Powershell: macOS can't use New-PSSession to Connect to O365 from PowerShell Host - WSMAN client library not found

[jnevins-gcm]

Steps to reproduce

Same issue as described here:
https://github.com/PowerShell/PowerShell/issues/5561

except when using Microsoft.PowerShell.SDK (6.2.3) instead of PowerShell CLI

• Create a netcoreapp2.2 console application on Mac OS Mojave
• Add PackageReference to Microsoft.PowerShell.SDK (6.2.3)
• Add code to connect to O365:

            var rs = RunspaceFactory.CreateRunspace();
            rs.Open();
            using (var ps = System.Management.Automation.PowerShell.Create())
            {
                ps.Runspace = rs;
                var initializationScript = $@"
$ErrorActionPreference = 'Stop'
try {{ Set-ExecutionPolicy Unrestricted }} catch {{}} # not supported on non-Windows platforms
$UserCredential = New-Object System.Management.Automation.PSCredential('******', (ConvertTo-SecureString '******' -AsPlainText -Force))
$Option = New-PSSessionOption
$Option.IdleTimeout = [TimeSpan]::FromSeconds(60) # inline setting of this property via New-PSSessionOption is not supported on non-Windows platforms
$Session = New-PSSession -SessionOption $Option -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://outlook.office365.com/powershell-liveid/' -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-Module (Import-PSSession $Session -DisableNameChecking) -Global
";
                await ps.AddScript(initializationScript).InvokeAsync();
            }

Error:

Unhandled Exception: System.AggregateException: One or more errors occurred.
(This parameter set requires WSMan, and no supported WSMan client library was found. WSMan is either not installed or unavailable for this system.) ---> System.Management.Automation.CmdletInvocationException: This parameter set requires WSMan, and no supported WSMan client library was found. WSMan is either not installed or unavailable for this system. ---> 
System.Management.Automation.Remoting.PSRemotingTransportException: This parameter set requires WSMan, and no supported WSMan client library was found. WSMan is either not installed or unavailable for this system. ---> System.DllNotFoundException: Unable to load shared library 'libpsrpclient' or one of its dependencies. In order to help diagnose loading problems, consider setting the DYLD_PRINT_LIBRARIES environment variable: dlopen(liblibpsrpclient, 1): image not found
   at System.Management.Automation.Remoting.Client.WSManNativeApi.WSManInitialize(Int32 flags, IntPtr& wsManAPIHandle)
   at System.Management.Automation.Remoting.Client.WSManClientSessionTransportManager.WSManAPIDataCommon..ctor()

If I set DYLD_PRINT_LIBRARIES to 1, I see the following when running from C# right before the error:

dyld: loaded: /Users/jeff/.nuget/packages/microsoft.powershell.native/6.2.0/runtimes/osx/native/libpsrpclient.dylib
dyld: unloaded: /Users/jeff/.nuget/packages/microsoft.powershell.native/6.2.0/runtimes/osx/native/libpsrpclient.dylib

Works:

• Install PowerShell CLI (6.4.0) (on the exact same machine)
• Run sudo ln -s /opt/local/lib /usr/local/opt/openssl/lib (this doesn't seem to help the C# code any)
• Run the exact same script

If I set DYLD_PRINT_LIBARIES to 1 for the CLI, I see the following right before the connection succeeds:

dyld: loaded: /usr/local/microsoft/powershell/6/libpsrpclient.dylib                                                                                                                                                                                                      dyld: loaded: /usr/local/microsoft/powershell/6/libmi.dylib                                                                                                                                                                                                              dyld: loaded: /usr/local/opt/openssl/lib/libssl.1.0.0.dylib                                                                                                                                                                                                              dyld: loaded: /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib                                                                                                                                                                                                           

so the problem is specific to the SDK...and the ln command fix doesn't seem to work for the SDK.

Expected behavior

Doesn't throw error

Actual behavior

Throws error

Environment data

Mac OS Mojave

[iSazonov]

@adityapatwardhan Could you please comment the SDK issue?

[jnevins-gcm]

Anyone?

[iSazonov]

@jnevins-gcm MSFT team is busy in the days so waiting...

[jnevins-gcm]

It's been 15 days... @iSazonov @adityapatwardhan

[iSazonov]

@jnevins-gcm From previous discussions I can only say please check that libpsrpclient is installed and loaded. The same for OpenSSL.

