pnp/cli-microsoft365

Diagnosing error: ClientAuthError: network_error: Network request failed

Closed this issue · 16 comments

scberr commented

I am trying to use m365 in a corporate environment with a complex pac file for the proxy.

I believe I've set the proxy right, but I may not have.

We are receiving the following error when trying to login and would appreciate any guidance on how to work out the root cause. personal information is redacted, but the username/password is definitely correct:

U:\>m365 login --tenant "MyTenant" --authType password -u "MyUserName" -p "MyPassword" --debug

Executing command login with options {"options":{"tenant":"MyTenant","authType":"password","userName":"MyYserBane","password":"MyPassword","debug":true,"output":"json"}}
Logging out from Microsoft 365...
Signing in to Microsoft 365...
No token found for resource https://graph.microsoft.com.
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Info - getTokenCache called
Retrieving new access token using credentials...
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Info - acquireTokenByUsernamePassword called
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - initializeRequestScopes called
[Tue, 18 Jun 2024 05:46:53 GMT] : [e04c8515-6659-44af-800d-910fc18f18f2] : @azure/msal-node@2.7.0 : Verbose - buildOauthClientConfiguration called
[Tue, 18 Jun 2024 05:46:53 GMT] : [e04c8515-6659-44af-800d-910fc18f18f2] : @azure/msal-node@2.7.0 : Verbose - createAuthority called
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Attempting to get cloud discovery metadata  from authority configuration
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Found cloud discovery metadata from hardcoded values.
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Attempting to get endpoint metadata from authority configuration
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Replacing tenant domain name MYTENANT with id {tenantid}
[Tue, 18 Jun 2024 05:46:53 GMT] : [e04c8515-6659-44af-800d-910fc18f18f2] : @azure/msal-node@2.7.0 : Info - Building oauth client configuration with the following authority: https://login.microsoftonline.com/MYTENANT/oauth2/v2.0/token.
[Tue, 18 Jun 2024 05:46:53 GMT] : [e04c8515-6659-44af-800d-910fc18f18f2] : @azure/msal-node@2.7.0 : Verbose - Username password client created
[Tue, 18 Jun 2024 05:46:53 GMT] : [e04c8515-6659-44af-800d-910fc18f18f2] : @azure/msal-common@14.9.0 : Info - in acquireToken call in username-password client
[Tue, 18 Jun 2024 05:46:53 GMT] : [] : @azure/msal-node@2.7.0 : Verbose - Replacing tenant domain name MYTENANT with id {tenantid}
Error:
ClientAuthError: network_error: Network request failed
    at createClientAuthError (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/node_modules/@azure/msal-node/node_modules/@azure/msal-common/dist/error/ClientAuthError.mjs:255:12)
    at NetworkManager.sendPostRequest (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/node_modules/@azure/msal-node/node_modules/@azure/msal-common/dist/network/NetworkManager.mjs:35:23)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async UsernamePasswordClient.executePostToTokenEndpoint (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/node_modules/@azure/msal-node/node_modules/@azure/msal-common/dist/client/BaseClient.mjs:79:26)
    at async UsernamePasswordClient.acquireToken (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/node_modules/@azure/msal-node/dist/client/UsernamePasswordClient.mjs:25:26)
    at async PublicClientApplication.acquireTokenByUsernamePassword (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/node_modules/@azure/msal-node/dist/client/ClientApplication.mjs:169:20)
    at async Auth.ensureAccessToken (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/dist/Auth.js:193:26)
    at async login (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/dist/m365/commands/login.js:74:17)
    at async LoginCommand.commandAction (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/dist/m365/commands/login.js:92:9)
    at async LoginCommand.action (file:///C:/Users/MyLanId/AppData/Roaming/npm/node_modules/@pnp/cli-microsoft365/dist/m365/commands/login.js:102:9) {
  errorCode: 'network_error',
  errorMessage: 'Network request failed',
  subError: '',
  correlationId: 'e04c8515-6659-44af-800d-910fc18f18f2'
}
milanholemans commented

Hi @scberr
If I read it correctly, you are trying to use CLI behind a corporate proxy? Have you tried following this guide?

scberr commented

Thank you for the response. I've read that documentation but the proxy we have uses a very complex pac file.

It's unclear from the error message if the issue is

A. we've extracted the proxy server incorrectly from the pac file and m365 can't connect to login.microsoftonline.com

Or B. There is a successful connection being made but there is a failure performing the OAuth login process.

Can you tell from the error what is going on?

milanholemans commented

@waldekmastykarz, if I'm not mistaken, you added/reviewed this functionality. Do you have an idea what could be wrong?

waldekmastykarz commented

At the moment, we don't support pac files. We only support specifying the proxy through environment variables, like @milanholemans mentioned. Following the stack trace of the error you shared with us, it seems like MSAL (which CLI uses for authentication) can't connect with Microsoft Entra, which would indicate connectivity rather than auth issues. If you could share with us some more info about what you've done, being mindful of not sharing anything sensitive, then perhaps we could debug the issue together.

  • ❤️1
scberr commented

Thank you for your assistance. We're going to do some more diagnosis and reverse engineering of the pac file to see if we can identify the root cause. From the extra info you provided it's almost certainly a proxy issue. There are over 40 different proxy servers/rules in the pac file though.

I'll update this ticket with the outcome, it will take a bit of time next week.

  • ❤️3
sindhujausbank commented

Hello, I am getting the same error. Please lmk what could be the issue. -

Screenshot 2024-08-07 at 3 50 05 PM

Sendrayan commented

As per Fiddler Log we are getting 502 Error along with below Response.

Response:
HTTP/1.1 502 Fiddler - Connection Failed
Date: Wed, 07 Aug 2024 12:17:51 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Cache-Control: no-cache, must-revalidate
Timestamp: 22:17:51.808

[Fiddler] The connection to 'localhost' failed.
Error: ConnectionRefused (0x274d).
System.Net.Sockets.SocketException No connection could be made because the target machine actively refused it 127.0.0.1:12588

Sendrayan commented

Kindly find the Request Details below:
GET http://localhost:12588/favicon.ico HTTP/1.1
Host: localhost:12588
Connection: keep-alive
sec-ch-ua: "Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: http://localhost:12588/?code=************************************************************************************
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

Sendrayan commented

Getting Failed in

~~Request Details with Proxy {
host: '127.0.0.1',
port: '3128',
method: 'CONNECT',
path: 'login.microsoftonline.com',
headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' }
}

Response Error in MSAL:
Error: Error connecting to proxy. Http status code: 400. Http status message: Bad Request

Also I have Update the Corporate Proxy URL in HTTP_PROXY & HTTPS_PROXY in Environment Variable it retuning the same result.

sindhujausbank commented
milanholemans commented

Are you also using a PAC-file @sindhujausbank?

sindhujausbank commented
waldekmastykarz commented

Hey @sindhujausbank, it seems like you're building a custom app. This issue list focuses on supporting CLI for Microsoft 365. For generic auth questions, please submit your issue to the MSAL repo at https://github.com/AzureAD/microsoft-authentication-library-for-js.

sindhujausbank commented
waldekmastykarz commented

Closing due to lack of further comments from the OP

itpropro commented

We have the same problem with node-msal. A normal client credential request fails with

Handling error AuthenticationRequiredError: network_error: Network request failed

There are no network issues, a manual post with cli/postman has no problems, it's just the msal-node library.

Using Node 20 with pnpm.