text:
Secret rotation and monitoring strategy

We have dozens of service principal credentials stored in the live test provisioning keyvault. We need to have a better way of managing these credentials, especially the ability to rotate them with minimal toil. This could mean simple rotation automation, or some higher level solution to make test credentials more dynamic.

There is both an immediate concern here as well as a larger scope plan needed.  @mitchdenny has some thinking on a plan for this and how to break it down in the short term as well.

Expanding the scope of this issue to not only test secrets but we have a number of PATs for github or DevOps that we store in KV that we need to setup automation so that we can detect when these are expiring and then regenerate and rotate them.

authors: benbp kurtzeborn weshaggard

repo: Azure/azure-sdk-tools


text:
Failed to sync file from local to Azure file

Which version of the AzCopy was used?
Note: The version is visible when running AzCopy without any argument
azcopy version 10.14.1
Which platform are you using? (ex: Windows, Mac, Linux)
Windows
What command did you run?
Note: Please remove the SAS to avoid exposing your credentials. If you cannot remember the exact command, please retrieve it from the beginning of the log file.
.\azcopy sync \{localIp}{localSmbShrea} 'https://{saAccount}.file.core.windows.net/{shareName}/{folderName}?{sasToken}'  --recursive --preserve-smb-permissions=true --preserve-smb-info=true --delete-destination=prompt
What problem was encountered?
It throws exception:
panic: runtime error: index out of range [0] with length 0
goroutine 104 [running]:
github.com/Azure/azure-storage-azcopy/v10/ste.localFileSourceInfoProvider.GetSDDL(0x14b0ed0, 0xc00025a0e0, 0xe64ae187366c7999, 0xfb2a1bb69fe01670, 0x800000, 0xc0024da000, 0x4e, 0x0, 0xc002b44000, 0x108, ...)
/home/vsts/work/1/s/ste/sourceInfoProvider-Local_windows.go:78 +0x5dc
github.com/Azure/azure-storage-azcopy/v10/ste.(*azureFileSenderBase).addPermissionsToHeaders(0xc000942ea0, 0xe64ae187366c7999, 0xfb2a1bb69fe01670, 0x800000, 0xc0024da000, 0x4e, 0x0, 0xc002b44000, 0x108, 0x10201, ...)
/home/vsts/work/1/s/ste/sender-azureFile.go:274 +0x11d
github.com/Azure/azure-storage-azcopy/v10/ste.(*azureFileSenderBase).SetFolderProperties(0xc000942ea0, 0x0, 0x0)
/home/vsts/work/1/s/ste/sender-azureFile.go:381 +0x1d8
github.com/Azure/azure-storage-azcopy/v10/ste.anyToRemote_folder(0x14b0ed0, 0xc00025a0e0, 0xe64ae187366c7999, 0xfb2a1bb69fe01670, 0x800000, 0xc0024da000, 0x4e, 0x0, 0xc002b44000, 0x108, ...)
/home/vsts/work/1/s/ste/xfer-anyToRemote-folder.go:85 +0x55d
github.com/Azure/azure-storage-azcopy/v10/ste.anyToRemote(0x14b0ed0, 0xc00025a0e0, 0x148b0c0, 0xc0003a2080, 0x1707c6dc200, 0xc0004a0010, 0x1377530, 0x1377580)
/home/vsts/work/1/s/ste/xfer-anyToRemote-file.go:180 +0x1a5
github.com/Azure/azure-storage-azcopy/v10/ste.parameterizeSend.func1(0x14b0ed0, 0xc00025a0e0, 0x148b0c0, 0xc0003a2080, 0x1707c6dc200, 0xc0004a0010)
/home/vsts/work/1/s/ste/xfer.go:76 +0x7a
github.com/Azure/azure-storage-azcopy/v10/ste.(*jobPartMgr).StartJobXfer(0xc000315a40, 0x14b0ed0, 0xc00025a0e0)
/home/vsts/work/1/s/ste/mgr-JobPartMgr.go:679 +0x78
github.com/Azure/azure-storage-azcopy/v10/ste.(*jobPartTransferMgr).StartJobXfer(0xc00025a0e0)
/home/vsts/work/1/s/ste/mgr-JobPartTransferMgr.go:216 +0x4f
github.com/Azure/azure-storage-azcopy/v10/ste.(*jobsAdmin).transferProcessor.func1(0x14b0ed0, 0xc00025a0e0)
/home/vsts/work/1/s/ste/JobsAdmin.go:467 +0x1b9
github.com/Azure/azure-storage-azcopy/v10/ste.(*jobsAdmin).transferProcessor(0xc000346340, 0x31)
/home/vsts/work/1/s/ste/JobsAdmin.go:475 +0x95
created by github.com/Azure/azure-storage-azcopy/v10/ste.initJobsAdmin
/home/vsts/work/1/s/ste/JobsAdmin.go:221 +0x7bd
How can we reproduce the problem in the simplest way?
No (Sorry, I can only tell the same cmd (the same local smb share) worked for me before on an older version azcopy that was downloaded around Dec. 2021)
Have you found a mitigation/solution?
No

Hey @robga ,
Thanks for reaching out!
AzCopy sync from local source to Azure file is working fine in the released versions. I tried to repro the issue but it worked as expected for me as well.
 .\azure-storage-azcopy.exe sync F:\RandomData\2020\ "https://azurestrgmohitfrance.file.core.windows.net/testdirectory/2020?<SAS>" --recursive --preserve-smb-permissions=true --preserve-smb-info=true --delete-destination=prompt
INFO: Any empty folders will be processed, because source and destination both support folders. For the same reason, properties and permissions defined on folders will be processed

Job 48ebf78e-a951-cf45-5e71-8b6a4d310a69 has started
Log file is located at: C:\Users\mohsha\.azcopy\48ebf78e-a951-cf45-5e71-8b6a4d310a69.log

The File 'Az %Copy.txt' does not exist at the source. Do you wish to delete it from the destination(https://azurestrgmohitfrance.file.core.windows.net/testdirectory/2020/mycont)? Please confirm with: [Y] Yes  [N] No  [A] Yes for all  [L] No for all A
INFO: Confirmed. All the extra Files will be deleted.
INFO: Deleting extra object: Az %Copy.txt
INFO: Deleting extra object: Import_User_Sample_en%.csv
INFO: Deleting extra object: max%resdefault.jpg
24 Files Scanned at Source, 7 Files Scanned at Destination

Job 48ebf78e-a951-cf45-5e71-8b6a4d310a69 Summary
Files Scanned at Source: 24
Files Scanned at Destination: 27
Elapsed Time (Minutes): 0.1337
Number of Copy Transfers for Files: 0
Number of Copy Transfers for Folder Properties: 0
Total Number Of Copy Transfers: 0
Number of Copy Transfers Completed: 0

I would like you to double check the command you're passing. I suspect that the source is not correctly formed. In the AzCopy log file, we publish Job-Command that you can see to validate the correct source/destination.
If it doesn't help, please share the AzCopy log and AzCopy Scanning log with me? I'll investigate it for you.

Whatever the parameters I gave, it shouldn't crush. I cannot share you the log. But I can tell you there is no error in the log. You should be able to investigate it based on the exception.

source: gharchive/issue

authors: mohsha-msft robga

repo: Azure/azure-storage-azcopy

license: MIT

license_type: permissive

license_source: github-api


text:
Functions that are disabled in host.json should still return keys and be runnable

Functions that are disabled in the functions array host.json behave differently than functions disabled in function.json. This causes a lot of customer confusion and it makes the portal behave poorly. The portal issue https://github.com/Azure/azure-functions-ux/issues/1428 is blocked until we address this script bug.
The two behaviors should either be consistent or we should deprecate this property.

The host.json documentation needs to make it clear that the functions property does not work well with the portal and is just for testing scenarios. The property should be removed from the host.json schema.

Rather than update our doc to say that this won't work well with the portal, I don't see why we don't just update the portal code to honor this list as originally suggested in https://github.com/Azure/azure-functions-ux/issues/1428. Why isn't that simple and straight forward?

@mathewc We believe that customers will be confused if functions don't appear in the portal at all, as then they can't manage them. Perhaps this can be solved with better documentation. Based on current customer feedback, they are expecting the functions array to behave like the "disabled" state, rather than "excluded"

authors: lindydonna mathewc paulbatum

repo: Azure/azure-webjobs-sdk-script


text:
Support view metrics in VSCode extension

How to install & use
https://github.com/Azure/azure-webpubsub/pull/692

Also feel too much for a vscode extension, any other service extension supporting such feature?

source: gharchive/pull-request

repo: Azure/azure-webpubsub


text:
Support "importing" resourceType and apiVersion mappings for specific resource types

can we allow for import of resourceType and/or apiVersion combinations for end users to declare resources without worrying as much about those details? essentially modules for types & apiVersions

Need more clarity on how important this is and how much modules could potentially help with this problem

Made suggestion in #413 that might be related to this.