/cc @SteveL-MSFT

[jnevins-gcm]

@isazonov - that isn’t a meaningful reply. It doesn’t seem like you’ve even read the issue

[iSazonov]

@jnevins-gcm Sorry for short answer.

and the ln command fix doesn't seem to work for the SDK.

libpsrpclient does not have a help logging so it would be great if you used diagnostic tools to identify broken dependencies (to ssl I guess).
And do you want to get a workaround or fix?

[jnevins-gcm]

I’d be totally happy with a workaround.

I’m not super familiar with dependency analysis tools on OS X but I’m happy to try to gather some information if you could provide some guidance on what tools to use.

Thanks!

[jnevins-gcm]

any update...? been about a month

[SteveL-MSFT]

I believe you need to include https://www.nuget.org/packages/Microsoft.PowerShell.Native

Microsoft.PowerShell.Native 6.2.0

Native binaries for PowerShell Core

[jnevins-gcm]

@SteveL-MSFT already tried this

....did you try it?

[SteveL-MSFT]

@jnevins-gcm sorry, didn't see all the details of your report. I did try this and noticed that dotnet run fails, but if I explicitly run the built exe it works (in the sense it tired to connect)

Unhandled exception. System.Management.Automation.ActionPreferenceStopException: The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: [outlook.office365.com] Connecting to remote server outlook.office365.com failed with the following error message : Client did not get proper response from server. For more information, see the about_Remote_Troubleshooting Help topic.
   at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
   at System.Management.Automation.Runspaces.Pipeline.Invoke()
   at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
   at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
   at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.CoreInvoke[TOutput](IEnumerable input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.Invoke()
   at wsman.Program.Main(String[] args) in /Users/steve/test/wsman/Program.cs:line 25

[jnevins-gcm]

thanks @SteveL-MSFT - what is the difference? how can I make a debugging experience function?

[SteveL-MSFT]

I don't know why dotnet run fails. You may have to bring that up in the dotnet CLI repo. Based on the traces it loads the necessary library, but unloads it for some reason. Running the exe directly doesn't unload that library.

[jnevins-gcm]

Got to trying this. Same error when calling "dotnet mydll"

You sure you actually got this to work via the command line?

[jnevins-gcm]

@SteveL-MSFT any updates? seems like a bug in PowerShell Core....

[jnevins-gcm]

@SteveL-MSFT @iSazonov

looking to get some/any support here please. PowerShell is supposedly actively supported by Microsoft and this is clearly a bug.

[iSazonov]

@jnevins-gcm Sorry, I haven't Mac to investigate.
If you shared your project or sample project it would help MSFT experts.

[jnevins-gcm]

The sample code I posted, exactly as is, in an out of box csproj console app will reproduce the problem.

[iSazonov]

Having GitHub ready-to-run project would save reviewer's time.

[jnevins-gcm]

@iSazonov @SteveL-MSFT

ok....

https://github.com/JeffN825/PowerShellWSManBug

It's a simple csproj and Program.cs copied straight from my original post.

dotnet build
cd bin/Debug/netcoreapp2.2/
dotnet PowerShellWSManBug.dll 

would be great to get a resolution

GitHub

JeffN825/PowerShellWSManBug

Contribute to JeffN825/PowerShellWSManBug development by creating an account on GitHub.

[iSazonov]

netcoreapp2.2

We never targeted 2.2. Can you try 2.1?

[jnevins-gcm]

doesn't work

[jnevins-gcm]

@iSazonov @SteveL-MSFT

bump...any fix for this bug? I spent the time putting together that sample...would be great if you could reciprocate.

[iSazonov]

@jnevins-gcm I haven't MacOs to investigate the issue, sorry. Since you are using SDK I guess you can use debugger and I suggest to use a native dll handler (see #11032) and catch a path to openssl.dylib. This can help to get understanding where is a problem or even to fix it in OS or in your code.

[jnevins-gcm]

Very frustrating that there is one single person who supports/replies to bugs in PowerShell and they have no access to platforms that PowerShell claims to support.

@iSazonov how do I leverage what’s in the PR you linked to? Some basic direction would be helpful.

[vexx32]

@jnevins-gcm keep in mind this is Thanksgiving weekend in the US, where the entire PS team is based. I'm sure they're all spending time with their families. :slightly_smiling_face:

[jnevins-gcm]

@vexx32 I'll be happily surprised if I get a helpful reply next week.

I opened this issue on September 23, more than 2 months ago and the team has been mostly unresponsive and I have not received any reply that has been useful.

[iSazonov]

Very frustrating that there is one single person ...

I am a community member like you and have limited resources and time. :-(

how do I leverage what’s in the PR you linked to?

