Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add HTTP responses to authentication exceptions #17442

Merged
merged 6 commits into from
Mar 25, 2021

Conversation

chlowell
Copy link
Member

@chlowell chlowell commented Mar 18, 2021

My goal here is to add Azure AD's response to each exception raised due to an Azure AD authentication error. That's easy where an exception is raised by code that already has the response. Less so for a credential implemented with MSAL, because MSAL returns only the response's deserialized body to the credential. So, this PR has MsalClient hang on to the last auth error response it saw, and adds a method credentials can call to get that response.

This closes #16906 by giving applications all the information AAD provided when authentication failed, for example:

try:
    client.operation()
except AuthenticationRequiredError as ex:
    if ex.response:  # can be None, a response isn't always available
        content = json.loads(ex.response.text())
        ...

This PR removes the redundant AuthenticationRequiredError.error_details, whose value was simply error_details from AAD's response. That value is usually incorporated into an exception's message, and its raw value is available in the response.

@chlowell chlowell added Client This issue points to a problem in the data-plane of the library. Azure.Identity labels Mar 18, 2021
@chlowell chlowell requested review from mccoyp and schaabs as code owners March 18, 2021 23:25
Copy link
Member

@mccoyp mccoyp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an interesting solution to the issue! Do you think it would be worth adding a test that verifies the value of AuthenticationRequiredError.response?

@chlowell
Copy link
Member Author

chlowell commented Mar 19, 2021

I'm uncertain. A mock test of that scenario (specifically, "credential elicits an AAD error by presenting a refresh token") would be complex, fragile, and not representative because MSAL is responsible for all the HTTP requests in the real world. I actually wrote a recorded test for it, using CAE to invalidate a credential's refresh token. Having done that, I'm conflicted about what it means to "verify" the value of the response. It seems insufficient to simply assert that the exception carries a response, or that it carries any error response, but doing more requires having an opinion about the content of a "correct" response, which is really up to Azure AD to decide 😩

Writing that convinced me it's worth adding a recorded test for this, which can simply assert that the exception carries an OAuth 2 error response. I don't want to add it to this PR though, because I expect to make changes to how tests are recorded and this one wouldn't run anyway, lacking CAE support.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Azure.Identity Client This issue points to a problem in the data-plane of the library.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Identity] Azure Identity should expose the original MSAL error
2 participants