Closing and tracking with #622

authors: alex-frankel slavizh

repo: Azure/bicep


text:
linter should catch non-optimal scope references

If you don't have a proper reference to a resource group (or other scope), you can provide a scope using the relevant scope function:
module foo '...' = {
  scope: resourceGroup('my-rg')
  ...
}

However, if you do have a reference, it is better to use that reference directly. This is a newer capability so there are old examples out there that use the previous way we exposed.
This is ideal if you have a reference:
resource rg 'microsoft.resources/resourceGroups@2020-06-01' = { ... }

module foo '...' = {
  scope: rg
  ...
}

But in practice we often see this less ideal pattern:
resource rg 'microsoft.resources/resourceGroups@2020-06-01' = { ... }

module foo '...' = {
  scope: resourceGroup(rg.name)
  ...
}

It should work for MGs this way as well once we fix #1833.

authors: alex-frankel majastrz


text:
Wrong Time format after arm to bicep decompile

Bicep version
Bicep CLI version 0.4.613 (d826ce8411)
Describe the bug
bicep decompile uses local Date Settings when decompiling arm template
Old:
...
        // Data Factory Trigger
        {
            "name": "[concat(parameters('dataFactoryName'), '/Backup Trigger')]",
            "type": "Microsoft.DataFactory/factories/triggers",
            "apiVersion": "2018-06-01",
            "properties": {
                "annotations": [],
                "runtimeState": "Started",
                "pipelines": [
                    {
                        "pipelineReference": {
                            "referenceName": "Backup Database",
                            "type": "PipelineReference"
                        },
                        "parameters": {}
                    }
                ],
                "type": "ScheduleTrigger",
                "typeProperties": {
                    "recurrence": {
                        "frequency": "Hour",
                        "interval": "[parameters('backupIntervalInHours')]",
                        "startTime": "2020-05-13T08:00:00Z",
                        "timeZone": "UTC"
                    }
                }
            },
            "dependsOn": ["Backup Database"]
        }
...

New (decompiled)
resource dataFactoryName_Backup_Trigger 'Microsoft.DataFactory/factories/triggers@2018-06-01' = {
  parent: datafactoryName_resource
  name: 'Backup Trigger'
  properties: {
    annotations: []
    runtimeState: 'Started'
    pipelines: [
      {
        pipelineReference: {
          referenceName: 'Backup Database'
          type: 'PipelineReference'
        }
        parameters: {}
      }
    ]
    type: 'ScheduleTrigger'
    typeProperties: {
      recurrence: {
        frequency: 'Hour'
        interval: backupIntervalInHours
        startTime: '13.05.2020 08:00:00' // wrong format here
        timeZone: 'UTC'
      }
    }
  }
  dependsOn: [
    dataFactoryName_Backup_Database
  ]
}

To Reproduce
None
Additional context
Computer has Swiss Date Time Format Settings

Good catch. I think the fix is most likely to configure DateParseHandling.None (https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_DateParseHandling.htm) when deserializing the JSON file - as we should be treating the date as if it were any other string.
Here's where the deserialization logic is: https://github.com/Azure/bicep/blob/8a745d1986ecb7e4783f3ba39acb4f600d23e4f6/src/Bicep.Decompiler/TemplateConverter.cs#L58-L62

authors: anthony-c-martin firewave-remo


text:
manifest.yaml differs from MS documentation

https://learn.microsoft.com/en-gb/azure/deployment-environments/configure-catalog-item#add-a-new-catalog-item
Indicates that the manifest.yaml should have the structure:
name: WebApp
    version: 1.0.0
    description: Deploys an Azure Web App without a data store
    engine:
      type: ARM
      templatePath: azuredeploy.json

However the manifests in this sample project follow the structure:
name: FunctionApp
version: 1.0.0
summary: Azure Function App Environment
description: Deploys an Azure Function App, Storage Account, and Application Insights
runner: ARM
templatePath: azuredeploy.json

Can open a PR if required, just need confirmation which is correct

Hi @tkimmm - Thank you for bringing it to our attention, the discrepancy has been resolved now! 👍

authors: sagarlankala tkimmm

repo: Azure/deployment-environments


text:
Adding prerun hook to lowercase application names

Fixes #209!
:wave: Hi @bacongobbler! I thought this would be a quick and easy fix to solve issue #209. Let me know what you think!

@bnookala,
Thanks for your contribution as a Microsoft full-time employee or intern. You do not need to sign a CLA.
Thanks,
Microsoft Pull Request Bot

Codecov Report

Merging #212 into master will decrease coverage by 0.46%.
The diff coverage is 0%.

@@            Coverage Diff             @@
##           master     #212      +/-   ##
==========================================
- Coverage   32.94%   32.47%   -0.47%
==========================================
  Files          18       18
  Lines        1108     1124      +16
==========================================
  Hits          365      365
- Misses        694      710      +16
  Partials       49       49

Impacted Files
Coverage Δ

cmd/draft/create.go
41.3% <0%> (-8.7%)
:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 63a6da1...a6d0306. Read the comment docs.

@bacongobbler was wondering if there was anything else that needed to be done for this branch too? :)

authors: bnookala codecov-io msftclas

repo: Azure/draft


text:
Feature/smartlb

Proxy implementation extended with smart load balancing (priority based) so you can prioritize your PTU over PAYG or have a secondary region as a fallback (will retry if rate limiter of the service is hit).
Proxy now uses AppInsights (OpenTelemetry), so dashboard application map should show the entire flow.
Updated bicep files to reflect this change (update on App Config with new proxyconfiguration structure)
Bicep Bugfixes for deployment of secondary Azure OpenAI instance - this now works again
included small changes that Mick came up with.
These are breaking changes - so if you have an environment, please remove it and redeploy everything again.

resolved most of the comments - some "will not fix"

Approved

authors: azureholic pascalvanderheiden

repo: Azure/enterprise-azureai


text:
Various bug fixes.

In IMDS retry logic, if we don't receive a response don't retry.
For error response bodies that aren't OData-v4 compliant stick the raw
JSON in the ServiceError.Details field so the information isn't lost.
Removed superfluous wrapping of response error in
azure.DoRetryWithRegistration.
Thank you for your contribution to Go-AutoRest! We will triage and review it as soon as we can.
As part of submitting, please make sure you can make the following assertions:

[ ] I've tested my changes, adding unit tests if applicable.
[ ] I've added Apache 2.0 Headers to the top of any new source files.
[ ] I'm submitting this PR to the dev branch, except in the case of urgent bug fixes warranting their own release.
[ ] If I'm targeting master, I've updated CHANGELOG.md to address the changes I'm making.

Fixes the following issues.
https://github.com/Azure/go-autorest/issues/286
https://github.com/Azure/go-autorest/issues/290
https://github.com/Azure/go-autorest/issues/291

repo: Azure/go-autorest

license_source: bigquery


text:
Running the module without azure

Hi you guys,
I'd like to get the gathered information just to the iod-edge broker and not to the cloud.
Is there a way to do this with your module?
Thanks =)
Best regards,
Zuendelmeister

sure. just checkout how we send it to iothub. you could put your code in there and do whatever you want to do with the data. what is the scenario you are going to address?

I just want to get the data from the OPC-OA server and send them to the iot edge broker. Before loading them to iot hub I need to add some additional information. Is there a plan to add this feature?
Best regards,
Zuendelmeister

Not yet. I keep the issue open and when we update the publisher to the iot-edge release, which will happen later this year, we will look into this.
From: Zuendelmeister [mailto:notifications@github.com]
Sent: Montag, 11. September 2017 20:11
To: Azure/iot-edge-opc-publisher iot-edge-opc-publisher@noreply.github.com
Cc: Hans Gschoßmann johanng@microsoft.com; Comment comment@noreply.github.com
Subject: Re: [Azure/iot-edge-opc-publisher] Running the module without azure (#74)
I just want to get the data from the OPC-OA server and send them to the iot edge broker. Before loading them to iot hub I need to add some additional information. Is there a plan to add this feature?
Best regards,
Zuendelmeister
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Fiot-edge-opc-publisher%2Fissues%2F74%23issuecomment-328607997&data=02|01|johanng%40microsoft.com|5427968a12004fbd14f608d4f9407f4b|72f988bf86f141af91ab2d7cd011db47|1|0|636407502788574424&sdata=wzQWVCReCdyz0fM4elICe3%2FlkRJ3KTY2dpbl%2F90uaSE%3D&reserved=0, or mute the threadhttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAHxeljA3j7h2H12vrAHtodPcCY3EHIzvks5shXRNgaJpZM4POOQR&data=02|01|johanng%40microsoft.com|5427968a12004fbd14f608d4f9407f4b|72f988bf86f141af91ab2d7cd011db47|1|0|636407502788574424&sdata=51NVYh5CDq8B1HwbdGtfulOjvl6q1FzkiDqOOH8%2FEoE%3D&reserved=0.

Thank you so much =)

When running the publisher as an IoT Edge module, you just need to configure your Edge routes appropriately. This way you can avoid to send any data to the IoT Hub in the cloud. For instance, you could route all the output from the publisher module into another Edge module that sends the data into some on-prem storage.

authors: Zuendelmeister hansgschossmann sebader

repo: Azure/iot-edge-opc-publisher


text:
Commit more Nexcom Popular Gateway device.

