[Bug] Broker on Mac error to authenticate "Source application does not match redirect uri host. Invalid source app."

Đang mở

#803 mở ngày 27/3/2025 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó: 4/5
Thời gian dự kiến: 3-5 ngày
Mức phù hợp với người mới: 30/100

Loại issue: Lỗi
Độ rõ ràng: Khá rõ ràng
Mức độ hoạt động: Đình trệ
Công nghệ: azure, python
Lĩnh vực: authentication, backend

Hướng nghiên cứu

The report provides a Blender plugin reproduction and broker logs, but names no MSAL source file or test. Start by reproducing with the linked plugin and compare its Blender run with the standalone src/login.py run, focusing on the redirect URI error. Done means broker authentication succeeds from within Blender; the issue has had no comment for 301 days, so maintainer guidance may be difficult to get.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

needs attention public-client untriaged

Describe the bug
A clear and concise description of what the bug is.

We are currently using msal[broker] to develop some Blender plugins that integrate with our Azure SSO.

When creating and running app.acquire_token_interactive() standalone, it works completely fine.
However, when running it from within Blender, the broker seems to do some extra verification of the redirectUri and detects some sort of mismatch.

To Reproduce
Steps to reproduce the behavior:

Clone https://github.com/RecuencoJones/blender-msal-plugin

First, we will verify that login works fine standalone

Update .env with corresponding AZURE_AD_TENANT_ID and AZURE_AD_CLIENT_ID, sample values are provided
Run just setup to fetch dependencies
Run uv run src/login.py
Verify success with token output

Now, the same from within Blender plugin

Update src/plugin.py with corresponding AZURE_AD_TENANT_ID and AZURE_AD_CLIENT_ID, sample values are provided or export as env variables for blender to pick them up.
Run just setup to fetch dependencies
Run just install-plugin to build and install the plugin to Blender
Open Blender from terminal (/usr/local/bin/blender or /Applications/Blender.app/Contents/MacOS/Blender)
Open Sidebar (shortcut n)
Open msal panel
Click Login
Verify success with token output in terminal

What you see instead

Sample debug output and error response from app.acquire_token_interactive():