I suggest to add the native dll handler in your project and set breakpoint. I guest you get more info that assembly is trying to load and that is path to native dll is. After that we could get understanding how fix this or make a workaround.

I opened this issue on September 23

We have some issues like this and I already pinged MSFT team. I hope they will look in depth because WSMan is sensitive.
/cc @SteveL-MSFT

[jnevins-gcm]

@iSazonov - sorry, I didn't realize you were not with MS. I appreciate your time on this.

Knowing that makes Microsoft's lake of support even more frustrating.

[davesil2]

do you see the openssl dependencies when you use otool?

ie:
otool -L /usr/local/microsoft/powershell/6/libmi.dylib
/usr/local/microsoft/powershell/6/libmi.dylib:
@rpath/libmi.dylib (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.60.2)
/usr/lib/libpam.2.dylib (compatibility version 3.0.0, current version 3.0.0)
/usr/local/opt/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)

did you install powershell with brew or downloaded through the packages on GitHub?

did you install openssl from brew, macports, other?

does the file dependency for libssl.1.0.0.dylib and libcrypto.1.0.0.dylib exist?

[jnevins-gcm]

@davesil2

 otool -L /usr/local/microsoft/powershell/6/libmi.dylib
/usr/local/microsoft/powershell/6/libmi.dylib:
    @rpath/libmi.dylib (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.60.2)
    /usr/lib/libpam.2.dylib (compatibility version 3.0.0, current version 3.0.0)
    /usr/local/opt/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)

for PowerShell 6 CLI (which works).

and for PowerShell.SDK

otool -L /Users/jeff/dev/PowerShellWSManBug/bin/Debug/netcoreapp2.2/publish/runtimes/osx/native/libmi.dylib 
/Users/jeff/dev/PowerShellWSManBug/bin/Debug/netcoreapp2.2/publish/runtimes/osx/native/libmi.dylib:
        @rpath/libmi.dylib (compatibility version 0.0.0, current version 0.0.0)
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.60.2)
        /usr/lib/libpam.2.dylib (compatibility version 3.0.0, current version 3.0.0)
        /usr/local/opt/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.8)

which doesn't work

I installed PowerShell.SDK through a regular PackageReference.

The command line PowerShell (which works), I installed via brew.

does the file dependency for libssl.1.0.0.dylib and libcrypto.1.0.0.dylib exist?

how do I check this?

[davesil2]

otool shows the dependency:

/usr/local/opt/openssl/lib/libssl.1.0.0.dylib
/usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib

Do those files exists?

ls -la /usr/local/opt/openssl/lib/

I've also had issues with the file not existing in the standard library directory myself:

ls -la /usr/local/lib/libssl.1.0.0.dylib
ls -la /usr/local/lib/libcrypto.1.0.0.dylib

you didn't mention what version of openssl you are running or how you installed it?

[jnevins-gcm]

I'm not really sure what to make of the latter missing libraries @davesil2

Jeffs-MacBook-Pro:~ jeff$ ls -la /usr/local/opt/openssl/lib/
total 11664
drwxr-xr-x  11 jeff  staff      352 Oct 20 19:19 .
drwxr-xr-x  13 jeff  staff      416 Oct 20 19:19 ..
drwxr-xr-x  14 jeff  staff      448 May 28  2019 engines
lrwxr-xr-x   1 root        staff       14 Sep 22 19:33 lib -> /opt/local/lib
-rw-r--r--   1 jeff  staff  1864096 Jun 24 17:11 libcrypto.1.0.0.dylib
-r--r--r--   1 jeff  staff  3208352 May 28  2019 libcrypto.a
lrwxr-xr-x   1 jeff  staff       21 May 28  2019 libcrypto.dylib -> libcrypto.1.0.0.dylib
-r--r--r--   1 jeff  staff   371128 Jun 24 17:11 libssl.1.0.0.dylib
-r--r--r--   1 jeff  staff   517904 May 28  2019 libssl.a
lrwxr-xr-x   1 jeff  staff       18 May 28  2019 libssl.dylib -> libssl.1.0.0.dylib
drwxr-xr-x   5 jeff  staff      160 Jun 24 17:11 pkgconfig

Jeffs-MacBook-Pro:~ jeff$ ls -la /usr/local/lib/libssl.1.0.0.dylib
ls: /usr/local/lib/libssl.1.0.0.dylib: No such file or directory

Jeffs-MacBook-Pro:~ jeff$ ls -la /usr/local/lib/libcrypto.1.0.0.dylib
ls: /usr/local/lib/libcrypto.1.0.0.dylib: No such file or directory

I have tried installing openssl both via MacPorts and Homebrew (both with negative results). Currently I'm running a copy installed via MacPorts (1.1.1d)

[davesil2]

So for me, what i've had to do was to create the symlink for libssl.1.0.0.dylib and lib crypto.1.0.0.dylib.

ln -s /usr/local/opt/openssl/lib/libssl.1.0.0.dylib /usr/local/lib/
ln -s /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib /usr/local/lib/

This should create a symlink in /usr/local/lib/ for that file. This has provided me success in using psremoting as it appears there may be some reference to that library (for me I can't get it to work on Catalina though it works find on Mojave).