Add Nexcom popular gateway device : (appc3154/ippc2150p/neu-x100/neu-x300/nife105w/nife200p2e/nife300e3/nise107/nise108/nise3600p2e/nise3800p2e/nise3900p2e/nise4200/nise4300/smb210) to public repository

Dear Sir,
Follow your suggestions, I had changed to using component and verify the
model can work.
I re-sent the PR again, please check it again.
Allan.
Ricardo Minguez (Rido) notifications@github.com 於 2020年10月21日 週三
上午12:33寫道：

@rido-min commented on this pull request.
Hi @llanchen1971, I see the Xcares1 interface several times in this PR.
These interfaces are meant to describe device interactions. If two or more
devices use the same interface there is no need to create one interface per
device.
It's ok to have different devices implementing the same interface.
Because once approved these models become immutable, I'd like to double
check with you before accepting.
Thanks,
Rido
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/Azure/iot-plugandplay-models/pull/26#pullrequestreview-512925219,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ADBTNTMWQ6K3U55OQIXZ5ATSLW3VNANCNFSM4SXYZVPA
.

Thanks for the update @allanchen1971,
As you can see in the PR checks, there is an error with the filename casing:
ERROR: in current path /home/runner/work/iot-plugandplay-models/iot-plugandplay-models/dtmi/nexcom/nexdeviceInfo-1.json, expecting /home/runner/work/iot-plugandplay-models/iot-plugandplay-models/dtmi/nexcom/nexdeviceinfo-1.json.
Can you update this PR?
Thanks,
Rido
PS: Just a reminder that different products can use the same interface. There is no need to submit one interface per device.

Dear Sir,
Yes, I had update it.
Ricardo Minguez (Rido) notifications@github.com 於 2020年10月21日 週三
下午10:45寫道：

Thanks for the update @allanchen1971 https://github.com/allanchen1971,
As you can see in the PR checks
https://github.com/Azure/iot-plugandplay-models/runs/1285710056?check_suite_focus=true#step:5:22,
there is an error with the filename casing:
ERROR: in current path
/home/runner/work/iot-plugandplay-models/iot-plugandplay-models/dtmi/nexcom/nexdeviceInfo-1.json,
expecting
/home/runner/work/iot-plugandplay-models/iot-plugandplay-models/dtmi/nexcom/nexdeviceinfo-1.json.
Can you update this PR?
Thanks,
Rido
PS: Just a reminder that different products can use the same interface.
There is no need to submit one interface per device.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/Azure/iot-plugandplay-models/pull/26#issuecomment-713629922,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ADBTNTOGSVNCRAETD6LQ2ZTSL3XZNANCNFSM4SXYZVPA
.

repo: Azure/iot-plugandplay-models


text:
Add convenience parameters to MakeTypeVisitor()

Adds parameters to the MakeTypeVisitor() method to make it easier to create a TypeVisitor for a specific purpose.
Goal is to make consuming code a little more declarative - this works particularly well when functions with well chosen names are passed to MakeTypeVisitor().

Codecov Report

Merging #439 (b7337ad) into master (0507bf4) will increase coverage by 0.08%.
The diff coverage is 58.91%.

:exclamation: Current head b7337ad differs from pull request most recent head 66bb040. Consider uploading reports for the commit 66bb040 to get more accurate results

@@            Coverage Diff             @@
##           master     #439      +/-   ##
==========================================
+ Coverage   62.27%   62.36%   +0.08%
==========================================
  Files         145      145
  Lines        9931     9989      +58
==========================================
+ Hits         6185     6230      +45
- Misses       3186     3207      +21
+ Partials      560      552       -8

Impacted Files
Coverage Δ

...k/generator/pkg/codegen/pipeline_augment_status.go
8.06% <0.00%> (ø)

...rator/pkg/codegen/pipeline_create_storage_types.go
3.19% <0.00%> (ø)

hack/generator/pkg/astmodel/type_visitor.go
53.36% <48.57%> (-2.26%)
:arrow_down:

...enerator/pkg/codegen/pipeline_flatten_resources.go
45.71% <50.00%> (-2.94%)
:arrow_down:

...generator/pkg/codegen/pipeline_create_arm_types.go
66.66% <71.42%> (-0.32%)
:arrow_down:

hack/generator/pkg/astmodel/type_definition.go
89.85% <100.00%> (-0.15%)
:arrow_down:

hack/generator/pkg/astmodel/type_flag.go
100.00% <100.00%> (ø)

...enerator/pkg/codegen/pipeline_check_for_anytype.go
92.45% <100.00%> (-0.14%)
:arrow_down:

.../codegen/pipeline_json_serialization_test_cases.go
79.16% <100.00%> (-1.61%)
:arrow_down:

...erator/pkg/codegen/pipeline_remove_type_aliases.go
69.76% <100.00%> (ø)

... and 9 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0507bf4...66bb040. Read the comment docs.

authors: codecov-commenter theunrepentantgeek


text:
kubectl exec -it  -- df -h shows size of 60Z

Followed the instructions on this page when i got to testing the deployment recieved the following out put from
kubectl exec -it deployment-localdisk-6f95f4f858-bjkms -- df -h
Filesystem      Size  Used Avail Use% Mounted on
overlay         124G   23G  102G  19% /
tmpfs            64M     0   64M   0% /dev
tmpfs            32G     0   32G   0% /sys/fs/cgroup
/dev/sdb1        60Z   60Z     0 100% /mnt/localdisk
/dev/sda1       124G   23G  102G  19% /etc/hosts
shm              64M     0   64M   0% /dev/shm
tmpfs            32G   12K   32G   1% /run/secrets/kubernetes.io/serviceaccount
tmpfs            32G     0   32G   0% /proc/acpi
tmpfs            32G     0   32G   0% /proc/scsi
tmpfs            32G     0   32G   0% /sys/firmware
connected to the pod and tried to make a directory at the mountpath /mnt/localdisk
mkdir test
mkdir: cannot create directory 'test': Structure needs cleaning
logs shows many
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning
/bin/sh: 1: cannot create /mnt/localdisk/outfile: Structure needs cleaning

aks kubernetes version 1.21.2

node type E8ds_v4

what's your disk size? looks like file system is corrupted

https://unix.stackexchange.com/questions/330742/cannot-remove-file-structure-needs-cleaning

I am in aks if I drop the deployment and reistablish it its supposed to repartition and reformat it correct.  This doesnt seem to be happening.  Can I drop the partition from a pod and recreate it?

df
Filesystem                1K-blocks                 Used Available Use% Mounted on
overlay                   129900528             24193776 105690368  19% /
tmpfs                         65536                    0     65536   0% /dev
tmpfs                      32934120                    0  32934120   0% /sys/fs/cgroup
/dev/sdb1      69679034472154449220 69679034471845929516         0 100% /mnt/localdisk
/dev/sda1                 129900528             24193776 105690368  19% /etc/hosts
shm                           65536                    0     65536   0% /dev/shm
tmpfs                      32934120                   12  32934108   1% /run/secrets/kubernetes.io/serviceaccount
tmpfs                      32934120                    0  32934120   0% /proc/acpi
tmpfs                      32934120                    0  32934120   0% /proc/scsi
tmpfs                      32934120                    0  32934120   0% /sys/firmware
root@deployment-localdisk-6f95f4f858-jct9d:/# e2fsck /dev/sdb1
e2fsck 1.46.2 (28-Feb-2021)
/dev/sdb1 is mounted.
WARNING!!!  The filesystem is mounted.   If you continue you WILL
cause SEVERE filesystem damage.
Do you really want to continue? yes
e2fsck: No such file or directory while trying to open /dev/sdb1
Possibly non-existent device?

Seems like this should be something the provisioner should be handling.  I dont seem to be able to do anything about it.

su -
root@deployment-localdisk-687ccc64f6-4vgs2:~# umount /dev/sdb1
umount: /mnt/localdisk: must be superuser to unmount.

also its a 300G but I reserver 299.

I also tried an aks debug pod.  That didnt work either.
root@aks-default2-35939363-vmss000000:/# su -
root@aks-default2-35939363-vmss000000:~# umount /dev/sdb1
umount: /host/var/lib/kubelet/plugins/kubernetes.io/local-volume/mounts/local-pv-41ef20bb: must be superuser to unmount.
It seems I cannot fix the issue with the node.  Setting up a new node pool every time this happens is less then desirable.
the problem is either in the kubernetes version or this driver.

could you provide kubectl logs local-volume-provisioner-xxx-n kube-system logs on that agent node? thanks.

it looks like the log is continuing to try and clean /dev/sdb1 with the shred script.  I guess I just have to wait.  The go program is scanning all the files under /dev.  This seems to be slowing it down considerably.

