`az login` fails: OSError: [WinError -2146892987]

Describe the bug

When running Azure CLI on Microsoft.AzureStackHCI/clusters, az login fails:

> az login --use-device-code
az : WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code xxx to authenticate.
    + CategoryInfo          : NotSpecified: (WARNING: To sig...o authenticate.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
ERROR: The command failed with an unexpected error. Here is the traceback:
ERROR: [WinError -2146892987] : ''
Traceback (most recent call last):
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/cli.py', line 231, in invoke
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 658, in execute
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 721, in _run_jobs_serially
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 692, in _run_job
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py', line 328, in __call__
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/command_operation.py', line 121, in handler
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/command_modules/profile/custom.py', line 149, in login
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/_profile.py', line 153, in login
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/auth/identity.py', line 158, in login_with_device_code
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/application.py', line 1608, in acquire_token_by_device_flow
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oauth2.py', line 384, in obtain_token_by_device_flow
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oauth2.py', line 346, in _obtain_token_by_device_flow
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oidc.py', line 115, in _obtain_token
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/oauth2cli/oauth2.py', line 789, in _obtain_token
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/application.py', line 581, in lambda
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/token_cache.py', line 307, in add
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/token_cache.py', line 113, in add
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal/token_cache.py', line 184, in __add
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal_extensions/token_cache.py', line 49, in modify
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal_extensions/persistence.py', line 163, in save
  File 'D:\\a\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\msal_extensions/windows.py', line 82, in protect
OSError: [WinError -2146892987] : ''
To open an issue, please run: 'az feedback'

Email: AKS on HCI | az login failing with unexpected error, probably known issue

[jiasli]

The workaround is to turn off token encryption: https://github.com/Azure/azure-cli/issues/20231#issuecomment-1007176901

[rayluo]

I’m not using an interactive session, it’s all done through ansible playbooks.

@jiasli, those automation environment might not satisfy that implicit requirement. What if we change Azure CLI to automatically set encrypt_token_cache=false (and perhaps even persist it) upon encountering an encryption/decryption failure?