[Bug] Broker token acquisition fails on macOS (Intel) with error code -42000

Aperta

#908 aperta il 7/5/2026 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà: 4/5
Tempo stimato: 3-5 giorni
Idoneità per principianti: 43/100

Tipo di issue: Bug
Chiarezza: Abbastanza chiara
Stato di attività: Tranquilla
Stack tecnologico: macos, python
Ambito: authentication, backend

Direzione di ricerca

Start by tracing how msal[broker] builds the macOS broker request for PublicClientApplication with allow_broker=True, then inspect the broker logs showing empty sourceApp and the SouceApplication is invalid error during redirect URI validation. Compare the request path on Intel macOS with the working Apple Silicon path. Done means silent broker acquisition succeeds or falls back to interactive authentication on the reported Intel setup.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs attention public-client Similar-Issue untriaged

Describe the bug
When using MSAL Python with the broker (msal[broker]) on macOS Tahoe 26.4.1 (Intel), silent token acquisition via the SSO broker consistently fails with error code -42000 and domain MSALErrorDomain. The error is thrown in sourceArea: Broker with Status: Response_Status.Status_Unexpected.

From the Company Portal logs, the broker appears to be reachable (keychain lookups succeed, PSSO/secondary broker is selected), but the silent flow ultimately fails. No fallback to interactive auth occurs.

To Reproduce
Steps to reproduce the behavior:
We are not using an off-the-shelf sample. This is a CLI tool that uses msal[broker] for authentication. The relevant auth flow is:

Create a PublicClientApplication with allow_broker=True on macOS Tahoe 26.4.1 (Intel)
Call acquire_token_interactive() or acquire_token_silent() targeting an A2A scope
MSAL routes the request to the macOS SSO broker
Broker returns error code -42000

We can provide the CLI package privately (via Teams) if needed.

Expected behavior
Broker-based token acquisition should succeed, or MSAL should cleanly fall back to interactive browser-based authentication.

What you see instead
Paste the sample output, or add screenshots to help explain your problem.

Error from MSAL Python:

Failed to acquire token: Description: (pii), Domain: MSALErrorDomain.
Error was thrown in sourceArea: Broker.
Status: Response_Status.Status_Unexpected,
Error code: -42000, Tag: 508638916

Native broker logs (from Company Portal):

2026-05-07 13:26:11:691 | I | ADB v3.16.5/WPJ v3.14.1 | Beginning authorization request
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] New Browser SSO state machine handler will be used
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag enable_js_platform_authentication, value in config 1, value type __NSCFNumber, this feature is disabled by default
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Feature flag enable_js_platform_authentication is enabled
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag browser_sso_interaction_enabled, value in config (null), value type (null), this feature is enabled by default
2026-05-07 13:26:11:692 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag browser_sso_disable_mfa, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_browser_sso_intercept_all, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_inapp_sso_signin, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag allow_account_enumeration_for_any_app, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag allow_account_enumeration_for_managed_apps, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag allow_global_signout_for_managed_apps, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sharedDeviceMode, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag suppress_camera_consent, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sdm_suppress_camera_consent, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature strings get_sso_cookie_allowlist, value in config (null), value type (null), this feature is not set by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature strings get_sso_cookie_blocklist, value in config (null), value type (null), this feature is not set by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag admin_debug_mode_enabled, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_app_prompt, value in config (null), value type (null), this feature is enabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_app_prompt_and_autologin, value in config 1, value type __NSCFNumber, this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Feature flag disable_explicit_app_prompt_and_autologin is enabled
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag remove_sso_rt_header, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_native_app_prompt, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_explicit_native_app_prompt_and_autologin, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sso_extension_exclude_msal_request_enabled, value in config (null), value type (null), this feature is enabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag sso_extension_disable_browser_interrupts, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature flag disable_ecc_prts, value in config (null), value type (null), this feature is disabled by default
2026-05-07 13:26:11:693 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Checking for feature string preferred_auth_config, value in config (null), value type (null), this feature is not set by default
2026-05-07 13:26:11:708 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Pre-processing received json...
2026-05-07 13:26:11:708 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] No broker key in json payload, generate it from source application.
2026-05-07 13:26:11:709 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Return pre-preocess json.
2026-05-07 13:26:11:709 | E | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] token_type key is missing in dictionary.
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] PID analysis - Parent is not launchd: YES, Runtime-like: YES
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] No UI is needed. About to execute without UI.
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Handling SSO request, requested operation: refresh
2026-05-07 13:26:11:710 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11 - 22BFFFB8-02DE-46B6-99E5-150B526FB531] Handling silent SSO request...
2026-05-07 13:26:11:714 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] PSSO status : enabled and registered
2026-05-07 13:26:11:715 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] bundleIdsAllowedInBrowserNativeMessageFlow {(
    "com.microsoft.msedge.adhoc-df",
    "com.microsoft.msedge.debug",
    "com.microsoft.edgemac",
    "com.microsoft.edgemac.Canary",
    "com.microsoft.edgemac.Beta",
    "com.microsoft.msedge",
    "com.microsoft.edgemac.local",
    "com.microsoft.edgemac.Dev",
    "com.microsoft.msedge-df.dev",
    "com.microsoft.msedge-df.canary",
    "microsoft.com.browserMessagingHost",
    "com.microsoft.msedge.dogfood",
    "com.microsoft.msedge-df.beta"
)}
2026-05-07 13:26:11:718 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Keychain find status: -25300
2026-05-07 13:26:11:718 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Start redirect_uri validation with isRunTimeLikeApp: 1 teamID != nil: 0 sourceApp:  redirectURI: 
2026-05-07 13:26:11:718 | E | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Creating Error with description: SouceApplication is invalid
2026-05-07 13:26:11:719 | E | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Failed to handle SSO request, error Error Domain=MSALErrorDomain Code=-42000 "(null)" UserInfo={MSALErrorDescriptionKey=SouceApplication is invalid}
2026-05-07 13:26:11:719 | I | ADB v3.16.5/WPJ v3.14.1 | Finish calling executing SSO extension request. (new handler)
2026-05-07 13:26:11:719 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Finish executing request.
2026-05-07 13:26:11:719 | I | ADB v3.16.5/WPJ v3.14.1 | TID=239902 MSAL 2.9.0 Mac 26.4.1 [2026-05-07 20:26:11] Finished SSO request.

