser_sso_disable_mfa, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_browser_sso_intercept_all, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_inapp_sso_signin, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag allow_account_enumeration_for_any_app, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag allow_account_enumeration_for_managed_apps, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag allow_global_signout_for_managed_apps, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sharedDeviceMode, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag suppress_camera_consent, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sdm_suppress_camera_consent, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature strings get_sso_cookie_allowlist, value in config (null), value type (null), this feature is not set by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature strings get_sso_cookie_blocklist, value in config (null), value type (null), this feature is not set by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag admin_debug_mode_enabled, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_app_prompt, value in config (null), value type (null), this feature is enabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_app_prompt_and_autologin, value in config 1, value type __NSCFNumber, this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Feature flag disable_explicit_app_prompt_and_autologin is enabled
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag remove_sso_rt_header, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_native_app_prompt, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_native_app_prompt_and_autologin, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sso_extension_exclude_msal_request_enabled, value in config (null), value type (null), this feature is enabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sso_extension_disable_browser_interrupts, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_ecc_prts, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature string preferred_auth_config, value in config (null), value type (null), this feature is not set by default
2026-05-07 13:26:11:708 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Pre-processing received json...
2026-05-07 13:26:11:708 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] No broker key in json payload, generate it from source application.
2026-05-07 13:26:11:709 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Return pre-preocess json.
2026-05-07 13:26:11:709 | E | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] token_type key is missing in dictionary.
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] PID analysis - Parent is not launchd: YES, Runtime-like: YES
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] No UI is needed. About to execute without UI.
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Handling SSO request, requested operation: refresh
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11 - 22BFFFB8-02DE-46B6-99E5-150B526FB531] Handling silent SSO request...
2026-05-07 13:26:11:714 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] PSSO status : enabled and registered
2026-05-07 13:26:11:715 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] bundleIdsAllowedInBrowserNativeMessageFlow {(
    "com.microsoft.msedge.adhoc-df",
    "com.microsoft.msedge.debug",
    "com.microsoft.edgemac",
    "com.microsoft.edgemac.Canary",
    "com.microsoft.edgemac.Beta",
    "com.microsoft.msedge",
    "com.microsoft.edgemac.local",
    "com.microsoft.edgemac.Dev",
    "com.microsoft.msedge-df.dev",
    "com.microsoft.msedge-df.canary",
    "microsoft.com.browserMessagingHost",
    "com.microsoft.msedge.dogfood",
    "com.microsoft.msedge-df.beta"
)}
2026-05-07 13:26:11:718 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Keychain find status: -25300
2026-05-07 13:26:11:718 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Start redirect_uri validation with isRunTimeLikeApp: 1 teamID != nil: 0 sourceApp:  redirectURI: 
2026-05-07 13:26:11:718 | E | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Creating Error with description: SouceApplication is invalid
2026-05-07 13:26:11:719 | E | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Failed to handle SSO request, error Error Domain=MSALErrorDomain Code=-42000 "(null)" UserInfo={MSALErrorDescriptionKey=SouceApplication is invalid}
2026-05-07 13:26:11:719 | I | ADB v3.16.5/WPJ v3.14.1 | Finish calling executing SSO extension request. (new handler)
2026-05-07 13:26:11:719 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Finish executing request.
2026-05-07 13:26:11:719 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Finished SSO request.

The MSAL Python version you are using
Paste the output of this

msal==1.36.0 (with broker extra)

Additional context

Reproduces consistently, even after clearing all cached tokens.
The calling application is an unsigned Python process (Python Build Standalone distribution), which may affect broker redirect URI validation or sourceApplication resolution.
The same codebase works correctly on Windows, Linux, and macOS Apple Silicon (M3) - it does appear to be Intel-specific or broker request payload related judging by the empty sourceApp in the broker logs.

