Crash when using WAM on Windows Server 2016

[mjcheetham]

Which version of GCM Core are you using?

2.0.498

Which Git host provider are you trying to connect to?

• Azure DevOps

Can you access the remote repository directly in the browser using the remote URL?

• Yes

---

[Azure DevOps only] What format is your remote URL?

• https://dev.azure.com/`{org}`/...

[Azure DevOps only] If the account picker shows more than one identity as you authenticate, check that you selected the same one that has access on the web.

• Not applicable

---

Expected behavior

The Windows broker account picker appears and I can sign in with a new AAD account.

Actual behavior

An error is thrown:

fatal: Could not get the account provider - account picker. See inner exception for details
fatal: Method not found: 'Void Windows.Security.Authentication.Web.Core.WebTokenRequest.put_CorrelationId(System.String)'.

Logs

Set the environment variables GCM_TRACE=1 and GIT_TRACE=1 and re-run your Git command. Review and redact any private information and attach the log.

gcm.log

[mjcheetham]

The version of MSAL used in GCM 2.0.498 is 4.31. Attempting to update to the latest MSAL (4.36.2 at time of writing) results in different behaviour.

Once I got an error "User canceled authentication". Another time I got a hang; the AAD plugin window was show, but then closed itself and authentication hung. Logs attached for this latter case.

gcm2.log

The problem appears to be with either MSAL or WAM in Windows Server 2016. An internal incident (ICM) was raised with the WAM team with ID 266225811 and detailed diagnostics provided there.

The Windows Server 2016 machine was "classic" domain joined. It does not appear to be possible to AAD or hybrid join; perhaps this is the root of the problem? Faulty WAM assumptions?

[mjcheetham]

The MSAL team's tracking issue for this problem is here: AzureAD/microsoft-authentication-library-for-dotnet#2946

[mjcheetham]

We are still awaiting a fix in MSAL.

[mjcheetham]

The latest from the MSAL team is that Windows Server 2016 isn't supported for WAM:

The reason why WAM is not available on Win Server 2016 is that the AAD plugin does not return an ID token. MSAL libraries don't really work with it.

We should update our WAM logic to exclude WinServer 2016.