Azurestorageexplorer: Sign-In Error on macOS Catalina

[jazaval]

Storage Explorer Version: 10.10.1
Build Number: 20190919.2
Platform/OS: macOS Catalina
Architecture: x64
Regression From: macOS Mojave

Bug Description

Unable to sign in after upgrading to macOS Catalina.

Steps to Reproduce

1. Observed the issue after being asked to re-authenticate several days after updating to macOS Catalina.
2. Able to successfully authenticate on the same build in Windows using the same auth method (username and password with phone authentication)
3. Same issue occurs when using the Device Code Flow

Expected Experience

1. Successful sign-in

Actual Experience

Unable to sign in: AADSTS50097: Device authentication is required.
 Trace ID: a113c9ef-ffd5-4799-a990-01859b870300
 Correlation ID: eaec5988-a649-40c8-898d-42d7b71f4fef
 Timestamp: 2019-10-25 23:09:11Z

[JasonYeMSFT]

Unfortunately we don't have a solution for this problem so far. You can try using other methods to access your resources. If possible, you can also check if there is any new security setting that is blocking our sign in process. Our developers are currently working on a new authentication library which might be able to solve this problem. We will verify it and get back to you when it's done.

[craxal]

@MRayermannMSFT "Device authentication is required." Does this mean he needs MSAL?

[jazaval]

FWIW I'm using the following auth flow:

Corp sign-in prompt (PIN/Smartcard) -> "Sign in with a username and password instead" -> "Sign in with your phone or token device" -> Successful authentication with Authenticator app on iOS -> "Unable to sign in: AADSTS50097: Device authentication is required."

[jazaval]

I also verified that this is now occurring in a macOS Mojave VM I spun up, so this is incorrectly correlated to system upgrades to Catalina. Using the above auth workflow on Windows is still successful.

[jinglouMSFT]

@jazaval can you try to use "Device code flow sign in" to see if you can sign in?

[jazaval]

Fails with the same error - the browser seems to authenticate the code.

Unable to sign in: AADSTS50097: Device authentication is required.
 Trace ID: 86b102b2-9178-4d70-8179-2b08cb790700
 Correlation ID: 7c779d1e-fedc-47f2-9031-9e179215a6b4
 Timestamp: 2019-10-30 21:52:13Z

[jinglouMSFT]

Have you ever been able to sign in on your Mac? This sounds like you need conditional access which we don't have the support at the moment. I assume you sign in using your MS credentials?

[jazaval]

I have been able to in the past - I am using MS creds.

[craxal]

Interesting. I also have a Catalina machine, but I haven't had any sign in issues. Does your machine, corp, or Azure account have any device or other restrictions?

[jazaval]

Closing as this seems to be unrelated to Catalina..

[JasonYeMSFT]

We are going to support this type of authentication by adopting a new authentication library.

[MRayermannMSFT]

Hi there! In an upcoming version of storage explorer, we're going to be offering a setting to try out a new auth library. This library includes support for additional sign in scenarios, and we believe that includes resolving this issue. Before we release that version though, would you be willing to try a private build which includes that setting?

If yes, then you can download the private build here:

• Windows: https://aka.ms/storageexplorer/msal/windows
• Mac: https://aka.ms/storageexplorer/msal/macos
• Linux: https://aka.ms/storageexplorer/msal/linux

To enable the new auth library, go to Settings (gear icon) -> Application -> Sign-in -> Microsoft Authentication Library (Preview), and then click the checkbox and restart.

Since this is a private build, we do not recommend using it long term, or on production data.

Let us know if the build resolves your issue. Thanks!

[jazaval]

It works! I'll continue to dogfood this build and let you know if I find anything.

[MRayermannMSFT]

Cool. I'll leave this open until we ship 1.11.1, and check back every now and then in case you find something. Thank you for dogfooding! :D

[MRayermannMSFT]

We're getting pretty close to shipping. I'm going to go ahead and close this now. Thanks again for trying the build!

[AsgeDarr]

I'm still having the exact same problem on the newer release.
Is this actually fixed or am I doing something wrong?

Version: 1.12.0
AzCopy Version: 10.3.3
Platform: macOS
Architecture: x64
Build Number: 20200116.10
Commit: 0a86d4ecc
Support ID: 63e9bb0c-8b5c-1fd9-3a28-b74dafd4f279

Unable to sign in: AADSTS50097: Device authentication is required.
Trace ID: fee74335-5fac-40ae-af73-43f9d5305b00
Correlation ID: 86e3ac32-e205-4a61-a127-71730853ca57
Timestamp: 2020-04-15 08:05:10Z

[craxal]

@AsgeDarr The current default authorization library we're using does not support device authentication. Have you tried turning on MSAL (Settings > Application > Sign-in > Microsoft Authentication Library)?

[AsgeDarr]

It worked. Thank you very much.