One thing that doesn't make sense to me is that you have 1.1.1d from macports installed but you have the 1.0.0 library? did you install both 1.1.1d and 1.0 ?

The other option would be to reset your openssl installs. I've had the best results with brew (for the most part).

you'd need to remove the macports install:

ports uninstall installed

**Note: removes all macports installed, you can also just do openssl and openssl10

brew install openssl
ln -s /usr/local/opt/openssl/lib/libcrypto.1.1.dylib /usr/local/lib/libcrypto.1.0.0.dylib
ln -s /usr/local/opt/openssl/lib/libssl.1.1.dylib /usr/local/lib/libssl.1.0.0.dylib

As long as it's in Mojave, i've had pretty solid success, the symlinks being the key. Hoping @Microsoft can help with the Catalina side

[jnevins-gcm]

@davesil2
Tried:

ports uninstall installed
brew install openssl
brew install openssl
ln -s /usr/local/opt/openssl/lib/libcrypto.1.1.dylib /usr/local/lib/libcrypto.1.0.0.dylib
ln -s /usr/local/opt/openssl/lib/libssl.1.1.dylib /usr/local/lib/libssl.1.0.0.dylib

and didn't work (but I recently updated to Catalina so that is probably why)

[jnevins-gcm]

@davesil2 I’be given up hope that @microsoft cares (or is capable of) supporting this platform

[daviscyd]

@davesil2 & @jnevins-gcm

Here's the error I'm seeing after running the link commands mentioned and connecting to Exchange Online using New-PSSession:
Symlink commands:

ln -s /usr/local/opt/openssl/lib/libcrypto.1.1.dylib /usr/local/lib/libcrypto.1.0.0.dylib
ln -s /usr/local/opt/openssl/lib/libssl.1.1.dylib /usr/local/lib/libssl.1.0.0.dylib

Error:

dyld: lazy symbol binding failed: Symbol not found: _SSL_library_init
  Referenced from: /usr/local/microsoft/powershell/6/libmi.dylib
  Expected in: /usr/local/lib/libssl.1.0.0.dylib

dyld: Symbol not found: _SSL_library_init
  Referenced from: /usr/local/microsoft/powershell/6/libmi.dylib
  Expected in: /usr/local/lib/libssl.1.0.0.dylib

[russburden]

I see the exact same error on my Catalina 15.1 Mac as well. I have spent many hours going through all of the iterations of this issue with no positive results. I'm basically backing down to using a Windows VM again just to accomplish 365 related tasks since PSSessions don't seem to work within PSCore and the newer libssl and libcrypto.

[JeffN825]

@tthoma24 can you provide the exact command you used? and were you using powershell CLI or SDK (this post is about the SDK...I've had success using the CLI)

[tthoma24]

Ah, never mind. My issue is with the CLI. Sorry for the confusion.

[daviscyd]

@JeffN825 Could you provide a link or info as to how you were able to get the CLI to work with o365?

[jnevins-gcm]

@daviscyd i just did the sudo ln commands mentioned in https://github.com/PowerShell/PowerShell/issues/5561

[Glennzo]

I had the same issue, managed to solve it by linking an older openssl version from brew with brew switch openssl 1.0.2s

[jnevins-gcm]

@Glennzo were you using the PowerShell CLI or the SDK nuget package. This issue is about the SDK nuget package.

[daviscyd]

@daviscyd i just did the sudo ln commands mentioned in #5561

@jnevins-gcm Are they the same as those mentioned in this thread here? Because if they are, I've already tried this and it doesn't work for me.

What OS are you running?

[davesil2]

@Glennzo How did you install 1.0.2s? When running that, brew tells me there is no package for that version.

[pyrohaz4good]

I had the same issue, managed to solve it by linking an older openssl version from brew with brew switch openssl 1.0.2s

This is the solution. If you have brew, type
brew switch openssl 1.0.2s

This only works if you had previously downloaded openssl because it's no longer available in the tap. If you can't get that to work, you probably need to manually find the files from 1.0.2s and symlink them in.