so the cleanup finished I waited a few minutes after that then redeployed same issue.
I1206 19:08:29.589363       1 discovery.go:287] file(vga_arbiter) under(/dev) does not match pattern(sdb1*)
I1206 19:08:30.002249       1 deleter.go:319] Cleanup pv "local-pv-d655187b": StderrBuf - "shred: /dev/sdb1: pass 3/3 (000000)...296GiB/300GiB 98%"
I1206 19:08:35.002239       1 deleter.go:319] Cleanup pv "local-pv-d655187b": StderrBuf - "shred: /dev/sdb1: pass 3/3 (000000)...298GiB/300GiB 99%"
I1206 19:08:39.139795       1 deleter.go:319] Cleanup pv "local-pv-d655187b": StderrBuf - "shred: /dev/sdb1: pass 3/3 (000000)...300GiB/300GiB 100%"
I1206 19:08:39.140383       1 deleter.go:283] Completed cleanup of pv "local-pv-d655187b"
I1206 19:08:39.589961       1 discovery.go:287] file(termination-log) under(/dev) does not match pattern(sdb1*)
I1206 19:08:39.590022       1 discovery.go:394] Found new volume at host path "/dev/sdb1" with capacity 322120450048, creating Local PV "local-pv-d655187b", required volumeMode "Filesystem"
I1206 19:08:39.605529       1 discovery.go:428] Created PV "local-pv-d655187b" for volume at "/dev/sdb1"
I1206 19:08:39.605556       1 discovery.go:287] file(isst_interface) under(/dev) does not match pattern(sdb1*)
I1206 19:08:39.605561       1 cache.go:55] Added pv "local-pv-d655187b" to cache
kubectl exec -it deployment-localdisk-6f95f4f858-twx7s -- df -h
Filesystem      Size  Used Avail Use% Mounted on
overlay         124G   21G  103G  17% /
tmpfs            64M     0   64M   0% /dev
tmpfs            32G     0   32G   0% /sys/fs/cgroup
/dev/sdb1        64Z   64Z  295G 100% /mnt/localdisk
/dev/sda1       124G   21G  103G  17% /etc/hosts
shm              64M     0   64M   0% /dev/shm
tmpfs            32G   12K   32G   1% /run/secrets/kubernetes.io/serviceaccount
tmpfs            32G     0   32G   0% /proc/acpi
tmpfs            32G     0   32G   0% /proc/scsi
tmpfs            32G     0   32G   0% /sys/firmwar
logs_removepvc.log
e

So I see some issues
The scan of the /dev
The shred script messing up the volume without repartitioning and formating it after.
Is it appropriate on the aks E8ds_v4's to be using the following?
hostDir: /dev
mountDir:  /dev

it seems to contradict what I am seeing as the mount path on the node.
/host/var/lib/kubelet/plugins/kubernetes.io/local-volume/mounts/local-pv-d655187b

the mount path for temp appears to be this for a non provisioned node.
lsblk
NAME    MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda       8:0    0   128G  0 disk
|-sda1    8:1    0 127.9G  0 part /host
|-sda14   8:14   0     4M  0 part
-sda15   8:15   0   106M  0 part /host/boot/efi sdb       8:16   0   300G  0 disk  -sdb1    8:17   0   300G  0 part /host/mnt

I have not heard about this issue in quite a while.  I am kind of stuck in terms of using tempdb space and nvme space until i either understand how to resolve this, or configure it correctly or if there is a patch comming do you have any kind of eta on it.

following these instructions.
https://github.com/Azure/kubernetes-volume-drivers/tree/master/local

authors: andyzhangx lonnieherring

repo: Azure/kubernetes-volume-drivers


text:
Binary download to SCS vm fails msg": "/mnt/resource directory does not exist

Is your feature request related to a problem? Please describe.
When the pipeline for BOM processing is started after a deallocation it will fail as /mnt/resource will vanish with the deallocation
Describe the solution you'd like
Create the temp donwload folder  /mnt/resource in the bom processing pipeline if it doesn't exist
Describe alternatives you've considered
none
Additional context
none

@mimergel  - One more for you, Sir :)
Please check and close :)

checked and closed.
Thanks

authors: PankajMeshramCSA mimergel

repo: Azure/sap-automation


text:
Error: Invalid for_each argument | create_role_assignment_network_contributor

Is there an existing issue for this?

[X] I have searched the existing issues

Greenfield/Brownfield provisioning
greenfield
Terraform Version
1.5.4
Module Version
9.0.0
AzureRM Provider Version
3.109.0
Affected Resource(s)/Data Source(s)
azurerm_kubernetes_cluster_node_pool
Terraform Configuration Files
module "aks" {
  source  = "Azure/aks/azurerm"
  version = "7.3.2"

  prefix                                     = "example"
  cluster_name                               = var.cluster_name
  enable_auto_scaling                        = true
  agents_pool_name                           = "systempool"
  agents_size                                = var.node_size
  agents_max_count                           = var.node_count.max
  agents_min_count                           = var.node_count.min
  agents_labels                              = var.agents_labels
  agents_taints                              = var.agents_taints
  agents_tags                                = var.agents_tags
  only_critical_addons_enabled               = true
  orchestrator_version                       = var.kubernetes_version
  kubernetes_version                         = var.kubernetes_version
  os_disk_type                               = "Managed"
  os_sku                                     = "Ubuntu"
  temporary_name_for_rotation                = var.temporary_name_for_rotation # enter this value when changing any of the default/system nodepool properties
  vnet_subnet_id                             = var.vnet_subnet_id
  agents_availability_zones                  = var.availability_zones
  resource_group_name                        = var.resource_group_name
  os_disk_size_gb                            = var.os_disk_size_gb
  sku_tier                                   = "Standard"
  node_pools                                 = var.node_pools
  network_plugin                             = "azure"
  network_plugin_mode                        = "overlay"
  net_profile_outbound_type                  = "userAssignedNATGateway"
  role_based_access_control_enabled          = true
  rbac_aad_managed                           = true
  local_account_disabled                     = true
  log_analytics_workspace_enabled            = false
  oidc_issuer_enabled                        = true
  workload_identity_enabled                  = true
  rbac_aad_azure_rbac_enabled                = true
  rbac_aad_admin_group_object_ids            = var.rbac_aad_admin_group_object_ids
  create_role_assignment_network_contributor = var.create_role_assignment_network_contributor
  web_app_routing                            = var.web_app_routing

tfvars variables values
resource_group_name = "staging"

node_size                   = "Standard_D8s_v3"
os_disk_size                = 100
temporary_name_for_rotation = null
environment                 = "staging"
kubernetes_version          = "1.27.9"

agents_labels = {}
agents_taints = []
agents_tags   = {}

availability_zones         = ["1", "2", "3"]
create_platform_namespaces = true
create_rbac_roles          = true

subscription_id = "XXXXXXXXXXXXXXXX"
env_prefix      = "pg"

create_role_assignment_network_contributor = true

Debug Output/Panic Output
╷
│ Error: Invalid for_each argument
│
│   on .terraform/modules/aks.aks.aks/main.tf line 790, in resource "azurerm_role_assignment" "network_contributor":
│  790:   for_each = var.create_role_assignment_network_contributor && (var.client_id == "" || var.client_secret == "") ? local.subnet_ids : []
│     ├────────────────
│     │ local.subnet_ids is a set of dynamic, known only after apply
│     │ var.client_id is ""
│     │ var.client_secret is ""
│     │ var.create_role_assignment_network_contributor is true
│
│ The "for_each" set includes values derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this
│ resource.
│
│ When working with unknown values in for_each, it's better to use a map value where the keys are defined statically in your configuration and where only the values contain apply-time results.
│
│ Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge.

Expected Behaviour
When the variable create_role_assignment_network_contributor is set to true, it should create and iterate over resources.
Actual Behaviour
On the first run, you will encounter an invalid for_each loop if the variable create_role_assignment_network_contributor is set to true. To avoid this, set the variable to false initially. After the cluster is created, you can then set it to true, and it will work fine. Additionally, any changes to the VNet resource can also cause this error.
We are currently using version 7.3.2 of the "Azure/aks/azurerm" module in our environments. Both new and old deployments use this version, but the issue persists regardless of the deployment time. Notably, this bug still exists in version 9.0.0.
Steps to Reproduce
No response
Important Factoids
No response
References
No response

hello @prosaied
this is a known problem and it was fixed in PR https://github.com/Azure/terraform-azurerm-aks/pull/410
the variable create_role_assignment_network_contributor is deprecated and will go away in a future version.
Please migrate to the new network_contributor_role_assigned_subnet_ids variable.

@zioproto
Thank you so much for your quick response. We have introduced the network_contributor_role_assigned_subnet_ids variable and performed the Terraform import from the create_role_assignment_network_contributor. Everything looks good now.

@zioproto
Thank you so much for your quick response. We have introduced the network_contributor_role_assigned_subnet_ids variable and performed the Terraform import from the create_role_assignment_network_contributor. Everything looks good now.

authors: prosaied zioproto

repo: Azure/terraform-azurerm-aks


text:
[AVM Module Issue]: modtm provider not available

Check for previous/existing GitHub issues

[X] I have checked for previous/existing GitHub issues

Issue Type?
Bug
(Optional) Module Version
No response
(Optional) Correlation Id
No response
Description
Need to add modtm provider information in terraform.tf file so that it can pick it up from azurerm instead of hashicorp/modtm
modtm = {
source  = "azure/modtm"
version = "~> 0.3"
}

looking into addressing this issue.

added recommendation
https://github.com/Azure/terraform-azurerm-avm-res-recoveryservices-vault/pull/36


text:
If items fail to deserialize, neither remove them nor return them.

Closes #308
@addev-ashish I'd like to review this change with you before we merge to make sure we're on the same page re expected behavior

Need to update unit tests.

