Comments (24)
I know this thread has been closed for a while, but installing the module first thing was an unreliable fix due to my environment. Adding a "-AzureCloudInstance 1" to the function call fixed it.
So my code became:
Get-MsalToken -ClientId $ClientId -TenantId $TenantId -ClientSecret $ClientSecret -AzureCloudInstance 1
from msal.ps.
I added the following code instead on line 338, and this seems to do the trick with object structure conflicts.
elseif ($TenantId) {
if( Get-Member -InputObject $ClientApplication.AppConfig -Name "AuthorityInfo" -MemberType Properties )
{
[void] $AquireTokenParameters.WithAuthority(('https://{0}' -f $ClientApplication.AppConfig.AuthorityInfo.Host), $TenantId)
}
else
{
[void] $AquireTokenParameters.WithAuthority(('https://{0}' -f $ClientApplication.AppConfig.Authority.AuthorityInfo.Host), $TenantId)
}
}
from msal.ps.
For those who are able to reproduce this, do you have any profile scripts that auto-run or other modules imported before importing MSAL.PS? MSAL.PS will allow you to use an old version of the dll libraries if they are already imported into the session. This is a common issue with the Az modules. MSAL.PS should prompt you though when this dll conflict occurs allowing you to proceed but warning you that some functionality might not work correctly.
from msal.ps.
I replaced line 338 in the module with below and it works for me
elseif ($TenantId) { [void] $AquireTokenParameters.WithAuthority(('https://{0}' -f $ClientApplication.AppConfig.AuthorityInfo.Host), $TenantId) }
from msal.ps.
I'm running MSAL.PS in one location for both 5.1 and 7.2.
Usually when the error crops up is when I switch between the runtimes, though have not spent to much time understanding where the problem comes from.
I did a debug through VSCode and saw that the $ClientApplication substructure was a bit different when it errors out.
Guess that might be because different Microsoft.Identity.Client.dll are loaded into 5.1 and 7.2.
Compensating for the object structure difference, I did not get any other errors and the token was received as expected.
from msal.ps.
Because 1) IMO this functionality should work in such a module, and 2) I'd rather update an module than code.
from msal.ps.
I know this thread has been closed for a while, but installing the module first thing was an unreliable fix due to my environment. Adding a "-AzureCloudInstance 1" to the function call fixed it.
So my code became:
Get-MsalToken -ClientId $ClientId -TenantId $TenantId -ClientSecret $ClientSecret -AzureCloudInstance 1
My man, you are a life saver! This worked for me as well. Thank you.
from msal.ps.
Hi Hal37,
Had the same issue using this line:
$Token = (Get-MsalToken -ClientId ($Config.ScriptMainConfig.TenantConfig.clientId) -TenantId ($Config.ScriptMainConfig.TenantConfig.tenantId) -ClientCertificate $thumbPrint).AccessToken
To resolve this, while waiting for an answer from Repo's maintainer, I opened the file Get-MsalToken.ps1 in the module folder and just commented the elseif line:
"*" {
if ($AzureCloudInstance -and $TenantId) { [void] $AquireTokenParameters.WithAuthority($AzureCloudInstance, $TenantId) }
elseif ($AzureCloudInstance) { [void] $AquireTokenParameters.WithAuthority($AzureCloudInstance, 'common') }
#elseif ($TenantId) { [void] $AquireTokenParameters.WithAuthority(('https://{0}' -f $ClientApplication.AppConfig.Authority.AuthorityInfo.Host), $TenantId) }
if ($Authority) { [void] $AquireTokenParameters.WithAuthority($Authority.AbsoluteUri) }
Hope this will help you to run the script with the latest version
from msal.ps.
+1 Same for me. (Context: Internal Microsoft / Office tooling) Goods news: I'm the only one on my team reproing this so far. Bad news: This is a pretty blocking issue for me - reproing across accounts, machines, and scenarios.
from msal.ps.
Ok, digging further, it looks like there was a change to the Microsoft.Identity.Client package that modified the members of ClientApplicationBase to put an Authority member and nest the existing AuthorityInfo member under that. Check your installed version using Get-Package Microsoft.Identity.Client. I had 4.16.0 installed and encountered this same error.
from msal.ps.
It looks like the module directory has compatible versions of the Microsoft.Identity.Client dlls in it. Is it possible that, if an older version was installed using Install-Package, that Powershell is loading the dlls from the older package instead of the module directory?
from msal.ps.
