Can MSAL support username password flow?

[vincentcccheng]

app = msal.ClientApplication(
config["client_id"], authority=config["authority"],
client_credential=config.get("client_secret"))

app.acquire_token_by_username_password throws error:

requests.exceptions.HTTPError: 400 Client Error: AADSTS90014: The required field 'api-version' is missing from the credential. Ensure that you have all the necessary parameters for the login request.

Is it because external guest account like "user_outlook.com#EXT#@company.onmicrosoft.com" is not supported? Is there a workaround? Internal AD account has no issues.

Thanks!
VC

[rayluo]

That error message is unfortunately vague, but, indeed, the username password authentication is not recommended, and it also has many constraints.

Go use interactive auth instead. Its documentation is available here, which mentions how you configure its redirect_uri (a.k.a. reply-url).

[rayluo]

(Hmm, I don't know how Vincent's following email reached my mailbox. The original Github Discussion<#351> does not contain your follow-up message. I hope you can somehow still see my reply below.) You don't configure your Azure App Registration to "ignore" the reply url. You can only configure your app to "use" a certain url. For acquire_token_interactive() to work, the prerequisite is described in its API document. I updated my earlier answer in that github discussion topic. Regards, Ray Luo

…

________________________________ From: vincentcccheng ***@***.***> Sent: Wednesday, April 21, 2021 11:54 PM To: AzureAD/microsoft-authentication-library-for-python ***@***.***> Cc: Ray Luo ***@***.***>; Comment ***@***.***> Subject: Re: [AzureAD/microsoft-authentication-library-for-python] Can (#351) Ray, that helps !! One more question - after signing in, it said: [image]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fuser-images.githubusercontent.com%2F67680209%2F115669052-6f164480-a37a-11eb-8681-bfa59320027e.png&data=04%7C01%7Crayluo%40microsoft.com%7Cfcfa6626adc741c48c1708d9055b89e3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637546712992204506%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ZAcfmpExu%2BO09C%2BMPwMsdhy26ht5cxjGNG9VzyQiRHc%3D&reserved=0> AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'e46e77ca-183c-4aaa-ae3c-4ae02ac2a94e'. Should I update Azure app registration to ignore the reply url? Thanks — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzureAD%2Fmicrosoft-authentication-library-for-python%2Fdiscussions%2F351%23discussioncomment-643629&data=04%7C01%7Crayluo%40microsoft.com%7Cfcfa6626adc741c48c1708d9055b89e3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637546712992204506%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FfGNK80tfaEYQ3B4HHz69CKydTiCgetEO44m%2BBqW7Ug%3D&reserved=0>, or unsubscribe<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAGISLSN2E2PTKJTAMNLCM3TJ7B4BANCNFSM43LOEZBQ&data=04%7C01%7Crayluo%40microsoft.com%7Cfcfa6626adc741c48c1708d9055b89e3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637546712992214501%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=D288qg%2BOkCTdsgR7zqRoLdswjuKF5uoMa5SmBcybojs%3D&reserved=0>.

[vincentcccheng]

Hi Ray, thank so much for your email. You're the best !! I removed my reply as I thought I needed to research further before I posted another question. Obviously, the email went to your inbox right away. Sorry for the confusion.

I tested using your example but ran into trouble:

1. As you said, I cannot ignore the Reply URL so I put http://localhost and it worked. This was fixed.
2. My current attempt is to configure React.JS (frontend) + Flask (back end). Unfortunately, the sigin in URL initiated from Flask (backend) cannot be seen by the frontend browser. It simply failed. I did that because many examples I saw on Internet authenticate the user in Flask before passing the bearer token. I must be totally wrong.

Now, I am so confused the proper way to setup authentication and passing token using both React JS and Flask. Any guidance would be very much appreciated. Thanks!

Vincent

[rayluo]

You started with the username password authentication, which made me think you were building a desktop app, so I recommended the Interactive Auth (which is the right choice for a desktop app). But if you are aiming to build something on the web, that is a different category. To help avoiding this kind of miscommunication for future customers, I am experimenting a "MAP" concept to hopefully guide people find "where am I (going to build)" easier. Let us know what you think.

Back to your topic. Your options can be:

1. Build a traditional web app, such that the authentication happens on the backend in Python. (A link to an MSAL-Python powered sample is available in the map I just mentioned.)
2. Build a frontend SPA in Javascript. We have a MSAL js library for that.

[vincentcccheng]

It seems none of the icons are clickable on Edge and Chrome. I think I wanted React front-end + Flask back-end. I actually tried to follow the example here -> https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/tree/main/3-Authorization-II/1-call-api
However, the example was using node js as the backend API and passport js to protect the web api. I am looking for an example of how to implement this using flask web/api (python). Hope you can have some examples for me. Thanks!

[rayluo]

It seems none of the icons are clickable on Edge and Chrome.

We happened to use a syntax that only worked with Firefox. Now fixed, so some icons in the map are clickable now.

Unfortunately, we do not currently have a web api sample written in Python. You can click a thumbs-up on #147 for our future planning. (CC @navyasric )

[vincentcccheng]

Got it. I researched and also found #147, clicked a thumbs-up. Hope there is a web api sample in Python soon. Thanks!