azure-cli: az login --identity fails on an AzureML compute instance: json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Describe the bug

Command Name az login --identity

Errors:

The command failed with an unexpected error. Here is the traceback:
Expecting value: line 1 column 1 (char 0)
Traceback (most recent call last):
  File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 231, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
    raise ex
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
    result = cmd_copy(params)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
    return self.handler(*args, **kwargs)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
    return op(**command_args)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/command_modules/profile/custom.py", line 122, in login
    return profile.login_with_managed_identity(username, allow_no_subscriptions)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/_profile.py", line 234, in login_with_managed_identity
    msi_creds = MSIAuthenticationWrapper(resource=resource)
  File "/opt/az/lib/python3.10/site-packages/msrestazure/azure_active_directory.py", line 592, in __init__
    self.set_token()
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/auth/adal_authentication.py", line 75, in set_token
    super().set_token()
  File "/opt/az/lib/python3.10/site-packages/msrestazure/azure_active_directory.py", line 596, in set_token
    self.scheme, _, self.token = get_msi_token_webapp(self.resource, self.msi_conf)
  File "/opt/az/lib/python3.10/site-packages/msrestazure/azure_active_directory.py", line 548, in get_msi_token_webapp
    token_entry = result.json()
  File "/opt/az/lib/python3.10/site-packages/requests/models.py", line 910, in json
    return complexjson.loads(self.text, **kwargs)
  File "/opt/az/lib/python3.10/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/opt/az/lib/python3.10/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/opt/az/lib/python3.10/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

Create a compute instance in AzureML (mine is STANDARD_DS11_V2)
Start the compute instance and click on the Terminal link to start a session
Run az login --identity as suggested by the welcome message

Expected Behavior

az login --identity should log me in without failures

Environment Summary

Linux-5.15.0-1017-azure-x86_64-with-glibc2.31, Ubuntu 20.04.4 LTS
Python 3.10.5 ("base" conda environment)
Installer: DEB

azure-cli 2.39.0 *

Extensions:
ml 2.11.0

Dependencies:
msal 1.18.0b1
azure-mgmt-resource 21.1.0b1

Additional Context

About this issue

Original URL
State: open
Created 2 years ago
Comments: 18 (3 by maintainers)

Most upvoted comments

We just faced the same issue. It seems that settings for identity-based auth had not been set up correctly, that’s one thing. But also the fact that the compute instance had been created by another user caused problems.

There are two things that it took to resolve:

Copy settings for identity-based auth to environment variables: For that run while read -r line ; do export $line; done < /etc/environment.sso in your shell. This will copy settings for authentication endpoints.
The compute instance in question had been created by someone else for me. In AzureML Studio, go to the compute instance and click on “Jupyter” in the “Applications” column. This will bring up a warning message, asking you to click if you trust this compute instance. Click to confirm that.

Once both those steps had been done, I was able to run az login --identity correctly.

So in way I guess the error message that I received was masking that “do you trust this compute instance” problem.

ant0nsc on Jun 29, 2023