The MSAL Python version you are using
Paste the output of this

msal==1.36.0 (with broker extra)

Additional context

Reproduces consistently, even after clearing all cached tokens.
The calling application is an unsigned Python process (Python Build Standalone distribution), which may affect broker redirect URI validation or sourceApplication resolution.
The same codebase works correctly on Windows, Linux, and macOS Apple Silicon (M3) - it does appear to be Intel-specific or broker request payload related judging by the empty sourceApp in the broker logs.

Lingua principale: Python
Stelle: 971
Fork: 223
Merge medio: 13h 48m
PR unite (30g): 2

Preparare l'ambiente

Nessun Dockerfile né file Docker Compose
Nessun modello di pull request
Leggi la guida per i contributori

Come iniziare

Leggi tutta la issue e poi la guida ai contributi del progetto.
Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
Fai un fork del repository e lavora su un branch.
Apri una pull request che faccia riferimento al numero della issue.

Altre issue di AzureAD/microsoft-authentication-library-for-python

[Bug] Misleading/Incompolete domain Bug
Aperta
- Qualcosa non va?
needs attention untriaged

Difficoltà 4/5 3-5 giorni Idoneità per principianti 48/100

AzureAD/microsoft-authentication-library-for-python#973 · Aperta il 18/10/2026
[Bug] Support library-agnostic HTTP clients for Service Fabric managed identity
Aperta
- Qualcosa non va?
AzureSDK bug P1

Difficoltà 4/5 3-5 giorni Idoneità per principianti 48/100

AzureAD/microsoft-authentication-library-for-python#965 · Aperta il 17/9/2026
http_client docstring does not say that timeout, verify and proxies only configure the default session
Forse già presa @HardMax71 l’ha presa 38 giorni fa. Aperta
- Qualcosa non va?
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 25/100

AzureAD/microsoft-authentication-library-for-python#960 · Aperta il 10/9/2026
[Bug] The built-in retry never retries the token POST: HTTPAdapter(max_retries=1) keeps urllib3's default allowed_methods
Forse già presa @HardMax71 l’ha presa 44 giorni fa. Aperta
- Qualcosa non va?
bug untriaged

Difficoltà 2/5 1-3 ore Idoneità per principianti 35/100

AzureAD/microsoft-authentication-library-for-python#957 · 3 commenti · Aperta il 4/9/2026
[Bug] macOS broker prompts twice for Keychain access, Always Allow doesn't apply to both
Aperta
- Qualcosa non va?
public-client untriaged

Difficoltà 5/5 Più di una settimana Idoneità per principianti 25/100

AzureAD/microsoft-authentication-library-for-python#955 · Aperta il 27/8/2026

Tutte le issue di AzureAD/microsoft-authentication-library-for-python

Issue simili

[Bug] Blog normalization corrupts escaped newlines and fails on its own output
Aperta
- Qualcosa non va?
Difficoltà 2/5 1-3 ore Idoneità per principianti 83/100

bytedance/bolt#1076 · Aperta il 19/10/2026

I maintainer di solito rispondono entro 1 giorno
export_hf: the order of LlmMetadata.stop_tokens depends on PYTHONHASHSEED, so the same export gives different .litertlm bytes
Aperta
- Qualcosa non va?
Difficoltà 2/5 1-3 ore Idoneità per principianti 86/100

google-ai-edge/litert-torch#1346 · Aperta il 19/10/2026

I maintainer di solito rispondono entro 1 giorno
Prefill command placeholders when selecting a custom backend image
Aperta
- Qualcosa non va?
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100

gpustack/gpustack#6501 · Aperta il 19/10/2026

I maintainer di solito rispondono entro 1 giorno
Complex rule still requires removed 'members' slot: GO:0032991 complex enablers with has_part fail LinkML validation
Aperta
- Qualcosa non va?
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100

geneontology/gocam-py#272 · Aperta il 19/10/2026
pushed_authorization_request sends list authorization_details as a Python repr
Forse già presa @RaphaelFakhri l’ha presa oggi. Aperta
- Qualcosa non va?
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100

auth0/auth0-python#903 · Aperta il 19/10/2026

I maintainer di solito rispondono entro 1 giorno

Altre issue su Python

[Bug] Broker token acquisition fails on macOS (Intel) with error code -42000

Qualcosa non va?

Valutazione

Direzione di ricerca

Descrizione

Preparare l'ambiente

Come iniziare

Altre issue di AzureAD/microsoft-authentication-library-for-python

Qualcosa non va?

Qualcosa non va?

Qualcosa non va?

Qualcosa non va?

Qualcosa non va?

Issue simili

Qualcosa non va?

Qualcosa non va?

Qualcosa non va?

Qualcosa non va?

Qualcosa non va?

Ricevi le nuove issue nella tua casella