[jnevins-gcm]

@pyrohaz4good SDK or CLI?

[pyrohaz4good]

Name Value
---- -----
PSVersion 6.2.0
PSEdition Core
GitCommitId 6.2.0
OS Darwin 18.5.0 Darwin Kernel Version 18.5.0: Mon…
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

[jnevins-gcm]

From c# or command line? @pyrohaz4good

[pyrohaz4good]

CLI (specifically, Visual Studio Code)

[jnevins-gcm]

@pyrohaz4good this issue is regarding the SDK. Even when it works with the CLI, It doesn’t work with the SDK

[jshum]

I had the same issue, managed to solve it by linking an older openssl version from brew with brew switch openssl 1.0.2s

For me 1.0.2r worked as well. I had the openssl 1.1 installed through brew but they did not work

[jnevins-gcm]

@jshum CLI or SDK? This issue relates to the SDK

[jshum]

Right, my comment was for CLI, but I'm guessing it may be the same underlying problem relating to the SSL library being found in the environment/path on OS X

[TravisEz13]

I suspect macports would still work. The instructions are here:
https://github.com/PowerShell/PowerShell/issues/5634#issuecomment-445051982

[JeffN825]

@TravisEz13 You could just try it or read the entirety of the question and you'd know it doesn't work... truly unbelievable

[JeffN825]

@TravisEz13 - it doesn’t work

[SteveL-MSFT]

I understand that some folks are frustrated here, but please keep in mind we are not a huge team and we have to prioritize issues we believe have the most impact. In this specific case, we've been having discussions with EXO team to move off WSMan based remoting. The library that we were using for WSMan remoting on non-Windows has been deprecated and no longer supported by a team. New EXO cmdlets are coming with expectation that they are cross platform compatible. Sorry no timeline to announce as it's not my project.

[luckman212]

Good luck on this! Hope the new cmdlets support MFA login on macOS, similar to Connect-AzAccount from the new Az module... 🚀

[TravisEz13]

Updated docs for getting libmi to work using MacPorts https://github.com/MicrosoftDocs/PowerShell-Docs/pull/5726

Please note that this is a temporary solution as @SteveL-MSFT said:

we've been having discussions with EXO team to move off WSMan based remoting. The library that we were using for WSMan remoting on non-Windows has been deprecated and no longer supported by a team. New EXO cmdlets are coming with expectation that they are cross platform compatible. Sorry no timeline to announce as it's not my project.

CC @mgreenegit

[luckman212]

For now, this hack works...

brew install https://github.com/luckman212/openssl10/releases/download/1.0.2u/[email protected]
rm /usr/local/opt/openssl
ln -s /usr/local/Cellar/[email protected]/1.0.2u /usr/local/opt/openssl

[JeffN825]

Does it work for the sdk or just the cli?

[luckman212]

@JeffN825 I can't say for sure, but this symlinks into the global /usr/local/opt dir so I would expect it to work for both. Please try if you can & report back.

[jnevins-gcm]

Nope

Jeffrey Nevins
Executive Director, IT Architecture & Engineering
GCM Grosvenor
900 North Michigan Avenue, Suite 1100
Chicago, IL 60611
T [phone]
M [phone]
[email protected]

[iSazonov]

For reference https://github.com/PowerShell/PowerShell/issues/11216#issuecomment-608221120

[TravisEz13]

@iSazonov I hid your topic as this has NOTHING to do with the CLR. This is libmi which is hardcoded to load from this path and is deprecated.

[msftbot[bot]]

This issue has been marked as external and has not had any activity for 1 day. It has been be closed for housekeeping purposes.

[jnevins-gcm]

Why the &$@! Would you close this issue??

[iSazonov]

@jnevins-gcm There is a long path to deprecated dependencies. It is so over last 2 years. Recommendation for remoting on MacOs is to use SSH. For O365 services, Azure modules we can only wait when they are updated.

[TravisEz13]

@jnevins-gcm Here is the external issue. https://github.com/microsoft/omi/issues/596 It was closed because OMI is deprecated and will not fix these issues.
This was summarized here: https://github.com/PowerShell/PowerShell/issues/10600#issuecomment-610565488

[adin3d]

ok, so it was moved to a project were was declared "out of scope"

I think there are around two years since we wait for this, any chance for this to have a proper follow-up and timeline?

Thank you

[iSazonov]

@adin3d Please look last comments in https://github.com/PowerShell/PowerShell/issues/5561