Repository: AzureAD/microsoft-authentication-library-for-dotnet

Issue #2839: [Bug] Browser pop up failed but no exception throws when Browser is no permission to run
Created: 2021-08-24T09:54:02Z
Logs and network traces
Without logs or traces, it is unlikely that the team can investigate your issue. Capturing logs and network traces is described in Logging wiki.
Which version of MSAL.NET are you using?

MSAL 4.30.1
Platform

.NET Core
What authentication flow has the issue?

Desktop / Mobile

 Interactive
 Integrated Windows Authentication
 Username Password
 Device code flow (browserless)


Web app

 Authorization code
 On-Behalf-Of


Daemon app

 Service to Service calls



Other?


Installed Firefox 91.0.1 (64-bit) on Ubuntu 20.04.2 LTS machine as default browser
Installed PowerShell 7.1.4 and Latest Az on PowerShell

Is this a new or existing app?

existing app
Repro
sudo pwsh
PowerShell 7.1.4
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.

PS /home/user> Connect-AzAccount          
DEBUG: Sought all Az modules and got latest version 6.3.0
DEBUG: 2:53:28 PM - ConnectAzureRmAccountCommand begin processing with ParameterSet 'UserWithSubscriptionId'.
DEBUG: 2:53:28 PM - Autosave setting from startup session: 'CurrentUser'
DEBUG: 2:53:28 PM - No autosave setting detected in environment variable 'AzContextAutoSave'. 
DEBUG: 2:53:28 PM - Using Autosave scope 'CurrentUser'

Then the whole process is blocked.
Expected behavior
Pop up a website to login account or tell the reason why can't pop up.
Actual behavior
The whole process is blocked.  PowerShell hangs with high CPU load. No popup is shown.
Possible solution

User installed browser as nonroot app. So when user used an elevated pwsh to call browser, this behavior is not allowed in this case. But MSAL didn't catch this case. A pre-detection should be done or the error should be thrown out.
Additional context / logs / screenshots
Add any other context about the problem here, such as logs and screenshots.
Run another pop-up command provided this error: Running Firefox as root in a regular user's session is not supported.
$ sudo pwsh
[sudo] password for user: 
PowerShell 7.1.4
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.

PS /home/user> Import-Module Az           
PS /home/user> Send-Feedback

Want to provide feedback about Azure PowerShell? Take a quick survey and let us know how we are doing: https://aka.ms/azpssurvey?Q_CHL=FEEDBACK. Do you want to open the link? (Y/N)

y

Running Firefox as root in a regular user's session is not supported.  ($XAUTHORITY is /run/user/1000/gdm/Xauthority which is owned by user.)
Running Firefox as root in a regular user's session is not supported.  ($XAUTHORITY is /run/user/1000/gdm/Xauthority which is owned by user.)
Running Firefox as root in a regular user's session is not supported.  ($XAUTHORITY is /run/user/1000/gdm/Xauthority which is owned by user.)
/usr/bin/xdg-open: 869: iceweasel: not found
/usr/bin/xdg-open: 869: seamonkey: not found
/usr/bin/xdg-open: 869: mozilla: not found
/usr/bin/xdg-open: 869: epiphany: not found
/usr/bin/xdg-open: 869: konqueror: not found
/usr/bin/xdg-open: 869: chromium: not found
/usr/bin/xdg-open: 869: chromium-browser: not found
/usr/bin/xdg-open: 869: google-chrome: not found
/usr/bin/xdg-open: 869: www-browser: not found
/usr/bin/xdg-open: 869: links2: not found
/usr/bin/xdg-open: 869: elinks: not found
/usr/bin/xdg-open: 869: links: not found
/usr/bin/xdg-open: 869: lynx: not found
/usr/bin/xdg-open: 869: w3m: not found
xdg-open: no method available for opening 'https://aka.ms/azpssurvey?Q_CHL=FEEDBACK'
PS /home/user>

Duplicate issue #1648: [Bug] User's default web browser does not open when running via `sudo`
Created: 2020-02-19T20:23:59Z
Which Version of MSAL are you using ?
MSAL 4.8.2
Platform
netcore (Linux and macOS)
What authentication flow has the issue?

Desktop / Mobile

 Interactive



Is this a new or existing app?
c. This is a new app or experiment
Repro
static void Main(string[] args)
{
    var app = PublicClientApplicationBuilder.Create(clientId)
        .WithRedirectUri("http://localhost")
        .Build();

    await app.AcquireTokenInteractive(scopes)
        .WithSystemWebViewOptions(new SystemWebViewOptions())
        .ExecuteAsync();
}
$ sudo dotnet run 
Expected behavior
The current (real) user's default web browser is opened to the authentication page.
Actual behavior
The root (UID 0) user's default web browser is opened instead of the real user.
Possible Solution
On non-Windows platforms check if the SUDO_USER environment variable is set.
If it is then use the value as the ProcessStartInfo::UserName property when performing the Process::Start in PlatformProxyShared::StartDefaultOsBrowser.
Additional context/Logs/Screenshots
Both the UID and EUID are set to that of 'root' (i.e, 0) when running the process via sudo.
Child processes by default fork with their parent's real UID and EUID. The .NET Core Process class will correctly attempt set the process to the correct user if the ProcessStartInfo::UserName field has been set to non-null.

Closing comment (2021-12-22T09:56:18Z): Duplicate of #2839
Most browsers do not cross user, so there is no solution expect to throw an exception.