user_interaction_required – Not able to add/refresh account in VS 2015

One day all of a sudden most of our team members were not able to add/refresh their account in VS 2015. We were getting an error

---------------------------

Microsoft Visual Studio

---------------------------

We could not refresh the credentials for the account xxx

user_interaction_required: One of two conditions was encountered: 1. The PromptBehavior.Never flag was passed, but the constraint could not be honored, because user interaction was required. 2. An error occurred during a silent web authentication that prevented the http authentication flow from completing in a short enough time frame

---------------------------

OK  

---------------------------

I then started looking at the network traces to figure out what’s wrong. I saw that there was an interaction between login.microsoftonline.com and tokenprovider.termsofuse.identitygovernance.azure.com after which the error would occur.

I copied the first url which looks like https://login.microsoftonline.com/xxx/oauth2/authorize?resource=https%3a%2f%2fmanagement.core.windows.net%2f&client_id=872cd9fa-d31f-45e0-9eab-6e460a02d1f1&response_type=code&redirect_uri=urn%3aietf%3awg%3aoauth%3a2.0%3aoob&login_hint=xxx&client-request-id=f9c9ba16-48c2-4def-9b2d-c2218191eb7f&prompt=attempt_none&x-client-SKU=.NET&x-client-Ver=2.16.0.0&x-client-CPU=x64&x-client-OS=Microsoft+Windows+NT+10.0.16299.0&sso_nonce=xxx&mscrid=xxx  and pasted it into browser.

Now, I saw a prompt to accept Terms Of Use in a different tenant that my home tenant. Looked like someone had enabled a Terms of Use Conditional Access policy on that tenant. See more details about Terms of Use here https://docs.microsoft.com/en-us/azure/active-directory/active-directory-tou

On analyzing more, it looks like VS tries to get a token for all the tenants you belong to. If one of the tenant has a Conditional Access policy like Terms of Use which requires a user input, VS 2015 will not be able to show it to you. So will you have to upgrade to VS 2017 or disable the Conditional Access policy.

Once this is done, everything should start working as usual.

Azure Active Directory - Get Tenant Id from Tenant Name

This question "How do I get my Tenant Id?" has come up several times so I though I will blog it.

You can do that my going to https://login.windows.net/TenantName/.well-known/openid-configuration where TenantName is the one of the domain name of your tenant.

For example, https://login.windows.net/anujc.onmicrosoft.com/.well-known/openid-configuration will return

{"authorization_endpoint":"https://login.windows.net/46650ea8-7413-4415-82c6-f891fc15a31e/oauth2/authorize","token_endpoint":"https://login.windows.net/46650ea8-7413-4415-82c6-f891fc15a31e/oauth2/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt"],"jwks_uri":"https://login.windows.net/common/discovery/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","token id_token","token"],"scopes_supported":["openid"],"issuer":"https://sts.windows.net/46650ea8-7413-4415-82c6-f891fc15a31e/","claims_supported":["sub","iss","aud","exp","iat","auth_time","acr","amr","nonce","email","given_name","family_name","nickname"],"microsoft_multi_refresh_token":true,"check_session_iframe":"https://login.windows.net/46650ea8-7413-4415-82c6-f891fc15a31e/oauth2/checksession","end_session_endpoint":"https://login.windows.net/46650ea8-7413-4415-82c6-f891fc15a31e/oauth2/logout","userinfo_endpoint":"https://login.windows.net/46650ea8-7413-4415-82c6-f891fc15a31e/openid/userinfo"}

This contains my Tenant Id 46650ea8-7413-4415-82c6-f891fc15a31e

AADSTS65001: No permission to access user information is configured for xxx' application, or it is expired or revoked

Recently, I had built an AAD application in my tenant with the permission “Enable single sign-on and read user’s profile”.

The application didn’t have admin consent so any time a user would login to my site, he would be asked for consent. I had some users who had consented to my app.

After some time, I added another permission “Access Azure Service Management” to my app and I was able to login fine. Users who had never consented to my app earlier could also sign in. However, users who had already consented to my app before I added the new permission started seeing this error “AADSTS65001: No permission to access user information is configured for xxx' application, or it is expired or revoked. “

I was really confused why the app works for some users but not for others.

After understanding the pattern that the error occurs only for users who had already consented, I asked them to perform the following work around:

1. Go to https://myapps.microsoft.com
2. Remove the app
3. Sign in again to the app in a fresh browser session
4. Now you will see the consent prompt for two permission
5. Grant consent   

After this, all users were able to login successfully.