$> /Applications/Blender.app/Contents/MacOS/Blender
DEBUG:urllib3.util.retry:Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
DEBUG:msal.authority:Initializing with Entra authority: https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): login.microsoftonline.com:443
DEBUG:urllib3.connectionpool:https://login.microsoftonline.com:443 "GET /e55df843-27da-4824-bf76-9bbf0a598f59/v2.0/.well-known/openid-configuration HTTP/1.1" 200 1753
DEBUG:msal.authority:openid_config("https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
DEBUG:msal.application:Broker enabled? True
DEBUG:msal.application:Calling broker._signin_silently()
DEBUG:msal.broker:[MSAL:0001]	WARNING	SetAuthorityUri:78	Initializing authority from URI 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59' without authority type, defaulting to MsSts
DEBUG:msal.broker:[MSAL:0001]	ERROR  	ErrorInternalImpl:134	Created an error: 4qj1e, StatusInternal::InteractionRequired, InternalEvent::None, Error Code 0, Context 'Signin silently flows other than ROPC are not supported on macOS.'
DEBUG:msal.application:Falls back to broker._signin_interactively()
DEBUG:msal.broker:[MSAL:0001]	WARNING	SetAuthorityUri:78	Initializing authority from URI 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59' without authority type, defaulting to MsSts
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIBrokerClient isAuthorizationTypeSupported:]:665	Continue without redirectUri validation on unsigned app runtime flow
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIBrokerClient shouldReCheckSsoExtState]:1233	Recheck decision: 0
DEBUG:msal.broker:[MSAL:0001]	INFO   	SetCorrelationId:259	Set correlation ID: 5de759a9-b56a-4abc-a1bc-677a694a7f1d
DEBUG:msal.broker:[MSAL:0001]	INFO   	ExecuteInteractiveRequest:1160	The original authority is 'https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59'
DEBUG:msal.broker:[MSAL:0001]	INFO   	ExecuteInteractiveRequest:1171	The normalized realm is ''
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIBrokerClient isAuthorizationTypeSupported:]:665	Continue without redirectUri validation on unsigned app runtime flow
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIBrokerClient shouldReCheckSsoExtState]:1233	Recheck decision: 0
DEBUG:msal.broker:[MSAL:0001]	INFO   	ModifyAndValidateAuthParameters:216	Additional query parameter added successfully. Key: '(pii)' Value: '(pii)'
DEBUG:msal.broker:[MSAL:0001]	INFO   	ModifyAndValidateAuthParameters:216	Additional query parameter added successfully. Key: '(pii)' Value: '(pii)'
DEBUG:msal.broker:[MSAL:0001]	INFO   	ModifyAndValidateAuthParameters:216	Additional query parameter added successfully. Key: '(pii)' Value: '(pii)'
DEBUG:msal.broker:[MSAL:0001]	INFO   	ModifyAndValidateAuthParameters:240	Authority Realm: e55df843-27da-4824-bf76-9bbf0a598f59
DEBUG:msal.broker:[MSAL:0001]	WARNING	TryEnqueueMsaDeviceCredentialAcquisitionAndContinue:1053	MsaDeviceOperationProvider is not available. Not attempting to register the device.
DEBUG:msal.broker:[MSAL:0002]	WARNING	ReadAccountById:272	Account id is empty - account not found
DEBUG:msal.broker:[MSAL:0002]	INFO   	-[MSAIBrokerClient isAuthorizationTypeSupported:]:665	Continue without redirectUri validation on unsigned app runtime flow
DEBUG:msal.broker:[MSAL:0002]	INFO   	-[MSAIBrokerClient shouldReCheckSsoExtState]:1233	Recheck decision: 0
DEBUG:msal.broker:[MSAL:0002]	INFO   	-[MSAIBrokerClient isAuthorizationTypeSupported:]:665	Continue without redirectUri validation on unsigned app runtime flow
DEBUG:msal.broker:[MSAL:0002]	INFO   	-[MSAIBrokerClient shouldReCheckSsoExtState]:1233	Recheck decision: 0
DEBUG:msal.broker:[MSAL:0002]	INFO   	-[MSAIBrokerClient isAuthorizationTypeSupported:]:665	Continue without redirectUri validation on unsigned app runtime flow
DEBUG:msal.broker:[MSAL:0002]	INFO   	-[MSAIBrokerClient shouldReCheckSsoExtState]:1233	Recheck decision: 0
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDKeychainTokenCache initWithGroup:error:]:169	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:22] Init MSAIMSIDKeychainTokenCache with keychainGroup: Masked(not-null)
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDSSOExtensionInteractiveTokenRequestController acquireToken:]:55	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:22 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Beginning interactive broker extension flow.
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDSSOExtensionInteractiveTokenRequest executeRequestWithCompletion:]:122	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:22 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Beginning interactive broker flow.
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDAuthority resolveAndValidate:userPrincipalName:context:completionBlock:]:109	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:22 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Resolving authority: Masked(not-null), upn: e3b0c442
DEBUG:msal.broker:[MSAL:0003]	WARNING	-[MSAIMSIDAadAuthorityCache networkUrlForAuthority:context:]:247	TID=8747730 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:22 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] No cached preferred_network for authority
DEBUG:msal.broker:[MSAL:0003]	INFO   	-[MSAIMSIDAadAuthorityResolver resolveAuthority:userPrincipalName:validate:context:completionBlock:]_block_invoke:102	TID=8747730 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:22 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Waiting on Authority Validation Queue
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAadAuthorityCache processImpl:authority:openIdConfigEndpoint:context:error:]:123	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Caching AAD Environements
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAadAuthorityCache processImpl:authority:openIdConfigEndpoint:context:error:]:165	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] networkHost: login.microsoftonline.com, cacheHost: login.windows.net, aliases: login.microsoftonline.com, login.windows.net, login.microsoft.com, sts.windows.net
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAadAuthorityCache processImpl:authority:openIdConfigEndpoint:context:error:]:165	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] networkHost: login.partner.microsoftonline.cn, cacheHost: login.partner.microsoftonline.cn, aliases: login.partner.microsoftonline.cn, login.chinacloudapi.cn
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAadAuthorityCache processImpl:authority:openIdConfigEndpoint:context:error:]:165	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] networkHost: login.microsoftonline.de, cacheHost: login.microsoftonline.de, aliases: login.microsoftonline.de
