Why is AcquireTokenByIntegratedWindowsAuth not available for python?

[rayluo]

Is there the way to do it?

(Posting this question on behalf of Lev from Intel)

[rayluo]

Most of the time, people who prefer Integrated Windows Auth on Windows are looking for a smooth user experience (ideally without interaction). Nowadays there is a modern way to do that, which is to use Broker that is already available on Windows. You may refer to the docs and sample mentioned in our MSAL Python 1.20's release note.

[zlev-intel]

Hi, connected the owners of the WEB application
They added the redirect URL

My python code still fails;
{'error': 'broker_error', 'error_description': '(pii). Status: Response_Status.Status_IncorrectConfiguration, Error code: 3399614466, Tag: 557973643', 'msal_telemetry': '{"msalruntime_telemetry":{"DATA LIMITED":"Full MSALRuntime telemetry not yet implemented","api_error_context":"Error context redacted, value may be written to log.","api_name":"SignInSilently","api_status_code":"StatusInternal::IncorrectConfiguration","broker_app_used":"true","client_id":"1441a063-45e1-4e47-9479-f2461278c25e","correlation_id":"05009f62-eda5-4ff6-a6ef-b8044a7f6de5","is_successful":"false","msal_version":"1.1.0+local","msalruntime_version":"0.17.1"},"msal_python_telemetry":null}'}

{"msalruntime_telemetry":{"DATA LIMITED":"Full MSALRuntime telemetry not yet implemented","api_error_context":"Error context redacted, value may be written to log.","api_name":"SignInSilently","api_status_code":"StatusInternal::IncorrectConfiguration","broker_app_used":"true","client_id":"1441a063-45e1-4e47-9479-f2461278c25e","correlation_id":"05009f62-eda5-4ff6-a6ef-b8044a7f6de5","is_successful":"false","msal_version":"1.1.0+local","msalruntime_version":"0.17.1"},"msal_python_telemetry":null}

What is also strange: reported version is not the same as installed:
"msal_version":"1.1.0+local"

(data_access) c:\source\tools\unit_data>pip show msal
Name: msal
Version: 1.32.0
Summary: The Microsoft Authentication Library (MSAL) for Python library enables your app to access the Microsoft Cloud by supporting authentication of users with Microsoft Azure Active Directory accounts (AAD) and Microsoft Accounts (MSA) using industry standard OAuth2 and OpenID Connect.
Home-page: https://github.com/AzureAD/microsoft-authentication-library-for-python
Author: Microsoft Corporation
Author-email: [email protected]
License: MIT
Location: c:\venv310\data_access\lib\site-packages
Requires: cryptography, PyJWT, requests
Required-by:

[rayluo]

What is also strange: reported version is not the same as installed:
broker_error ... msalruntime_telemetry ... "msal_version":"1.1.0+local", "msalruntime_version":"0.17.1"

(data_access) c:\source\tools\unit_data>pip show msal
Name: msal
Version: 1.32.0

The presence of those "mismatching" version numbers are unfortunately just a red herring. MSAL has lots of internal components and historically they don't always identify themselves precisely as "msal component X 1.1.0".

... the owners of the WEB application
They added the redirect URL

My python code still fails;
{'error': 'broker_error', 'error_description': '(pii). Status: Response_Status.Status_IncorrectConfiguration, Error code: 3399614466, Tag: 557973643', 'msal_telemetry': '{"msalruntime_telemetry":{"DATA LIMITED":"Full MSALRuntime telemetry not yet implemented","api_error_context":"Error context redacted, value may be written to log.","api_name":"SignInSilently","api_status_code":"StatusInternal::IncorrectConfiguration","broker_app_used":"true","client_id":"1441a063-45e1-4e47-9479-f2461278c25e","correlation_id":"05009f62-eda5-4ff6-a6ef-b8044a7f6de5" ...

The real strange thing is that those "Error code" and "Tag" remain the same as your previous offline error report before your adding redirect_uri.

So, please double check whether those redirect_uri were spelled correctly and added to the right "platform". In your case, you said your app is a web app, so its existing redirect_uri was the Web platform; but your new broker redirect_uri must be added to the "Mobile and desktop applications" platform. Please double check and report back. UPDATE: A screenshot sent from @zlev-intel offline indicated that the ms-appx-web://Microsoft.AAD.BrokerPlugin/1441a063-45e1-4e47-9479-f2461278c25e was registered properly in the "Mobile and desktop application" platform.

At this point, I'll have to transfer this case to my teammates @iulico-1 @ashok672 @fengga to investigate what those Status: Response_Status.Status_IncorrectConfiguration, Error code: 3399614466, Tag: 557973643 actually means.