I was able to fix this by uninstalling any older nuget packages for Microsoft.Identity.Client and then uninstalling and reinstalling the MSAL.PS module.
from msal.ps.
Interesting... I don't think that I have such a package installed?
PS C:\WINDOWS\system32> Get-Package Microsoft.Identity.Client
Get-Package : No package found for 'Microsoft.Identity.Client'.
from msal.ps.
Interesting... I don't think that I have such a package installed?
PS C:\WINDOWS\system32> Get-Package Microsoft.Identity.Client Get-Package : No package found for 'Microsoft.Identity.Client'.
I'm not sure if PS will return different results depending on if it's running as admin or not like it does with modules, but that is a possibility. If you check both and don't see it I'm not sure where it would be loading from, but an older version has to be the cause. There was definitely a change to the ClientApplicationBase object that the ConfidentialClientApplication inherits from that added the Authority member and moved the AuthorityInfo under it. I'm not sure what version that was though. The New-MSALToken cmdlet changed that reference on line 338 in the latest update and that's definitely what we're seeing with this error.
As a test, you could try opening a new PS instance and use Add-Type to load the two dlls in the modules directory to load the proper version before importing the module and see if that somehow helps.
Hopefully a developer will be able to shed more light on this.
from msal.ps.
Hi,
I tried your suggestion to add those DLL's directly but it did not change on my end... But perhaps I did not load the correct ones?
MSAL.PS\4.37.0.0\Microsoft.Identity.Client.4.37.0\net45\Microsoft.Identity.Client.dll
MSAL.PS\4.37.0.0\Microsoft.Identity.Client.Desktop.4.37.0\net461\Microsoft.Identity.Client.Desktop.dll
from msal.ps.
Got the same problem in my script. The reason was ExchangeOnlineManagement
module. One of its cmdlet was called before Get-MsalToken
therefore the MSAL.PS
module was not imported as first.
I had to explictly put Import-Module MSAL.PS
at the top of file (or just before using any other cmdlet which could load different module).
from msal.ps.
I too ran into the issue with the collision of ExchangeOnlineManagement and Get-MSALToken. The simple solution was to use Get-MSALToken in a fresh PowerShell session.
from msal.ps.
The same issue also exist using MSAL.PS with the MicrosoftTeams module.
At the moment I'm using version 4.36.1.2 of MSAL.PS without issue, but new version does not work.
I'm using MSAL with SP and a AAD user for delegated permissions.
In a fresh powershell (5.1) session i need to run:
Import-Module MSAL.PS -MaximumVersion 4.36.1.2 -ErrorAction Continue -ErrorVariable oErr -Verbose:$false
if($oErr)
{
Write-Error -Message "Failed to import supporten module version of: MSAL.PS" -ErrorAction Stop
}
Import-Module MicrosoftTeams -MaximumVersion 3.0.0 -ErrorAction Continue -ErrorVariable oErr -Verbose:$false
if($oErr)
{
Write-Error -Message "Failed to import supporten module version of: MicrosoftTeams" -ErrorAction Stop
}
Commenting out line 338 worked and I get a token, replacing the code with what @JBines suggested does not work for my scenario.
Also commenting out the code on line 338 I can run with the latest version of both MSAL.PS and MicrosoftTeams for combined SP and delegated AAD user.
$GraphConnectionDetails = @{
'TenantId' = $AzureConnection.TenantId
'ClientId' = $AzureConnection.ApplicationId
'UserCredential' = $TeamsServiceAccount
'Scope' = $GraphScope
'RedirectURI' = $RedirectURI
}
from msal.ps.
Could it be related to assembly dependency conflicts?
- https://docs.microsoft.com/en-us/powershell/scripting/dev-cross-plat/resolving-dependency-conflicts?view=powershell-7.2
- PowerShell/PowerShell#2083
I was checking out MSAL.PS today for replacing following code for generating access token with app id and secret only:
# Settings
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
# Assets
$AppRegistration = [pscredential](Get-Credential -Message 'App Id and secret')
$TenantInitialDomain = [string] '<your_initial_domain>.onmicrosoft.com'
$TenantId = [string](
(Invoke-RestMethod -Uri ('https://login.microsoftonline.com/{0}/.well-known/openid-configuration'-f$TenantInitialDomain) -Method 'Get').'userinfo_endpoint'.Split('/')[3]
)
$Body = [hashtable]@{
'client_id' = $AppRegistration.'Username'
'client_secret' = $AppRegistration.GetNetworkCredential().'Password'
'scope' = 'https://graph.microsoft.com/.default'
'grant_type' = 'client_credentials'
}
# Get access token
$AccessToken = Invoke-RestMethod -Method 'Post' ('https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $TenantId) -Body $Body
# Example use - Connect with Microsoft.Graph.Authentication
$null = Connect-MgGraph -AccessToken $AccessToken.'access_token'
But got the "The property 'Authority' cannot be found on this object" error. I added the code here as it might be helpful for others in same situation. Until MSAL.PS get's up and running again.
from msal.ps.