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAadAuthorityCache processImpl:authority:openIdConfigEndpoint:context:error:]:165	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] networkHost: login.microsoftonline.us, cacheHost: login.microsoftonline.us, aliases: login.microsoftonline.us, login.usgovcloudapi.net
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAadAuthorityCache processImpl:authority:openIdConfigEndpoint:context:error:]:165	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] networkHost: login-us.microsoftonline.com, cacheHost: login-us.microsoftonline.com, aliases: login-us.microsoftonline.com
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDAuthority resolveAndValidate:userPrincipalName:context:completionBlock:]_block_invoke:125	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Resolved authority, validated: YES, error: 0
DEBUG:msal.broker:[MSAL:0004]	ERROR  	-[MSAIMSIDBrokerKeyProvider createBrokerKeyWithError:]:229	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23] Could not write broker key -34018
DEBUG:msal.broker:[MSAL:0004]	ERROR  	MSAIMSIDFillAndLogError:239	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23] Encountered error with code -51808, description Masked(not-null)
DEBUG:msal.broker:[MSAL:0004]	ERROR  	-[MSAIMSIDBrokerKeyProvider base64BrokerKeyWithContext:error:]:151	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Failed to retrieve broker key with error MaskedError(MSAIMSIDErrorDomain, -51808)
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[MSAIMSIDBrokerOperationRequest jsonDictionary]:103	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] Broker key is invalid, continue generating broker request for MSAIMSIDBrokerOperationInteractiveTokenRequest class
DEBUG:msal.broker:[MSAL:0004]	INFO   	-[ASAuthorizationController(MSAIMSIDExtensions) msaimsidPerformRequests]:33	TID=8747762 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23] ASAuthorizationController: performRequests with operation(s): login
DEBUG:msal.broker:[MSAL:0003]	INFO   	-[MSAIMSIDAadAuthorityResolver resolveAuthority:userPrincipalName:validate:context:completionBlock:]_block_invoke:104	TID=8747730 MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:23 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Returned from Authority Validation Queue
DEBUG:msal.broker:[MSAL:0001]	ERROR  	-[MSAIMSIDSSOExtensionRequestDelegate authorizationController:didCompleteWithError:]:53	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:27 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Received error from SSO extension: MaskedError(com.apple.AuthenticationServices.AuthorizationError, -6000)
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDSSOExtensionInteractiveTokenRequestController acquireToken:]_block_invoke:61	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:27 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Interactive broker extension flow finished. Result (null), error: -50000 error domain: MSALErrorDomain
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDSSOExtensionInteractiveTokenRequestController shouldFallback:]:94	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:27 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] Looking if we should fallback to fallback controller, error: -50000 error domain: MSALErrorDomain.
DEBUG:msal.broker:[MSAL:0001]	INFO   	-[MSAIMSIDSSOExtensionInteractiveTokenRequestController shouldFallback:]:98	TID=8747704 (main thread) MSAL.xplat.macOS 1.1.0+local Mac 14.7.4 [2025-03-27 10:58:27 - 5DE759A9-B56A-4ABC-A1BC-677A694A7F1D] [MSAL.xplat.macOS] fallback controller is nil, SSO extension controller should fallback: NO
DEBUG:msal.broker:[MSAL:0001]	ERROR  	ErrorInternalImpl:134	Created an error: 4ut1e, StatusInternal::Unexpected, InternalEvent::None, Error Code -42000, Context 'Description: (pii), Domain: MSALErrorDomain.Error was thrown in location: Broker'
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:423	Printing Telemetry for Correlation ID: 5de759a9-b56a-4abc-a1bc-677a694a7f1d
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: authority_type, Value: Unknown
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: stop_time, Value: 2025-03-27T10:58:27.000Z
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: msalruntime_version, Value: 0.17.1
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: all_error_tags, Value: 4ut1e
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: api_status_code, Value: StatusInternal::Unexpected
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: api_error_tag, Value: 4ut1e
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: api_error_code, Value: -42000
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: api_name, Value: SignInInteractively
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: authorization_type, Value: Interactive
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: ui_event_count, Value: 1
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: read_token_last_error, Value: missing required parameter
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: is_successful, Value: false
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: additional_query_parameters_count, Value: 3
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: original_authority, Value: https://login.microsoftonline.com/e55df843-27da-4824-bf76-9bbf0a598f59
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: broker_app_used, Value: true
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: msal_version, Value: 1.1.0+local
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: api_error_context, Value: Description: (pii), Domain: MSALErrorDomain.Error was thrown in location: Broker
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: was_request_throttled, Value: false
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: request_duration, Value: 5109
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: request_eligible_for_broker, Value: true
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: auth_flow, Value: Broker
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: start_time, Value: 2025-03-27T10:58:22.000Z
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: client_id, Value: deb27bec-956b-447e-8084-c37534a345fa
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:431	Key: correlation_id, Value: 5de759a9-b56a-4abc-a1bc-677a694a7f1d
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:436	Printing Execution Flow:
DEBUG:msal.broker:[MSAL:0001]	INFO   	LogTelemetryData:444	{"t":"646u1","tid":1,"ts":0,"l":2},{"t":"4s7ub","tid":1,"ts":1,"l":2},{"t":"4sufd","tid":1,"ts":1,"s":2,"l":2},{"t":"4swgg","tid":1,"ts":1,"s":1,"l":2},{"t":"4swgf","tid":1,"ts":1,"s":1,"l":2},{"t":"4swgi","tid":2,"ts":1,"s":1,"l":2},{"t":"8bkxy","tid":2,"ts":2,"l":2},{"t":"8bkxy","tid":2,"ts":2,"l":2},{"t":"8dqkl","tid":2,"ts":3,"l":2,"a":9,"ie":0},{"t":"481mc","tid":1,"ts":12,"l":2},{"t":"8dqkn","tid":1,"ts":5110,"l":2,"a":5,"ie":1},{"t":"8dqko","tid":1,"ts":5110,"l":2,"a":9,"ie":1},{"t":"646u1","tid":1,"ts":5110,"l":2}

