az login WSL 2 Ubuntu 18.04 does not open browser: Detect no GUI is available, so fall back to device code

[nbihan-mediware]

Describe the bug
When running command az login web browser won't open.
Running on verbose mode

az login --verbose
Detect no GUI is available, so fall back to device code
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code GFHKIOWYA to authenticate.

To Reproduce
Run az login on WSL 2 Ubuntu 18.04

Expected behavior
Default browser opens on AZ login page.

Environment summary
Windows 10 Pro 2004

WSL 2 Ubuntu 18.04

uname -a
Linux MY-COMPUTER 4.19.104-microsoft-standard #1 SMP Wed Feb 19 06:37:35 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

az --version
azure-cli                         2.10.0

command-modules-nspkg              2.0.3
core                              2.10.0
nspkg                              3.0.4
telemetry                          1.0.4

Python location '/opt/az/bin/python3'
Extensions directory '/home/nico/.azure/cliextensions'

Python (Linux) 3.6.10 (default, Jul 31 2020, 08:33:11)
[GCC 7.5.0]

Additional context
Running

powershell.exe -Command 'Start-Process https://github.com/Azure/azure-cli/issues'

opens successfully the browser on the Azure CLI issues page.

[yonzhan]

add to S174

[jiasli]

We currently haven't developed and tested on WSL 2, so it is not supported yet. For now, you may use

az login --use-device-code

[nbihan-mediware]

@yonzhan, maybe I missed it, but was there any actual resolution?

[yonzhan]

This feature is currently not supported in CLI and you can use the workaround provided by @jiasli . If you do want this, we can consider planning it in our backlog. Due to a bunch of high priority features, we do not have bandwidth to support it currently. Thanks for your understanding.
Please let me know if you have any further questions.

[nbihan-mediware]

I totally understand the priorities but a bit disappointing to see no support for WSL2 when Microsoft is now backporting it to Windows 10 19.09 and 19.03.
I think the bug is rather simple and resides in the way the CLI is detecting WSL vs WSL2, and fall back in the default behavior.

[jiasli]

Let me reopen it and put it into our roadmap.

[schundu9]

Just use below - its Display issue
DISPLAY=:0 az login

[jiasli]

@schundu9, setting DISPLAY=:0 is basically hacking into this line

azure-cli/src/azure-cli-core/azure/cli/core/util.py

Line 692 in 25912fd

gui_env_vars = ['DESKTOP_SESSION', 'XDG_CURRENT_DESKTOP', 'DISPLAY']

to force env var DISPLAY to exist and trick Azure CLI that it is run in a Linux desktop environment.

Not only :0 works, but anything works, like DISPLAY=foo az login.

However, it will trigger a warning:

tcgetpgrp failed: Not a tty

⚠ This is not the supported way to launch browser in WSL 2.

[jackcoleman-iex]

Any updates on this? Still running into this issue in WSL2

[jiasli]

@jackcoleman-iex, this issue has long been solved. 😊

Could you share the error message you see and the --debug log?

[adriancuadrado]

I am running into the same issue, except because I am using Ubuntu 20.04 and I used to have this working. I don't know why today it doesn't work. @jiasli this is the output I get with --debug:

$ az login --debug
cli.knack.cli: Command arguments: ['login', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7fe6baa57b70>, <function OutputProducer.on_global_arguments at 0x7fe6ba98b730>, <function CLIQuery.on_global_arguments at 0x7fe6ba9a9840>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'login': ['azure.cli.command_modules.profile']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: profile                   0.002         2         9
cli.azure.cli.core: Total (1)                 0.002         2         9
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
cli.azure.cli.core: next                      0.134         1         1  /home/adrian/.azure/cliextensions/next
cli.azure.cli.core: Total (1)                 0.134         1         1
cli.azure.cli.core: Loaded 2 groups, 10 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : login
cli.azure.cli.core: Command table: login
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7fe6ba4206a8>]
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x7fe6ba3ab620>, <function register_global_query_examples_argument.<locals>.register_query_examples at 0x7fe6ba314158>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x7fe6ba3141e0>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x7fe6ba3142f0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7fe6ba98b7b8>, <function CLIQuery.handle_query_parameter at 0x7fe6ba9a98c8>, <function register_global_query_examples_argument.<locals>.handle_example_parameter at 0x7fe6ba3140d0>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x7fe6ba314268>]
cli.azure.cli.core.auth.persistence: build_persistence: location='/home/adrian/.azure/msal_token_cache.json', encrypt=False
cli.azure.cli.core.auth.identity: _load_msal_http_cache: /home/adrian/.azure/msal_http_cache.bin
cli.azure.cli.core.auth.identity: __load_msal_http_cache: /home/adrian/.azure/msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/organizations/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/{tenantid}/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/organizations/kerberos', 'tenant_region_scope': None, 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
cli.azure.cli.core.auth.identity: The default web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.
msal.telemetry: Generate or reuse correlation_id: 4d0017f7-035e-4f73-859a-a66de419b907
msal.oauth2cli.oauth2: Using http://localhost:36447 as redirect_uri
msal.oauth2cli.authcode: Abort by visit http://localhost:36447?error=abort
msal.oauth2cli.authcode: Open a browser on this device to visit: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=04b07795-8ddb-461a-bbee-02f9e1bf7b46&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A36447&scope=https%3A%2F%2Fmanagement.core.windows.net%2F%2F.default+offline_access+openid+profile&state=tlmaEfyBGXiFOSKu&code_challenge=v6ou-m-dugIcPRCLsR4XplGkeTnuyPMN0076ohI6590&code_challenge_method=S256&nonce=04c6681747e0bedb5c40f22ac9ef1a8ce3404ee014916177c1a7ae324475ed26&client_info=1&prompt=select_account

[adriancuadrado]

Oh crap now I got the web browser opening. It took surprisingly long. More surprising is the fact that it opened long after I pressed Ctrl+C to kill the process. Weird.

[jiasli]

Oh crap now I got the web browser opening. It took surprisingly long. More surprising is the fact that it opened long after I pressed Ctrl+C to kill the process. Weird.

Azure CLI uses MSAL which uses Python's built-in library webbrowser to open the browser on host Windows:

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/c7e81baf0fb807182e39293711c4bce8f22155a7/msal/oauth2cli/authcode.py#L51-L71

def _browse(auth_uri, browser_name=None):  # throws ImportError, webbrowser.Error
    """Browse uri with named browser. Default browser is customizable by $BROWSER"""
    import webbrowser  # Lazy import. Some distro may not have this.
    if browser_name:
        browser_opened = webbrowser.get(browser_name).open(auth_uri)
    else:
        # This one can survive BROWSER=nonexist, while get(None).open(...) can not
        browser_opened = webbrowser.open(auth_uri)

    # In WSL which doesn't have www-browser, try launching browser with PowerShell
    if not browser_opened and is_wsl():
        try:
            import subprocess
            # https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe
            # Ampersand (&) should be quoted
            exit_code = subprocess.call(
                ['powershell.exe', '-NoProfile', '-Command', 'Start-Process "{}"'.format(auth_uri)])
            browser_opened = exit_code == 0
        except FileNotFoundError:  # WSL might be too old
            pass
    return browser_opened

webbrowser.open internally uses www-browser to launch a browser. If you see any problem with it, you may report to WSL at https://github.com/microsoft/WSL/issues

[abdur-n-tr]

I was facing same issues on WSL2 with ubuntu 22.04 but I figure out using the below command.

az login --debug

when you will run this command in wsl2 or on ubuntu application in windows, it will open some other window, in my case I just press key q to come out of that window and then you will see detailed logs. At the end of logs, you will see a log line like this: Open a browser on this device to visit

this line will contain link to login and authenticate, just copy and hit into browser and it will authenticate you. Also, important this is that think link must contain client_id, if it is not there then your issue might be different.

[jiasli]

Hi @abdurrehman11, I am not aware of a window/app that allows you to press q. Could you share a screenshot?

[ianphil]

This helped me out: Azure/azure-dev#2291 (comment)