@mortenlerudjordet your post as of 9 days ago (Mar-12?) looks like a good work around.
@jasoth / @apurvghai : do you know what the release process for this project is?
from msal.ps.
On the off chance is anyone having this issue after importing Graph modules? I just discovered that I get this error if I run any of the following commands before running Get-MSALToken. I'm assuming it's going to be any Graph modules though.
Select-MgProfile -Name "beta"
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Identity.Signins
Import-Module Microsoft.Graph.Authentication
It appears this also happens when using the Connect-PnPOnline module.
I need to run the Get-MSALToken command before anything else in order to avoid this error. This is a better workaround for those who don't want to modify the module file.
from msal.ps.
@agrecaBAS, I import MSAL before graph and that seems to not give me the error
from msal.ps.
This error and numerous others can happen when the DLLs included with MSAL.PS cannot be loaded due to a conflict with another DLL loaded in the current PowerShell session, often from another module like Azure or Exchange Online Admin Shell.
You should see the following prompt during import when this occurs and as the message indicates, "Some module functionality will not work."
Ignore assembly conflict and continue importing module?
Some module functionality will not work.
[Y] Yes [N] No [?] Help (default is "N"):
As a workaround, I would suggest ensuring that the MSAL.PS module is loaded into the PowerShell session first before any other modules. There is a fix to this but it would require significant rework of the MSAL.PS module in C# so no guarantee this will be addressed anytime soon, if ever.
from msal.ps.
(This didn't thread correctly? Not sure how to comment on a closed issue..)
Source: #45 (comment)
I was checking out MSAL.PS today for replacing following code for generating access token with app id and secret only:
[....]
But got the "The property 'Authority' cannot be found on this object" error. I added the code here as it might be helpful for others in same situation. Until MSAL.PS get's up and running again.
Can you explain why you care about MSAL.PS if the workaround code in your comment does the job required?
$AppID = ...
$AppSecret = ...
$TenantID = ...
$Body = [hashtable]@{
'client_id' = $AppID
'client_secret' = $AppSecret
'scope' = 'https://graph.microsoft.com/.default'
'grant_type' = 'client_credentials'
}
$AccessToken = Invoke-RestMethod -Method 'Post' `
('https://login.microsoftonline.com/{0}/oauth2/v2.0/token' `
-f $TenantId) -Body $Body
# Connect with Microsoft.Graph.Authentication
Connect-MgGraph -AccessToken $AccessToken.'access_token'
This works, and I don't need to load any additional modules. I have no idea what is "wrong" with doing this vs using Get-MsalToken..
from msal.ps.
Related Issues (20)
- IntegratedWindowsAuth example? HOT 4
- MSAL token provided only works with MS Graph HOT 1
- Support WAM as an Authentication Method
- Get-MsalToken fails to launch interactive authentication prompt from Windows Terminal HOT 4
- replace load of PS1 files in psd1 by a main psm1 loading the ps1 HOT 3
- -Scope or -Scopes? HOT 1
- Import Module fails when home./config is not present HOT 1
- Missing Get-MsalToken in version 4.37.0.0 HOT 1
- New-MsalClientApplication : Cannot convert argument "builder" HOT 4
- MSAL.PS in Azure Automation with 7.2 Runbook
- Get-MsalToken fails for some users, references a .NET in error message. HOT 3
- New-MsalClientApplication : Cannot convert argument "builder" HOT 4
- "Microsoft.Identity.Client.dll" conflicts w/same assembly from ExchangeOnlineManagement module HOT 3
- I get this error with Select-MsalClientApplication.ps1
- Import-Module MSAL.PS retrieve errors
- Primary refresh token missing in WebView2, unable to authenticate HOT 4
- Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\MSAL.PS\4.37.0.0\Microsoft.Identity.Client.4.37.0\net45\Microsoft.Identity.Client.dll' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
- Use with different ResourceUri's? HOT 2
- Unable to convert .cert file to type X509Certificates.X509Certificate2
- Version of Microsoft.Identity.Client is significantly dated
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from msal.ps.