{'error': 'broker_error', 'error_description': 'Description: (pii), Domain: MSALErrorDomain.Error was thrown in location: Broker. Status: Response_Status.Status_Unexpected, Error code: -42000, Tag: 508638916', 'msal_telemetry': '{"msalruntime_telemetry":{"DATA LIMITED":"Full MSALRuntime telemetry not yet implemented","api_error_context":"Error context redacted, value may be written to log.","api_name":"SignInInteractively","api_status_code":"StatusInternal::Unexpected","broker_app_used":"true","client_id":"deb27bec-956b-447e-8084-c37534a345fa","correlation_id":"5de759a9-b56a-4abc-a1bc-677a694a7f1d","is_successful":"false","msal_version":"1.1.0+local","msalruntime_version":"0.17.1"},"msal_python_telemetry":null}'}

Relevant logs from tail -F ~/Library/Containers/com.microsoft.CompanyPortalMac.ssoextension/Data/Library/Caches/Logs/Microsoft/SSOExtension/*:

2025-03-27 12:05:14:077 | I | ADB v3.4.3/WPJ v3.5.35 | TID=8755911 MSAL 1.6.3 Mac 14.7.4 [2025-03-27 11:05:14] Keychain find status: -25300
2025-03-27 12:05:14:077 | E | ADB v3.4.3/WPJ v3.5.35 | TID=8755911 MSAL 1.6.3 Mac 14.7.4 [2025-03-27 11:05:14] Creating Error with description: redirect uri has incorrect scheme - it must be in the form of msauth.<app_bundle_id>://auth
2025-03-27 12:05:14:077 | E | ADB v3.4.3/WPJ v3.5.35 | TID=8755911 MSAL 1.6.3 Mac 14.7.4 [2025-03-27 11:05:14] Creating Error with description: Source application does not match redirect uri host. Invalid source app.
2025-03-27 12:05:14:077 | E | ADB v3.4.3/WPJ v3.5.35 | TID=8755911 MSAL 1.6.3 Mac 14.7.4 [2025-03-27 11:05:14] Creating Error with description: MSAL redirectUri validation error: redirect uri has incorrect scheme - it must be in the form of msauth.<app_bundle_id>://auth
ADAL redirectUri validation error: Source application does not match redirect uri host. Invalid source app.
2025-03-27 12:05:14:077 | I | ADB v3.4.3/WPJ v3.5.35 | Request complete
2025-03-27 12:05:14:077 | E | ADB v3.4.3/WPJ v3.5.35 | TID=8755911 MSAL 1.6.3 Mac 14.7.4 [2025-03-27 11:05:14] Failed to handle SSO request, error Error Domain=MSALErrorDomain Code=-42000 "(null)" UserInfo={MSALErrorDescriptionKey=MSAL redirectUri validation error: redirect uri has incorrect scheme - it must be in the form of msauth.<app_bundle_id>://auth
ADAL redirectUri validation error: Source application does not match redirect uri host. Invalid source app.}

The MSAL Python version you are using

1.32.0

Additional context

Running on MacOS Sonoma 14.7 and Microsoft Intune Company Portal 5.2502.1

The app registration has already Platform iOS / macOS with Bundle ID com.msauth.unsignedapp and redirect URI: msauth.com.msauth.unsignedapp://auth

Ngôn ngữ chính: Python
Star: 971
Fork: 223
Merge trung bình: 13 giờ 48 phút
Pull request đã merge (30 ngày): 2

Chuẩn bị môi trường

Không có Dockerfile hay tệp Docker Compose
Không có mẫu pull request
Đọc hướng dẫn đóng góp

Bắt đầu từ đâu

Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
Fork repository và làm thay đổi trên một nhánh.
Mở pull request có tham chiếu số hiệu của issue.

