Azure/azure-cli

WAM does not integrate with browser's password manager

elygre opened this issue · 12 comments

elygre commented

az login says that you are preparing to switch to WAM (Web Authentication Manager). The message says "To help us collect feedback on the new login experience, you may opt-in to use WAM by running the following commands", which indicates that you want feedback. At the same time, you don't say where, so I chose this channel.

My feedback: WAM does not seem to integrate with my password manager. This creates a much more annoying workflow: The WAM-window opens, i select the username, I have to switch to a browser, open the password manager, copy the password, return to the WAM-window, paste the password, submit the login, switch to my command line.

The corresponding browser-login is much simpler: The browser opens, I select the username, password is automatically filled, I submit, and switch to the command line.

So, for me, the important command is az config set core.allow_broker=false, which I hope will remain operational.

yonzhan commented

@jiasli for awareness

rayluo commented

WAM does not seem to integrate with my password manager. This creates a much more annoying workflow: The WAM-window opens, i select the username, I have to switch to a browser, open the password manager, copy the password, return to the WAM-window, paste the password, submit the login, switch to my command line.

Hi @elygre , did you need to do that just once, or did you need to do that for every "az login" even for the same account?

elygre commented

So there are two levels of "az login".

  • First, when Azure requires a login, because for example "Your organizational policy requires you to sign in again after a certain time period." In these scenarios I need to enter a password, and the WAM password dialog does not integrate with my password manager -- and probably not with any password manager?
  • Second, if I for example open a new shell and execute a new "az login" before the login expiration, then a new login is not required, and a new password is not required, and therefore the password manager integration is not required.

For my organization, the login lifetime is measured in a few hours, and I need multiple "real" logins during a workday.

  • 👍1
ms6073 commented

Wanted to comment that on my Win 10 laptop, running the suggested commands resulted in my no longer being able to to actually login to the azure client!

az config set core.allow_broker=false
az account clear
az login

After which login attempts returned a variety of errors, the most common that was repeated with each logon attempt was as follows. Fortunately I stumbled across the OP and was able to resolve the issue setting core.allow_broker=true:

Winrt exception was thrown during GetTokenSilently '(pii)'.. Status: Response_Status.Status_Unexpected, Error code: -2147023584, Tag: 590996738
Please explicitly log in with: az login

rayluo commented

Wanted to comment that on my Win 10 laptop, running the suggested commands resulted in my no longer being able to to actually login to the azure client!

az config set core.allow_broker=false az account clear az login

After which login attempts returned a variety of errors, the most common that was repeated with each logon attempt was as follows. Fortunately I stumbled across the OP and was able to resolve the issue setting core.allow_broker=true:

Winrt exception was thrown during GetTokenSilently '(pii)'.. Status: Response_Status.Status_Unexpected, Error code: -2147023584, Tag: 590996738 Please explicitly log in with: az login

Are you sure you did not actually use the "...allow_broker=true" or "...false" in the opposite way? That error message would only show up when broker was in effect.

ms6073 commented

Sorry, may have juxtaposed the cmds. Our organization requires additional authentication in which a web page opens and prompts for the password and then have to complete 2FA using MS Authenticator app, and after the login is approved, the page refreshed with the prompt about WAM and I decided to run the cmds as outlined on that webpage.

  • 👀1
rayluo commented

Winrt exception was thrown during GetTokenSilently '(pii)'.. Status: Response_Status.Status_Unexpected, Error code: -2147023584, Tag: 590996738 Please explicitly log in with: az login

@ms6073, would you mind re-enabling broker by setting "allow_broker=true", and then reproduce the problem while running "az login --debug", and then send the logs to us? You can find our email from our github profile.
CC: @MSamWils, @jiasli .

ms6073 commented
  • 👀1
rayluo commented

Thanks for the logs. We will look into this. 👀

MSamWils commented

Hi @ms6073, may I ask did you "run as a different user" when launching the console for doing the az login?

ms6073 commented

@MSamWils

Yes. I work for a large health care organization and the account I logon with is not a member of the local administrator's group, thus for operations that require administrator rights on the local machine such as installing or updating software, I use another AD account with applicable permissions. There is a 3rd AD account that I must use for administering things in Azure, but for each of these, I am opening/running the CMD window as the applicable AD account requiring me to enter username/password for each instance. Note that the use of multiple accounts is a pretty common occurrence for IT members in health care organizations as well as oil & gas, and more than likely banking/finance.

  • ❤️1
MSamWils commented

Hi @ms6073 , circle back on this topic since we would like to learn about your scenario and may be able to provide alternative solution if applicable. Can you please send me an email at samwils AT microsoft DOT com to discuss more about that? Thanks