Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WAM with UI requires password auth to be used #5049

Closed
jformacek opened this issue Jan 4, 2025 · 1 comment
Closed

WAM with UI requires password auth to be used #5049

jformacek opened this issue Jan 4, 2025 · 1 comment
Labels
needs attention Delete label after triage public-client untriaged Do not delete. Needed for Automation

Comments

@jformacek
Copy link

Library version used

4.66.0

.NET version

.NET8

Scenario

PublicClient - desktop app

Is this a new or an existing app?

None

Issue description and reproduction steps

Hello, I wanted to ask for guidance with WAM and FIDO/passwordless:

  • basically using the way as described in example here (just without cache): https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.publicclientapplication?view=msal-dotnet-latest
  • when using with WAM and different account than my own Windows account (account from different tenant), I get MsalUIRequiredException, call AcquireTokenInteractive() and get UI with built-in webWiev
  • UI gets displayed, offering various methods of authentication:
    image
  • however only password-based auth works. When selecting 'Use your face, fingerprint, PIN, or security key instead' option, then error occurs:
    image
  • even after entering the password, conditional access requires MFA, and again, option 'Face, fingerprint, PIN, or security key' does not work, producing the same error - at least I can use Azure Authenticator to verify my account
    image

Getting the same behavior when logging in to Windows App to get access to my W365 desktop in different tenant - so I believe this is not just problem with my code.

I'm wondering what is and is not supported with WAM and passwordless when UI gets required for authentication. FIDO itself works fine for me with other authentication flows (e.g. Interactive login via Edge browser).

Relevant code snippets

No response

Expected behavior

'Face, fingerprint, PIN, or security key' option works when WAM shows an UI

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

Authenticate with password and provide 2nd factor by other MFA method than FIDO

@jformacek jformacek added needs attention Delete label after triage untriaged Do not delete. Needed for Automation labels Jan 4, 2025
@jformacek
Copy link
Author

Closing as it fixed itself after few reboots - problems most likely caused by some local issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs attention Delete label after triage public-client untriaged Do not delete. Needed for Automation
Projects
None yet
Development

No branches or pull requests

1 participant