Thanks @addev-ashish -- @heidijinxujia you may want to review this, even if only for FYI's sake


text:
V 1.6.2 failed with proxy configured

Hi,
We were using 1.4.0 msal4j version and now we have upgraded it to latest version 1.6.2. But now we get this exception while fetching the toke. Proxy is configured in our environment.
com.microsoft.aad.msal4j.MsalClientException: java.net.SocketTimeoutException: Read timed outcom.microsoft.aad.msal4j.MsalClientException: java.net.SocketTimeoutException: Read timed out 	at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequest(HttpHelper.java:68) 	at com.microsoft.aad.msal4j.OAuthHttpRequest.send(OAuthHttpRequest.java:34) 	at com.microsoft.aad.msal4j.TokenRequestExecutor.executeTokenRequest(TokenRequestExecutor.java:37) 	at com.microsoft.aad.msal4j.AbstractClientApplicationBase.acquireTokenCommon(AbstractClientApplicationBase.java:117) 	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:63) 	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:59) 	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:17) 	at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1604) 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) 	at java.lang.Thread.run(Thread.java:748) Caused by: java.net.SocketTimeoutException: Read timed out 	at java.net.SocketInputStream.socketRead0(Native Method) 	at java.net.SocketInputStream.socketRead(SocketInputStream.java:116) 	at java.net.SocketInputStream.read(SocketInputStream.java:171)
We are using Client Credential flow to get the token. Exactly same as - https://github.com/Azure-Samples/ms-identity-java-daemon/tree/master/msal-client-credential-secret.
Additional thing what we did is whitelisted below urls on the proxy. We are using Squid proxy.
 .login.microsoftonline.com,  .dataservice.protection.outlook.com,  .api.aadrm.com
This is required because MIPSDK does not support authenticated proxy. We are using msal4j to get the token and MIPSDK to fetch the labels from Azure Information Protection. Things work fine if these urls are removed from proxy whiltelisted list.
What is the change in newer versions of msal4j which are impacting this scenario?
It worked correctly when we were at 1.4.0 version but after upgrade to 1.6.2 things got broken.

ConnectTimeout and ReadTimeout are set to 3 and 5 seconds, probably timeouts are too short. Does this happen to all issued requests or occasionally ?

This occurs occasionally on some machines and frequent on other machines.

we are going to increase default timeouts + add APIs to set it, going to release it next week

1.7.0 version with increased timeouts + api to set custom timeouts released

Can I know what was the old timeout and what is new default timeout?

license: mit


text:
MFA Support

Hi,
I created an angular application with AAD authentication implemented based on the angular 9 sample, my application has a .net core API back-end that is also protected by AAD Authentication. Our organization has MFA enabled for all the users and if I try to open the application in incognito I get the following error
core.js:5828 ERROR Error: Uncaught (in promise): InteractionRequiredAuthError: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access 'API Client Id'. Trace ID: a1efbaca-fc0b-4ea9-8932-3571517f3700 Correlation ID: 44cb331f-a226-4a6d-ac71-f4159d490732 Timestamp: 2020-07-12 12:20:06Z InteractionRequiredAuthError: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access 'API Client Id'. Trace ID: a1efbaca-fc0b-4ea9-8932-3571517f3700 Correlation ID: 44cb331f-a226-4a6d-ac71-f4159d490732 Timestamp: 2020-07-12 12:20:06Z     at InteractionRequiredAuthError.AuthError [as constructor] (AuthError.js:22)     at InteractionRequiredAuthError.ServerError [as constructor] (ServerError.js:22)     at new InteractionRequiredAuthError (InteractionRequiredAuthError.js:24)     at MsalService.push../node_modules/msal/lib-es6/UserAgentApplication.js.UserAgentApplication.saveTokenFromHash (UserAgentApplication.js:1385)     at MsalService.push../node_modules/msal/lib-es6/UserAgentApplication.js.UserAgentApplication.processCallBack (UserAgentApplication.js:941)     at MsalService.push../node_modules/msal/lib-es6/UserAgentApplication.js.UserAgentApplication.handleAuthenticationResponse (UserAgentApplication.js:993)     at MsalService.<anonymous> (UserAgentApplication.js:737)     at step (tslib.es6.js:99)     at Object.next (tslib.es6.js:80)     at fulfilled (tslib.es6.js:70)     at resolvePromise (zone-evergreen.js:793)     at resolvePromise (zone-evergreen.js:752)     at zone-evergreen.js:854     at ZoneDelegate.invokeTask (zone-evergreen.js:400)     at Object.onInvokeTask (core.js:40744)     at ZoneDelegate.invokeTask (zone-evergreen.js:399)     at Zone.runTask (zone-evergreen.js:168)     at drainMicroTaskQueue (zone-evergreen.js:570)     at invokeTask (zone-evergreen.js:485)     at ZoneTask.invoke (zone-evergreen.js:470)
from what I understood msal will call acquireTokenSilent but that's not triggering MFA and I don't get the approval to my Authenticator.
Any help is appreciated.
Thank you in advance

@nasrnassar the pattern to handle these errors is to fallback to one of the interactive methods to acquire the token (which in this case should trigger MFA prompt). Take a look at the documentation here.

@nasrnassar Hope the documentation helps. Please use our issue template in the future if you have further issues so we can attempt to reproduce the errors. Thank you.

@jo-arroyo Apologies, I missed the template when adding my issue.
After going through the documentation link provided above and multiple failures, I filled the proper template below, hope this information sheds some light.
Library

[x] msal@1.3.0
[ ] @azure/msal-browser@2.x.x
[ ] @azure/msal-angular@0.x.x
[x] @azure/msal-angular@1.0.0
[ ] @azure/msal-angularjs@1.x.x

Framework
Angular 9
.Net core 3.1.2
Description
The application keeps going into 'msal:acquireTokenFailure' whenever I'm redirecting to the guarded Component.
Error Message
ERROR Error: Uncaught (in promise): InteractionRequiredAuthError: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '2d5c1a48-588c-475a-9f33-65cf44627f3b'. Trace ID: d558e24b-10c2-4864-ae28-8f36e1e28e00 Correlation ID: 393290df-4f36-436c-bbb6-a74f3d5bb8ef Timestamp: 2020-07-14 07:39:53Z InteractionRequiredAuthError: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '2d5c1a48-588c-475a-9f33-65cf44627f3b'. Trace ID: d558e24b-10c2-4864-ae28-8f36e1e28e00 Correlation ID: 393290df-4f36-436c-bbb6-a74f3d5bb8ef Timestamp: 2020-07-14 07:39:53Z     at InteractionRequiredAuthError.AuthError [as constructor] (AuthError.js:22)     at InteractionRequiredAuthError.ServerError [as constructor] (ServerError.js:22)     at new InteractionRequiredAuthError (InteractionRequiredAuthError.js:24)     at MsalService.push../node_modules/msal/lib-es6/UserAgentApplication.js.UserAgentApplication.saveTokenFromHash (UserAgentApplication.js:1385)     at MsalService.push../node_modules/msal/lib-es6/UserAgentApplication.js.UserAgentApplication.processCallBack (UserAgentApplication.js:941)     at MsalService.push../node_modules/msal/lib-es6/UserAgentApplication.js.UserAgentApplication.handleAuthenticationResponse (UserAgentApplication.js:993)     at MsalService.<anonymous> (UserAgentApplication.js:737)     at step (tslib.es6.js:99)     at Object.next (tslib.es6.js:80)     at fulfilled (tslib.es6.js:70)     at resolvePromise (zone-evergreen.js:793)     at resolvePromise (zone-evergreen.js:752)     at zone-evergreen.js:854     at ZoneDelegate.invokeTask (zone-evergreen.js:400)     at Object.onInvokeTask (core.js:40744)     at ZoneDelegate.invokeTask (zone-evergreen.js:399)     at Zone.runTask (zone-evergreen.js:168)     at drainMicroTaskQueue (zone-evergreen.js:570)     at invokeTask (zone-evergreen.js:485)     at ZoneTask.invoke (zone-evergreen.js:470)
Security

[ ] Is this issue security related?

Regression

[ ] Did this behavior work before?
Version:

MSAL Configuration
...
const baseHref = document.getElementsByTagName('base')[0].href;

export const protectedResourceMap: [string, string[]][] = [
    [
        baseHref,
        [environment.azureConfig.apiClientUrl]
    ],
    [environment.endpoints.GRAPH_ENDPOINT, ['user.read']]
];
const isIE = window.navigator.userAgent.indexOf('MSIE ') > -1 || window.navigator.userAgent.indexOf('Trident/') > -1;

function MSALConfigFactory(): Configuration {
    return {
        auth: {
            clientId: environment.azureConfig.uiClientId,
            authority: environment.azureConfig.instance + environment.azureConfig.tenantId,
            validateAuthority: true,
            redirectUri: baseHref,
            postLogoutRedirectUri: baseHref,
            navigateToLoginRequestUrl: true,
        },
        cache: {
            // cacheLocation: 'localStorage',
            storeAuthStateInCookie: isIE, // set to true for IE 11
        },
    };
}

function MSALAngularConfigFactory(): MsalAngularConfiguration {
    return {
        popUp: !isIE,
        consentScopes: [
            'user.read',
            'openid',
            'profile',
            environment.azureConfig.apiClientUrl
        ],
        unprotectedResources: ['https://www.microsoft.com/en-us/'],
        protectedResourceMap,
        extraQueryParameters: {}
    };
}
const appRoutes: Routes = [
    {
        path: 'apps',
        loadChildren: () => import('./main/apps/apps.module').then(m => m.AppsModule),
        canActivate: [
            MsalGuard
        ]
    },
    {
        path: 'pages',
        loadChildren: () => import('./main/pages/authentication/authentication.module').then(m => m.AuthenticationModule)
    },
    {
        path: '**',
        redirectTo: 'pages'
    }
];

