microsoft-authentication-library-for-dotnet: UWP authentication sometimes crashes

Which Version of MSAL are you using ? MSAL 3.0.5-preview

Platform UWP

In my UWP app, I only had internetClient capability enabled and it works ok for most users. However, some of my users get an error like

{Microsoft.Identity.Client.MsalException: WAB authentication failed ---> System.IO.FileNotFoundException: The specified protocol is unknown. (Exception from HRESULT: 0x800C000D) at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) ...(TRUNCATION)... --- End of stack trace from previous location where exception was thrown --- at UserDetailsClient.MainPage.d__2.MoveNext() ErrorCode: authentication_ui_failed}

Therefore I investigated about what could be the problem and found out it could be related to the app capabilites. Could you please clarify regarding the capabilites needed for UWP.

Here, @jennyf19 states these 4 capabilities are needed:

  <Capabilities>
    <Capability Name="internetClient" />
    <Capability Name="privateNetworkClientServer" />
    <uap:Capability Name="enterpriseAuthentication" />
    <uap:Capability Name="userAccountInformation" />
  </Capabilities>

However, in this example, these 4 capabilities are listed (sharedUserCertificates instead of userAccountInformation):

  <Capabilities>
    <Capability Name="internetClient" />
    <Capability Name="privateNetworkClientServer" />
    <uap:Capability Name="enterpriseAuthentication" />
    <uap:Capability Name="sharedUserCertificates" />
  </Capabilities>

Then again, in this example, only this capability is listed:

  <Capabilities>
    <Capability Name="internetClient" />
  </Capabilities>

Two of the above capabilites, sharedUserCertificates & enterpriseAuthentication, are restricted capabilites and I would only want to include them if they are indeed needed.

All very confusing. Could you maybe clarify here and in the docs?

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 2
Comments: 25 (13 by maintainers)

Commits related to this issue

Retry calls to WAB and better error message - #1098 — committed to AzureAD/microsoft-authentication-library-for-dotnet by bgavrilMS 5 years ago
Retry calls to WAB and better error message - #1098 (#1415) — committed to AzureAD/microsoft-authentication-library-for-dotnet by bgavrilMS 5 years ago

Most upvoted comments

Sure, I’ve just sent them

tipa on Nov 21, 2019

I added a retry when calling WAB and some information on how to collect logs if this occurs again. It’s not a fix per se, but hopefully it will bring us closer to a solution.

bgavrilMS on Oct 4, 2019

No, this is not the same root cause. There are 2 root causes identified by @tipa :

Reading the token cache from a DPAPI protected file which sometimes gets corrupted (issue #1064).
Calling WAB to perform the interactive flow (issue #1098 - this one)

I plan to tackle the first one by automatically deleting the token cache file, which will result in the user having to re-authenticate (better than uninstalling the app). For the second issue, I am following up with the WAB team to see if a retry mechanism would help.

bgavrilMS on Sep 30, 2019