Getting "Unable to get authority configuration" Error when Authority is properly sent

[AlmogBentz]

Describe the bug
We are using MSAL in production environment in out first party application.
we are using ConfidentialClientApplication with certificate.

in the logs I see this error popping up:
"ValueError: Unable to get authority configuration for https://login.microsoftonline.com/. Authority would typically be in a format of https://login.microsoftonline.com/your_tenant_name"
(I removed the AAD context id for privacy here)

for exactly the same context-id from AAD the same request with the same authority url can pass multiple times and then randomly fail with the same message.

Expected behavior
if this is an error that is not caused by the authority url input but by something else the message returned should be different.
we need to be able to differentiate the types of errors, so that if this is caused by something transient we can ignore it.

The MSAL Python version you are using
msal version is 1.5.0

[rayluo]

Expected behavior
if this is an error that is not caused by the authority url input but by something else the message returned should be different.
we need to be able to differentiate the types of errors, so that if this is caused by something transient we can ignore it.

That is an understandable ask. We currently provide a most-likely cause which would help your app's development/onboarding, but, admittedly, that message does not help for in-production errors, especially those transient.

Would it help if we change that error message to something like this?

ValueError: Unable to get authority configuration for https://login.microsoftonline.com/.... If you see this during your app development, make sure you use a correct authority. Authority would typically be in a format of https://login.microsoftonline.com/your_tenant_name If you see this as a transient error in production, you can enable debug log and find the actual endpoint and start your troubleshooting there.

PS: There would probably NOT be a "how to enable debug log" in that already-long error message, but you can enable debug log of your app like this, and you will find a log like this, right before the aforementioned exception.

DEBUG:urllib3.connectionpool:https://login.microsoftonline.com:443 "GET /YOUR_TENANT_HERE/v2.0/.well-known/openid-configuration HTTP/1.1" 200 1651

Then you can start your troubleshooting by manually visiting such url https://login.microsoftonline.com:443/YOUR_TENANT_HERE/v2.0/.well-known/openid-configuration and see what it returns.

By the way, based on your other message "the same request with the same authority url can pass multiple times and then randomly fail with the same message", it seems to be a transient error that this library can not directly help. Again, would the new error message above help?

[AlmogBentz]

yes that would be good, I was hoping that you could do one step further and distinguish between the errors by perhaps adding a validation on your side so you could throw different types of errors for client fault.
this would really help in knowing when there should be a retry mechanism and when not

[rayluo]

@AlmogBentz Fair enough. We may revisit this to see what we can do here. Meanwhile, do you happen to have a response that you captured when that transient error still occurred? i.e. when visiting https://login.microsoftonline.com:443/YOUR_TENANT_HERE/v2.0/.well-known/openid-configuration, what was the http response status code, and what was the http response content? Currently we know a successful HTTP 200 response, an expected HTTP 400 error when a tenant does not exist, and I assume your transient would be an HTTP 5xx error?

[txwizard]

On 22 October 2021, @rayluo mentioned that there is a HTTP 400 response when a tenant does not exist. However, following the link in his previous comment of 15 October 2020 to Enable Debug Log of Your App, I notice a comment under the endpoint node in the configuration JSON to the effect that you must declare User.Read.All scope. Wouldn't absence of that scope elicit the same HTTP response?