@NgModule({
    declarations: [
        ...
    ],
    imports: [
      ...
RouterModule.forRoot(appRoutes, { useHash: true }),
        MsalModule,
...
    ],
    providers: [
        {
            provide: HTTP_INTERCEPTORS,
            useClass: MsalInterceptor,
            multi: true
        },
        {
            provide: MSAL_CONFIG,
            useFactory: MSALConfigFactory
        },
        {
            provide: MSAL_CONFIG_ANGULAR,
            useFactory: MSALAngularConfigFactory
        },
        MsalService
    ],
    bootstrap: [
        AppComponent
    ]
})

Login.component:
ngOnInit(): void {
        this.isIframe = window !== window.parent && !window.opener;

        this.checkoutAccount();

        this.broadcastService.subscribe('msal:loginSuccess', () => {
            this.checkoutAccount();
        });

        this.authService.handleRedirectCallback((authError, response) => {
            if (authError) {
                console.error('Redirect Error: ', authError.errorMessage);
                return;
            }

            console.log('Redirect Success: ', response);
        });

        this.broadcastService.subscribe('msal:acquireTokenFailure', payload => {
           if (!this.authService.getLoginInProgress()) {
                const accessTokenRequest = {
                    scopes: [environment.azureConfig.uiClientId],
                    authority: environment.azureConfig.instance + environment.azureConfig.tenantId,
                    forceRefresh: true
                };

                this.authService.acquireTokenPopup(accessTokenRequest).then((response) => {
                    console.log('success');
                    // redirect to my guarded component
                });
            }
        });

        this.authService.setLogger(new Logger((logLevel, message, piiEnabled) => {
            console.log('MSAL Logging: ', message);
        }, {
                correlationId: CryptoUtils.createNewGuid(),
                piiLoggingEnabled: false
            }));
    }

 checkoutAccount(): void {
        this.loggedIn = !!this.authService.getAccount();
    }

// called on button click
    login(): void {
        const isIE = window.navigator.userAgent.indexOf('MSIE ') > -1 || window.navigator.userAgent.indexOf('Trident/') > -1;

        if (isIE) {
            this.authService.loginRedirect();
        } else {
            this.authService.loginPopup().then((result) => {
                // redirect to my guarded component
            });
        }
    }

For the .NET core side, I set up the Authentication using JwtBearer with the below code

var tenantId = Configuration.GetValue<string>("AzureAd:TenantId");
            var apiAppId = Configuration.GetValue<string>("AzureAd:ClientId");
            var clientAppId = Configuration.GetValue<string>("AzureAd:UIClientId");

            services.AddAuthentication(sharedoptions =>
            {
                sharedoptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(options =>
            {
                options.Authority = $"https://login.microsoftonline.com/{tenantId}";

                options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidAudiences = new List<string>
                    {
                        apiAppId,
                        clientAppId
                    },
                    ValidIssuers = new List<string>
                    {
                        $"https://login.microsoftonline.com/{tenantId}/v2.0",
                        $"https://sts.windows.net/{tenantId}/",
                        $"https://sts.windows.net/{tenantId}/v2.0"
                    }
                };

                options.Events = new JwtBearerEvents
                {
                    OnAuthenticationFailed = ctx =>
                    {
                        if (!ctx.Response.HasStarted)
                        {
                            ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
                            message += "From OnAuthenticationFailed:\n";
                            message += FlattenException(ctx.Exception);
                        }
                        return Task.CompletedTask;
                    },

                    OnChallenge = ctx =>
                    {
                        if (!ctx.Response.HasStarted)
                        {
                            message += "From OnChallenge:\n";
                            ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
                            ctx.Response.ContentType = "text/plain";
                        }
                        return ctx.Response.WriteAsync(message);

                    },

                    OnMessageReceived = ctx =>
                    {
                        if (!ctx.Response.HasStarted)
                        {
                            message = "From OnMessageReceived:\n";
                            ctx.Request.Headers.TryGetValue("Authorization", out var BearerToken);
                            if (BearerToken.Count == 0)
                                BearerToken = "no Bearer token sent\n";
                            message += "Authorization Header sent: " + BearerToken + "\n";
                        }
                        return Task.CompletedTask;
                    },

                    OnTokenValidated = ctx =>
                    {
                        Debug.WriteLine("token: " + ctx.SecurityToken.ToString());
                        return Task.CompletedTask;
                    }
                };
            });

Reproduction steps
// Provide relevant code snippets here.
// For Azure B2C issues, please include your policies.

- Create .NET core web application with Angular template
- Add the msal required libraries to the angular application
- Register both API and UI applications on Azure
- Start from a fresh browser where cookies and cache is emptied

Expected behavior
I expect the app to trigger MFA so I can get the approval notification on MS Authenticator app
Browsers/Environment

[x] Chrome
[ ] Firefox
[ ] Edge
[ ] Safari
[ ] IE
[ ] Other (Please add browser name here)

@nasrnassar The logs seem to indicate that a popup window is opened. Did you observe that? Can you also provide the logs that happen before the error?

@jo-arroyo indeed a popup opens but closes immediately, and if i debug the code goes into the success function of "acquireTokenPopup" but when it tries redirecting to the guarded component that calls my .NET core api it throws the error.

@nasrnassar just in case, are you observing this in other browsers as well? The blinking popup window issue sometimes happen on Chrome -try checking your javascript settings.

@nasrnassar Is this only happening in Chrome Incognito? Does this happen in a normal Chrome window as well?

@jo-arroyo if I'm already logged in to my microsoft account it doesn't happen.
@derisen it's not JavaScript setting but might be browser related. We're investigating if something is blocking the request from completely going through. Will update you on Sunday as soon as I find out.

closing this issue, it was our network preventing the request from going properly. Sorry for any inconvenience and Thank you for your support

authors: derisen jo-arroyo nasrnassar


text:
Using prompt=login RedirectRequest parameter does not get passed to B2C Identity Provider

Core Library
MSAL.js v2 (@azure/msal-browser)
Core Library Version
2.14.2
Wrapper Library
MSAL React (@azure/msal-react)
Wrapper Library Version
1.0.0-beta.3
Description
I'm working the include the prompt=login flag in an custom AD B2C flow which includes an Azure AD Identity Provider (in addition to email login). When the prompt: 'login' flag is added into the loginRedirect call, it's included in the initial B2C login URI (as a query parameter) but it is not included when using the Azure AD Identity provider.
Error Message
No response
Msal Logs
No response
MSAL Configuration
{
  auth: {
    clientId: xxxxx-xxxxx-xxxxx,
    authority: `https://xxxxxx.b2clogin.com/xxxxx.onmicrosoft.com/B2C_1_signin`,
    knownAuthorities: [
      `https://xxxxx.b2clogin.com/xxxxx.onmicrosoft.com/B2C_1_signin`
    ],
    cloudDiscoveryMetadata: '',
    redirectUri: window.location.origin,
    postLogoutRedirectUri: window.location.origin,
    navigateToLoginRequestUrl: true,
    clientCapabilities: ['CP1']
  },
  cache: {
    cacheLocation: BrowserCacheLocation.SessionStorage,
    storeAuthStateInCookie: false
  },
  system: {
    windowHashTimeout: 60000,
    iframeHashTimeout: 6000,
    loadFrameTimeout: 0,
    asyncPopups: false
  }
}

Relevant Code Snippets
const loginRequest: RedirectRequest = {
  authority: `https://xxxxx.b2clogin.com/xxxxx.onmicrosoft.com/B2C_1_signin`,
  scopes: ['openid', 'offline_access'],
  prompt: 'login'
};
...

<MsalAuthenticationTemplate interactionType={InteractionType.Redirect} authenticationRequest={loginRequest}>
   ...
</MsalAuthenticationTemplate>

Reproduction Steps

Create and add Custom B2C Identity Provider for Azure AD
Configure MSAL login request to include the prompt=login field
Trigger loginRedirect in the MSAL library to go to the login page
Click on the Azure AD option included in the login page
Observe that the prompt=login field is not passed to the query parameters (although included on the initial page)

Expected Behavior
The Identity provider selected should include the prompt flag in the query parameters if added in the base MSAL configuration
Identity Provider
Azure B2C Custom Policy
Browsers Affected (Select all that apply)
Chrome
Regression
No response
Source
External (Customer)

ok, thank you @jo-arroyo!

Is there an update on this issue? I just hit the same issue with prompt=login not being included in the redirect.

B2C service team addressed this for specific IDPs (google for example) but if it is a custom policy, the details are user specific. They had plans to roll it out eventually for a list of IDPs. To get the status for your specific use case, can you please follow up with the service team on the status by raising an issue here?