Lenguaje dominante: Python
Estrellas: 971
Forks: 223
Merge medio: 13 h 48 min
PR fusionados (30 d): 2

Preparar el entorno

Sin Dockerfile ni archivo de Docker Compose
Sin plantilla de pull request
Leer la guía de contribución

Primeros pasos

Lee el issue completo y luego la guía de contribución del proyecto.
Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
Haz un fork del repositorio y trabaja en una rama.
Abre un pull request que haga referencia al número del issue.

Más de AzureAD/microsoft-authentication-library-for-python

[Bug] Misleading/Incompolete domain Bug
Abierto
- ¿Algo no está bien?
needs attention untriaged

Dificultad 4/5 3-5 días Aptitud para principiantes 48/100

AzureAD/microsoft-authentication-library-for-python#973 · Abierto el 18/10/2026
[Bug] Support library-agnostic HTTP clients for Service Fabric managed identity
Abierto
- ¿Algo no está bien?
AzureSDK bug P1

Dificultad 4/5 3-5 días Aptitud para principiantes 48/100

AzureAD/microsoft-authentication-library-for-python#965 · Abierto el 17/9/2026
http_client docstring does not say that timeout, verify and proxies only configure the default session
Posiblemente ocupada @HardMax71 la tomó hace 38 días. Abierto
- ¿Algo no está bien?
Dificultad 1/5 Menos de una hora Aptitud para principiantes 25/100

AzureAD/microsoft-authentication-library-for-python#960 · Abierto el 10/9/2026
[Bug] The built-in retry never retries the token POST: HTTPAdapter(max_retries=1) keeps urllib3's default allowed_methods
Posiblemente ocupada @HardMax71 la tomó hace 44 días. Abierto
- ¿Algo no está bien?
bug untriaged

Dificultad 2/5 1-3 horas Aptitud para principiantes 35/100

AzureAD/microsoft-authentication-library-for-python#957 · 3 comentarios · Abierto el 4/9/2026
[Bug] macOS broker prompts twice for Keychain access, Always Allow doesn't apply to both
Abierto
- ¿Algo no está bien?
public-client untriaged

Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100

AzureAD/microsoft-authentication-library-for-python#955 · Abierto el 27/8/2026

Todos los issues de AzureAD/microsoft-authentication-library-for-python

Issues similares

docs: correct the GitHub/auth and online-command claims in CONTRIBUTING
Abierto
- ¿Algo no está bien?
documentation good first issue help wanted

Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100

drevendev/HungryCrab#273 · Abierto el 18/10/2026

Los mantenedores suelen responder en 1 día
docs: give PocketDiff's existing visual example a one-page design-intent brief
Abierto
- ¿Algo no está bien?
good first issue help wanted

Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100

drevendev/BeautifulRepo#19 · Abierto el 18/10/2026

Los mantenedores suelen responder en 2 días
Moonshot: Kimi K3 always sends `reasoning_effort="max"`, though the API now accepts `low` and `high`
Abierto
- ¿Algo no está bien?
accepted

Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100

UKGovernmentBEIS/inspect_ai#5939 · Abierto el 18/10/2026

Los mantenedores suelen responder en 1 día
Spell checking logs GtkSpell 'speller != NULL' criticals at every start-up
Abierto
- ¿Algo no está bien?
bug linux

Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100

translate/virtaal#4439 · Abierto el 18/10/2026

Los mantenedores suelen responder en 1 día
Fill paper for Screen2Words
Abierto
- ¿Algo no está bien?
area:data data-quality

Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100

reacher-z/Awesome-CUA#1468 · Abierto el 18/10/2026

Los mantenedores suelen responder en 1 día

Más issues de Python

[Bug] Broker token acquisition fails on macOS (Intel) with error code -42000

¿Algo no está bien?

Evaluación

Línea de trabajo

Descripción

Preparar el entorno

Primeros pasos

Más de AzureAD/microsoft-authentication-library-for-python

¿Algo no está bien?

¿Algo no está bien?

¿Algo no está bien?

¿Algo no está bien?

¿Algo no está bien?

Issues similares

¿Algo no está bien?

¿Algo no está bien?

¿Algo no está bien?

¿Algo no está bien?

¿Algo no está bien?

Recibe los nuevos issues en tu correo