Issue khác của AzureAD/microsoft-authentication-library-for-python

[Bug] Misleading/Incompolete domain Bug
Đang mở
- Có gì không ổn?
needs attention untriaged

Độ khó 4/5 3-5 ngày Mức phù hợp với người mới 48/100

AzureAD/microsoft-authentication-library-for-python#973 · 1 bình luận · Mở ngày 18/10/2026
[Bug] Support library-agnostic HTTP clients for Service Fabric managed identity
Đang mở
- Có gì không ổn?
AzureSDK bug P1

Độ khó 4/5 3-5 ngày Mức phù hợp với người mới 48/100

AzureAD/microsoft-authentication-library-for-python#965 · Mở ngày 17/9/2026
http_client docstring does not say that timeout, verify and proxies only configure the default session
Có thể đã có người làm @HardMax71 đã nhận 40 ngày trước. Đang mở
- Có gì không ổn?
Độ khó 1/5 Dưới một giờ Mức phù hợp với người mới 25/100

AzureAD/microsoft-authentication-library-for-python#960 · Mở ngày 10/9/2026
[Bug] The built-in retry never retries the token POST: HTTPAdapter(max_retries=1) keeps urllib3's default allowed_methods
Có thể đã có người làm @HardMax71 đã nhận 46 ngày trước. Đang mở
- Có gì không ổn?
bug untriaged

Độ khó 2/5 1-3 giờ Mức phù hợp với người mới 35/100

AzureAD/microsoft-authentication-library-for-python#957 · 3 bình luận · Mở ngày 4/9/2026
[Bug] macOS broker prompts twice for Keychain access, Always Allow doesn't apply to both
Đang mở
- Có gì không ổn?
public-client untriaged

Độ khó 5/5 Hơn một tuần Mức phù hợp với người mới 25/100

AzureAD/microsoft-authentication-library-for-python#955 · Mở ngày 27/8/2026

Tất cả issue của AzureAD/microsoft-authentication-library-for-python

Issue tương tự

[Bug] Unit tests reach real Bedrock call paths without patching the model
Có thể đã có người làm @proton0210 đã nhận hôm nay. Đang mở
- Có gì không ổn?
bug

Độ khó 2/5 1-3 giờ Mức phù hợp với người mới 67/100

aws-samples/sample-aws-genai-db-modernizer#1318 · 1 bình luận · Mở ngày 21/10/2026

Maintainer thường phản hồi trong vòng 1 ngày
pyarrow-25.0.1-cp310-cp310-manylinux_2_28_x86_64.whl: 1 vulnerabilities (highest severity is: 5.3)
Đang mở
- Có gì không ổn?
Mend: dependency security vulnerability

Độ khó 2/5 1-3 giờ Mức phù hợp với người mới 62/100

capitalone/locopy#394 · Mở ngày 21/10/2026
[Bug] Unhandled ValueError terminates watchdog thread when GISRC value contains multiple colons
Đang mở
- Có gì không ổn?
bug

Độ khó 2/5 1-3 giờ Mức phù hợp với người mới 76/100

OSGeo/grass#8096 · Mở ngày 21/10/2026

Maintainer thường phản hồi trong vòng 1 ngày
sdk-typescript: unquoted COPY globs in shell form are silently dropped from the image build context
Đang mở
- Có gì không ổn?
bug javascript

Độ khó 2/5 1-3 giờ Mức phù hợp với người mới 78/100

daytona/clients#391 · Mở ngày 21/10/2026

Maintainer thường phản hồi trong vòng 1 ngày
Charter status should have a link to mailing list discussion
Đang mở
- Có gì không ổn?
enhancement

Độ khó 2/5 1-3 giờ Mức phù hợp với người mới 65/100

ietf-tools/datatracker#11922 · 1 bình luận · Mở ngày 21/10/2026

Maintainer thường phản hồi trong vòng 1 ngày

Thêm issue về Python

[Bug] Broker on Mac error to authenticate "Source application does not match redirect uri host. Invalid source app."

Có gì không ổn?

Đánh giá

Hướng nghiên cứu

Mô tả

Chuẩn bị môi trường

Bắt đầu từ đâu

Issue khác của AzureAD/microsoft-authentication-library-for-python

Có gì không ổn?

Có gì không ổn?

Có gì không ổn?

Có gì không ổn?

Có gì không ổn?

Issue tương tự

Có gì không ổn?

Có gì không ổn?

Có gì không ổn?

Có gì không ổn?

Có gì không ổn?

Nhận issue mới trong hộp thư của bạn