Closing as this is a service issue. If you're still experiencing issues please consider opening an issue with B2C. Thanks!

authors: c0d3blooded l-o-l sameerag tnorling


text:
Refresh token silently with 3rd Party Cookies allowed - Error AADSTS50058

Core Library
MSAL.js (@azure/msal-browser)
Core Library Version
3.23.0
Wrapper Library
MSAL Angular (@azure/msal-angular)
Wrapper Library Version
None
Public or Confidential Client?
Public
Description
In our enterprise PWA App we try to make use of refreshing the token silently to avoid the users need to re-login after a certain period. For doing this we make sure, that the login.microsoftonline.com domain is added as per the documentation here: https://support.apple.com/en-euro/guide/deployment/depb4c146c2e/web
For just testing this, it's also enough to disable Prevent Cross-Site Tracking in the iPadOS Setting (Attention this is allowing all 3rd party Cookies).
After the user is logged in, we added a button to refresh the token silently to test it out. When trying to refresh silently we get:
"errorCode": "login_required",  "errorMessage": "AADSTS50058: A silent sign-in request was sent but no user is signed in.
Is there anything else we need to take action on or any other parameter to be set?
The user is having a valid session at the moment we invoke the msal method.
Any hints?
Thanks!
Error Message
No response
MSAL Logs
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getActiveAccount: Active account filters schema found
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getAccountKeys called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getAccount called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getTokenKeys called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-common@14.14.2 : Trace - CacheManager - getIdToken called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getIdTokenCredential: cache hit
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-common@14.14.2 : Trace - getAliasesFromMetadata called with source: config
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-common@14.14.2 : Trace - getAliasesFromMetadata called with source: hardcoded_values
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-common@14.14.2 : Trace - getAliasesFromMetadata: found cloud discovery metadata in hardcoded_values, returning aliases
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-common@14.14.2 : Info - CacheManager:getIdToken - Returning ID token
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : @azure/msal-browser@3.23.0 : Verbose - acquireTokenSilent called
main.a9d3d2ba3135d49e.js:2 MSAL 11:07:32 | SilentRequest {  "scopes": [    "URL"  ],  "forceRefresh": false,  "cacheLookupPolicy": 5,  "account": {    "homeAccountId": "homeAccountId",    "environment": "login.windows.net",    "tenantId": "tenantId",    "username": "username",    "localAccountId": "localAccountId",    "name": "name",    "authorityType": "MSSTS",    "tenantProfiles": [      [        "tenantProfiles",        {          "tenantId": "tenantId",          "localAccountId": "localAccountId",          "name": "",          "isHomeTenant": true        }      ]    ],    "idTokenClaims": {      "aud": "...",      "iss": "....",      "iat": 1729162731,      "nbf": 1729162731,      "exp": 1729166631  },    "idToken": "idToken"  }}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : @azure/msal-browser@3.23.0 : Verbose - acquireTokenSilent called for the first time, storing active request
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function acquireTokenSilentAsync
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Info - Emitting event: msal:acquireTokenStart
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Verbose - Emitting event to callback XYZe: msal:acquireTokenStart
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function initializeSilentRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function initializeBaseRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Verbose - Authentication Scheme wasn't explicitly set in request, defaulting to "Bearer" request
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Returning result from initializeBaseRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Returning result from initializeSilentRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - isNativeAvailable called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - isNativeAvailable: allowNativeBroker is not enabled, returning false
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Verbose - acquireTokenSilent - attempting to acquire token from web flow
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function acquireTokenFromCache
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Error occurred in acquireTokenFromCache
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - {"errorCode":"token_refresh_required","errorMessage":"Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.","subError":"","name":"ClientAuthError"}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Info - Emitting event: msal:acquireTokenFromNetworkStart
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Verbose - Emitting event to callback XYZe: msal:acquireTokenFromNetworkStart
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function acquireTokenByRefreshToken
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Error occurred in acquireTokenByRefreshToken
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - {"errorCode":"token_refresh_required","errorMessage":"Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.","subError":"","name":"ClientAuthError"}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : @azure/msal-browser@3.23.0 : Verbose - Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function acquireTokenBySilentIframe
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Executing function silentIframeClientAcquireToken
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function standardInteractionClientInitializeAuthorizationRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - getRedirectUri called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function initializeBaseRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Authentication Scheme set to "Bearer" as configured in Auth request
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from initializeBaseRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Setting validated request account
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from standardInteractionClientInitializeAuthorizationRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - initializeServerTelemetryManager called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function standardInteractionClientCreateAuthCodeClient
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function standardInteractionClientGetClientConfiguration
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function standardInteractionClientGetDiscoveredAuthority
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function authorityFactoryCreateDiscoveredInstance
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function authorityResolveEndpointsAsync
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getAuthorityMetadata: cache hit
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function authorityUpdateCloudDiscoveryMetadata
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Attempting to get cloud discovery metadata  from authority configuration
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Found cloud discovery metadata from hardcoded values.
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from authorityUpdateCloudDiscoveryMetadata
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function authorityUpdateEndpointMetadata
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Attempting to get endpoint metadata from authority configuration
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from authorityUpdateEndpointMetadata
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.setAuthorityMetadata called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from authorityResolveEndpointsAsync
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from authorityFactoryCreateDiscoveredInstance
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from standardInteractionClientGetDiscoveredAuthority
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from standardInteractionClientGetClientConfiguration
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from standardInteractionClientCreateAuthCodeClient
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function silentIframeClientTokenHelper
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function standardInteractionClientInitializeAuthorizationCodeRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function generatePkceCodes
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function generateCodeVerifier
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function getRandomValues
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from getRandomValues
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from generateCodeVerifier
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function generateCodeChallengeFromVerifier
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function sha256Digest
Successfully preconnected to https://login.microsoftonline.com/
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from sha256Digest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from generateCodeChallengeFromVerifier
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from generatePkceCodes
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from standardInteractionClientInitializeAuthorizationCodeRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - isNativeAvailable called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - isNativeAvailable: allowNativeBroker is not enabled, returning false
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function getAuthCodeUrl
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : @azure/msal-common@14.14.2 : Trace - Executing function authClientCreateQueryString
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : @azure/msal-common@14.14.2 : Verbose - createAuthCodeUrlQueryString: Adding login_hint from account
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : @azure/msal-common@14.14.2 : Trace - Returning result from authClientCreateQueryString
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Verbose - Replacing tenant domain name 72e15514-5be9-46a8-8b0b-af9b1b77b3b8 with id {tenantid}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from getAuthCodeUrl
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function silentHandlerInitiateAuthRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function silentHandlerLoadFrameSync
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from silentHandlerLoadFrameSync
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from silentHandlerInitiateAuthRequest
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:32 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function silentHandlerMonitorIframeForHash
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function removeHiddenIframe
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from removeHiddenIframe
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from silentHandlerMonitorIframeForHash
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function deserializeResponse
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Returning result from deserializeResponse
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Executing function handleCodeResponse
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Error occurred in handleCodeResponse
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - {"errorCode":"login_required","errorMessage":"AADSTS50058: A silent sign-in request was sent but no user is signed in. Trace ID: 1b21d5f3-0878-4f5a-ac34-5e1ad9a30a00 Correlation ID: xyzIDxyz Timestamp: 2024-10-17 11:07:33Z","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"","claims":"","errorNo":"50058"}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - Error occurred in silentIframeClientTokenHelper
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [xyzIDxyz] : msal.js.browser@3.23.0 : Trace - {"errorCode":"login_required","errorMessage":"AADSTS50058: A silent sign-in request was sent but no user is signed in. Trace ID: 1b21d5f3-0878-4f5a-ac34-5e1ad9a30a00 Correlation ID: xyzIDxyz Timestamp: 2024-10-17 11:07:33Z","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"","claims":"","errorNo":"50058"}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.getServerTelemetry: cache hit
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - BrowserCacheManager.setServerTelemetry called
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Error occurred in silentIframeClientAcquireToken
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - {"errorCode":"login_required","errorMessage":"AADSTS50058: A silent sign-in request was sent but no user is signed in. Trace ID: 1b21d5f3-0878-4f5a-ac34-5e1ad9a30a00 Correlation ID: xyzIDxyz Timestamp: 2024-10-17 11:07:33Z","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"xyzIDxyz","claims":"","errorNo":"50058"}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Error occurred in acquireTokenBySilentIframe
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - {"errorCode":"login_required","errorMessage":"AADSTS50058: A silent sign-in request was sent but no user is signed in. Trace ID: 1b21d5f3-0878-4f5a-ac34-5e1ad9a30a00 Correlation ID: xyzIDxyz Timestamp: 2024-10-17 11:07:33Z","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"xyzIDxyz","claims":"","errorNo":"50058"}
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Info - Emitting event: msal:acquireTokenFailure
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Verbose - Emitting event to callback XYZe: msal:acquireTokenFailure
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - Error occurred in acquireTokenSilentAsync
main.a9d3d2ba3135d49e.js:2 [Thu, 17 Oct 2024 11:07:33 GMT] : [] : @azure/msal-browser@3.23.0 : Trace - {"errorCode":"login_required","errorMessage":"AADSTS50058: A silent sign-in request was sent but no user is signed in. Trace ID: 1b21d5f3-0878-4f5a-ac34-5e1ad9a30a00 Correlation ID: xyzIDxyz Timestamp: 2024-10-17 11:07:33Z","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"xyzIDxyz","claims":"","errorNo":"50058"}
main.a9d3d2ba3135d49e.js:2 MSAL 11:07:33 | Error 3rd party cookies {  "errorCode": "login_required",  "errorMessage": "AADSTS50058: A silent sign-in request was sent but no user is signed in. Trace ID: 1b21d5f3-0878-4f5a-ac34-5e1ad9a30a00 Correlation ID: xyzIDxyz Timestamp: 2024-10-17 11:07:33Z",  "subError": "",  "name": "InteractionRequiredAuthError",  "timestamp": "",  "traceId": "",  "correlationId": "xyzIDxyz",  "claims": "",  "errorNo": "50058"}
writeToConsole @ main.a9d3d2ba3135d49e.js:2
error @ main.a9d3d2ba3135d49e.js:2
(anonymous) @ main.a9d3d2ba3135d49e.js:2
(anonymous) @ main.a9d3d2ba3135d49e.js:2
(anonymous) @ main.a9d3d2ba3135d49e.js:2
error @ main.a9d3d2ba3135d49e.js:2
_error @ main.a9d3d2ba3135d49e.js:2
error @ main.a9d3d2ba3135d49e.js:2
onInvoke @ main.a9d3d2ba3135d49e.js:2
run @ polyfills.d75bcda12191eee1.js:2
(anonymous) @ polyfills.d75bcda12191eee1.js:2
onInvokeTask @ main.a9d3d2ba3135d49e.js:2
runTask @ polyfills.d75bcda12191eee1.js:2
K @ polyfills.d75bcda12191eee1.js:2
invokeTask @ polyfills.d75bcda12191eee1.js:2
Network Trace (Preferrably Fiddler)

