microsoft-authentication-library-for-js: AAD errors are masked by misleading "network_error" from MSAL node

Core Library

MSAL Node (@azure/msal-node)

Core Library Version

Version 1.9.1

Wrapper Library

Not Applicable

Wrapper Library Version

none

Description

This issue is related to MSAL node and can be reproduced with any MSAL node sample. I have not tried other MSAL js flavours.

Use for example the Username-Password node sample. Configure everything but set a bad password.

Actual error:

{“errorCode”:“network_error”, “errorMessage”:“Network request failed. Please check network trace to determine root cause. | Fetch client threw: Error: HTTP status code 400 | Attempted to reach: https://login.microsoftonline.com/common/oauth2/v2.0/token”, “subError”:“”, “name”:“ClientAuthError”}

Expected error:

Error_code is invalid_grant Error_description is AADSTS50055: The password is expired

"{"error":"invalid_grant","error_description":"AADSTS50055: The password is expired.\r\nTrace ID: e59410c3-5316-43f7-84b9-28e298215600\r\nCorrelation ID: f8504f1a-8c13-4894-9af4-b4696246ad92\r\nTimestamp: 2022-06-08 13:50:55Z","error_codes":[50055],"timestamp":"2022-06-08 13:50:55Z","trace_id":"e59410c3-5316-43f7-84b9-28e298215600","correlation_id":"f8504f1a-8c13-4894-9af4-b4696246ad92","error_uri":"https://login.microsoftonline.com/error?code=50055\“,\“suberror\”:\“user_password_expired\”}”

Note: this message is available in the HttpClient class, but it is wiped out later.

Error Message

The network error message is very misleading. It is normal for AAD to reply with 400 Bad Request, but it doesn’t indicate a network error. Network errors fall in the 5xx category (and maybe the special 429 Too Many Requests).

Msal Logs

No response

MSAL Configuration

just use Username-Password sample with any client_id / tenant_id and set a bad password. Or use the client_credentials sample with a bad scope or a bad secret.

Relevant Code Snippets

Username-Password sample
Client_Credentials sample.

Reproduction Steps

See description

Expected Behavior

1. Error code should be copied from the error from AAD
2. Error message should also be copied from the error from AAD
3. Error type should indicate that this is a service error. For error types like “invalid_grant”, the error type should indicate that “Interaction is required”

Identity Provider

Azure AD / MSA

Browsers Affected (Select all that apply)

None (Server)

Regression

No response

Source

Internal (Microsoft)