[Bug][M] Interactive + System Browser fails if listening to localhost is forbidden - better error required

Which Version of MSAL are you using ? Microsoft.Identity.Client 4.22.0

Platform netcore

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)
• Web App
  • Authorization code
  • OBO
• Daemon App
  • Service to Service calls

Other? - please describe;

Is this a new or existing app? Existing app that works on most machines, but fails on others

Repro No special code to reproduce as this appears to be a Windows configuration issue. When I called AcquireTokenInteractive(), everything worked on my development machine. However, I had an end user that it would not work for. He could authenticate using the software on my machine without issue, so I knew it was specific to his machine. He did have VS 2019 on his machine, so I began debugging and it would throw the exception below when AcquireTokenInteractive() was called.

System.Net.HttpListenerException (1214): The format of the specified network name is invalid.
   at System.Net.HttpListener.AddPrefixCore(String registeredPrefix)
   at System.Net.HttpListener.AddAllPrefixes()
   at System.Net.HttpListener.Start()
   at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.ListenToSingleRequestAndRespondAsync(Int32 port, Func`2 responseProducer, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.InterceptAuthorizationUriAsync(Uri authorizationUri, Uri redirectUri, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.AcquireAuthorizationAsync(Uri authorizationUri, Uri redirectUri, RequestContext requestContext, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceInternalAsync(IWebUI webUi, CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceVerifierAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.GetTokenResponseAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

I ended up bringing in the source code for Microsoft.Identity.Client and discovered that I got the exception on this line “httpListener.Start();” of HttpListenerInterceptor.cs. I examined the url and it was valid at http://localhost:56874. I then came across this article on stackoverflow for that error message with an HttpListener. https://stackoverflow.com/questions/47969786/c-sharp-httplistener-the-format-of-the-specified-network-name-is-not-valid

Sure enough, when I ran “netsh http show iplisten”, 127.0.0.1 was not in the list. I then ran “netsh http add iplisten 127.0.0.1” and authentication immediately began working on this machine.

Expected behavior Authentication via AcquireTokenInteractive() should work on all machines or give a better error messages.

Actual behavior if netsh iplisten is not properly set up to listen on 127.0.0.1, the call to AcquireTokenInteractive() throws an HttpListenerException().

Possible Solution At the very least, please provide a better error message as this took me hours to figure out. I am not sure why some machines have this netsh enabled and others don’t. It might be helpful to have a method that checks if this is properly configured since AcquireTokenInteractive() depends on it.

Additional context/ Logs / Screenshots 11:13:19.755 MSAL_LOGGING Error True (True) MSAL 4.22.0.0 MSAL.NetCore Microsoft Windows 10.0.19042 [11/19/2020 16:13:19 - 847293f7-d6b6-434e-8830-fb5c67e105ad] System.Net.HttpListenerException (1214): The format of the specified network name is invalid. at System.Net.HttpListener.AddPrefixCore(String registeredPrefix) at System.Net.HttpListener.AddAllPrefixes() at System.Net.HttpListener.Start() at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.ListenToSingleRequestAndRespondAsync(Int32 port, Func`2 responseProducer, CancellationToken cancellationToken) at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.InterceptAuthorizationUriAsync(Uri authorizationUri, Uri redirectUri, CancellationToken cancellationToken) at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.AcquireAuthorizationAsync(Uri authorizationUri, Uri redirectUri, RequestContext requestContext, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceInternalAsync(IWebUI webUi, CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceVerifierAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.GetTokenResponseAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.ExecuteAsync(CancellationToken cancellationToken) at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

[Steve0212a]

I think the error message approach is good - and also perhaps add a way to override the default value of localhost on the line below. That would give end users the ability to change it to 127.0.0.1 if needed…

string urlToListenTo = "http://localhost:" + port + "/";

[pmaytak]

This is included in MSAL 4.30.0 release.