[x] Sent
[X] Pending

MSAL Configuration
const request: SilentRequest = {
      scopes: this.environmentService.getEnvironment().auth.scopes,
      forceRefresh,
      cacheLookupPolicy,
      account: this.msalService.instance.getActiveAccount() || undefined
    };

test3rdPartyCookies(): Observable<ThirdPartyCookieTestResult> {
    return this.msalService.acquireTokenSilent(this.getSilentRequest(false, CacheLookupPolicy.Skip)).pipe(
      map(authResult => ({ result: true, data: this.logService.cleanObjectAndStringify(authResult) })),
      catchError(error => {
        this.logService.error('Error 3rd party cookies', LogCategory.MSAL, [error]);
        return of({ result: false, data: this.logService.cleanObjectAndStringify(error) });
      })
    );

Relevant Code Snippets
const request: SilentRequest = {
      scopes: this.environmentService.getEnvironment().auth.scopes,
      forceRefresh,
      cacheLookupPolicy,
      account: this.msalService.instance.getActiveAccount() || undefined
    };

test3rdPartyCookies(): Observable<ThirdPartyCookieTestResult> {
    return this.msalService.acquireTokenSilent(this.getSilentRequest(false, CacheLookupPolicy.Skip)).pipe(
      map(authResult => ({ result: true, data: this.logService.cleanObjectAndStringify(authResult) })),
      catchError(error => {
        this.logService.error('Error 3rd party cookies', LogCategory.MSAL, [error]);
        return of({ result: false, data: this.logService.cleanObjectAndStringify(error) });
      })
    );

Reproduction Steps

On iPadOS Safari setting allow 3rd party cookies. Disable Prevent Cross-Site Tracking (In an enterprise environment this can be done specifially for some domains (i.e. login.microsoftonline.com).
Login into your PWA app
Try to invoke acquireTokenSilent by setting the Cachepolicy to CacheLookupPolicy.Skip (Making sure it's skipping the cache).

Expected Behavior
We would expect the token to be refresehd without any user interaction
Identity Provider
Entra ID (formerly Azure AD) / MSA
Browsers Affected (Select all that apply)
Safari
Regression
No response

One more addition from our side.
When testing the app on iOS 18 inside Chrome - the token acquireTokenSilent works.
On Safari (Our default Browser) I see there are no Cookies stored in this regards, this could answer the question why the error message points out that there is no user logged in.
Is there any way to make sure the needed Cookies are stored?
We enabled storeAuthStateInCookie, but still no Cookies stored in Safari.


text:
Add node 16 support

Adds Node 16 to supported versions

Codecov Report

Merging #6656 (7cab9df) into dev (81d34b4) will decrease coverage by 4.27%.
Report is 378 commits behind head on dev.
The diff coverage is n/a.

Flag
Coverage Δ

msal-angular
?

msal-browser
?

msal-common
?

msal-core
?

msal-node
80.72% <ø> (-2.67%)
:arrow_down:

msal-node-extensions
?

msal-react
?

node-token-validation
?

see 235 files with indirect coverage changes

authors: codecov-commenter tnorling


text:
Clicking to purchase a tile works inconsistently

When I click a city and bring up the city view, I see the purchasable tiles, but actually purchasing them can be a bit of a challenge at times. It seems to take 2 clicks on average, sometimes 3-5 clicks, sometimes 1.

OS: Windows 10
Version: 1.0.0.290
Expansions: All expansions and DLC, including Rise & Fall, and Gathering Storm
Other mods: None

I seem to recall this issue being present in CQUI before Gathering Storm, I just shrugged it off as my misclicking. Vanilla is buttery smooth in comparison.
Related to #216?

Yes, it's related, also related to the rewrite in https://github.com/Azurency/CQUI_Community-Edition/commit/6ea61cf772396869cf0fe1bef019c08cacbc10a6#diff-3cebae74c7703440c01145d16ef5ea6cR102 of plotinfo_CQUI.lua using LuaEvents.CQUI_StartDragMap()

Should be fixed now in the latest version

Tested it with new Steam Version which includes the fix.
Clicking to purchase tiles worked about 80-90% of the time in my new test. Purchased a 100 or so tiles.  While CQUI was the only mod I used during the test, I used an old saved game file which had a lot of mods associated with it. No issue with fresh game perhaps? Haven't tried that yet.
Even if a fresh game were to give same result. It's A LOT better.

80-90% 👀. Are you sure the 20-10% times it's not working that you're not dragging the map a little ? It should buy the plot when you click on the button unless you're dragging to avoid unwanted purchase.

Just finished testing it again. Bound mouse click to keyboard this time. If I take my hand of the mouse, before clicking with my keyboard, issue's gone. As for clicking with mouse, I was buying up tiles quickly in previous test. If I'm a little more careful while mouse clicking, it may happen 5% of the time?
Seems very sensitive to mouse drag, which I understand is to prevent accidental tile purchases. Having said that, I'd consider this resolved.

authors: Azurency ubereffect


text:
Update stats

Allan valide please

ton code est bon chef


text:
modify CSM merge for non datetime subsytems

Changes
allow time dependent subsystems that don't use absolute times to be merged into CSM instances with a set reference time
Related Issues
Closes # (add issue numbers)
Checks

[ ] updated CHANGELOG.md
[ ] updated tests
[ ] updated doc/
[ ] update example/tutorial notebooks

@vhirtham the problem is cause when csm.uses_absolute_times is true (there is some DateTimeIndex involved) but  csm.reference_time is false (there is no reference time set on a CSM level)
I think this can only happen with a single reference_time LCS involved but not sure about the checks
This fix will return a valid pd.DateTimeIndex in these cases

@vhirtham changed error behavior of csm.merge() as discussed

repo: BAMWelDX/weldx


text:
Gene-of-Interest List Includes Genes with No Counts, Causing FeaturePlot Failure

The list of genes of interest provided by the user may contain an existing gene in the file features.tsv.gz, but with no count.
This results in an issue with creating the plots at the end of DEA.
The gene is not removed from the goiList, but the function FeaturePlot can't find it in the dataset (as there was no count, the feature has been deleted).

The gene_of_interest is used in few files:
/scDataPipeline $ grep -in genes_of_interest *
00_pipeline_launcher.R:700:    genes_of_interest = if (exists("PATH_GENES_OF_INTEREST")) PATH_GENES_OF_INTEREST else NULL
05_annotDEAviz_pipeline.Rmd:148:if (!is.null(genes_of_interest)) {
05_annotDEAviz_pipeline.Rmd:149:    checkPath(genes_of_interest)
05_annotDEAviz_pipeline.Rmd:166:if (!is.null(genes_of_interest)) {
05_annotDEAviz_pipeline.Rmd:167:    checkPath(genes_of_interest)
05_annotDEAviz_pipeline.Rmd:266:```{r load-goi-list, eval=!is.null(genes_of_interest), echo=!is.null(genes_of_interest)}
05_annotDEAviz_pipeline.Rmd:268:goi <- readLines(genes_of_interest)
05_annotDEAviz_pipeline.Rmd:450:if(!is.null(genes_of_interest)){
globalParameters_MODEL_2_combined.toml:30:PATH_GENES_OF_INTEREST = "XXXXX"              # path from the PATH_ROOT to the list of genes of interest
globalParameters_MODEL_single.toml:32:PATH_GENES_OF_INTEREST = "XXXXX"          # path from the PATH_ROOT to the list of genes of interest
load_parameters.R:46:    assignPath("PATH_GENES_OF_INTEREST", path$input$PATH_GENES_OF_INTEREST)
README.md:102:PATH_GENES_OF_INTEREST = "XXXXX"          # path to the list of specific genes of interest (text file with one gene per line), usually in $PATH_ROOT/01_requirements.

repo: BAUDOTlab/scDataPipeline