[Feature Request] Option to launch interactive auth on a different browser

[choonchernlim]

MSAL client type

Public

Problem Statement

I currently use the delegated auth flow approach by using app.acquire_token_interactive(..), which launches my default browser (Brave browser, in this case) on MacOS.

However, due to my institution's configuration, the authentication flow gets stuck indefinitely on the "Set up your device to get access" page. If I change my default browser to Chrome, it works successfully.

I noticed setting the preferred browser using the environment variable is possible. However, it is only applicable to Linux.

Proposed solution

Is it possible to specify a different browser programmatically without changing the default browser on my Mac?

One way is to remove the Linux platform check to allow other platforms to specify different browser via environment variable, too.

Thank you.

[rayluo]

I haven't tried it on Mac, but the Python documentation hints that Python will honor the BROWSER env var ... also on Mac? Alternatively, you may go down the rabbit hole like this. Will that work for you?

[choonchernlim]

With my default browser set to Brave on my Mac, this is what I tried:

os.environ['BROWSER'] = 'chrome' # Opens Brave
os.environ['BROWSER'] = 'google-chrome' # Opens Brave
os.environ['BROWSER'] = 'chromium' # Opens Brave
os.environ['BROWSER'] = 'chromium-browser' # Opens Brave
os.environ['BROWSER'] = 'firefox' # Opens Firefox, but my institution doesn't support this browser

Somehow, webbrowser has difficulty differentiating a chromium browser like Brave from Chrome (vice versa).

Regarding that rabbit hole, I'm a little hesitated because I believe it will change the default browser permanently, unless I rerun it to change it back.

[rayluo]

I haven't tried it on Mac, but the Python documentation hints that Python will honor the BROWSER env var ... also on Mac?

Quoted from the doc, "If the environment variable BROWSER exists, it is interpreted as the os.pathsep-separated list of browsers to try ahead of the platform defaults. When the value of a list part contains the string %s, then it is interpreted as a literal browser command line to be used with the argument URL substituted for %s; ..."

Can you try BROWSER="/path/to/your/chrome/executable %s"?

[choonchernlim]

I think I got it! The path is a little convoluted, but I was able to launch it with Chrome now!

# default browser on Mac = Brave

os.environ['BROWSER'] = "/Applications/Google\\ Chrome.app %s"  # Opens Brave
os.environ['BROWSER'] = 'open -a /Applications/Google\\ Chrome.app %s' # Opens Chrome [UPDATED 2024-09-23]


app = msal.PublicClientApplication(CLIENT_ID, authority=AUTHORITY)

Thank you very much for your help, @rayluo! I will close this ticket.

[choonchernlim]

@rayluo slight tweak to the answer to prevent Python from complaining about "invalid escape sequence '\ '"

# better!
os.environ['BROWSER'] = '/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome %s'  # Opens Chrome

Also, I noticed an oddity with this solution that I want to call out.

Scenario 1: Chrome isn't Opened => Not Working

If Chrome isn't opened, I see the following in the log before Chrome is launched:

Created TensorFlow Lite XNNPACK delegate for CPU.
Attempting to use a delegate that only supports static-sized tensors with a graph that has dynamic-sized tensors (tensor#141 is a dynamic-sized tensor).

However, after completing my 2FA authentication, it is always stuck on this screen.

Scenario 2: Open Chrome First => Working

If I open Chrome first and leave it opened before I run the script, I see this in my log:

Opening in existing browser session.

This time, the auth flow works as expected and I can retrieve the access token from the response.

Any idea what might cause Scenario 1's problem? Thank you.

[rayluo]

Thanks for following up and striking for a better answer, @choonchernlim .

slight tweak to the answer to prevent Python from complaining about "invalid escape sequence '\ '"

Sounds good. Can you directly edit your previous answer to use your new command line?

Any idea what might cause Scenario 1's problem? Thank you.

Not that I'm aware of. Perhaps as a workaround, you can have the BROWSER env var configured to use a script which launch Chrome first, sleep several seconds, and then open the %s in its new tab?

[choonchernlim]

There's something with webbrowser that prevents it from completing the complete authentication flow if my Chrome isn't already opened first.

Perhaps, my institution has a very strict device check and webbrowser sets a slightly different configuration that triggers the "Approve sign in request" or "Set up your device to get access" check that always get stuck, even if it launches the correct browser.

For now, I wrote a hack similar to yours using subprocess to ensure Chrome is already running before webbrowser does its thing. Pretty sure I will regret this decision, but I'm too tired to think now. :)

import subprocess

os.environ['BROWSER'] = '/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome %s'  # Opens Chrome
subprocess.run(['open', '-a', 'Google Chrome'])

[choonchernlim]

@rayluo May I know what's causing this message to be printed out?

Created TensorFlow Lite XNNPACK delegate for CPU.
Attempting to use a delegate that only supports static-sized tensors with a graph that has dynamic-sized tensors (tensor#141 is a dynamic-sized tensor).

My requirements.txt doesn't have any TensorFlow related dependencies:

requests
msal
msal-extensions

... and my virtual env only has these dependencies:

$ pip list
Package            Version
------------------ ---------
certifi            2024.8.30
cffi               1.17.1
charset-normalizer 3.3.2
cryptography       43.0.1
idna               3.10
msal               1.31.0
msal-extensions    1.2.0
pip                24.2
portalocker        2.10.1
pycparser          2.22
PyJWT              2.9.0
requests           2.32.3
urllib3            2.2.3

I'm not doing any AI related things in this project, so it is very weird to see the word "Tensorflow" from MSAL.

[rayluo]

May I know what's causing this message to be printed out?

Created TensorFlow Lite XNNPACK delegate for CPU.
Attempting to use a delegate that only supports static-sized tensors with a graph that has dynamic-sized tensors (tensor#141 is a dynamic-sized tensor).

...
it is very weird to see the word "Tensorflow" from MSAL.

One thing I know for sure is that those lines were not emitted by MSAL. :-)

Empirically, browser as a GUI app tends to emit some debug log to stdout which becomes visible in your use case because a browser is launched inside a console. You may observe the same when you simply run this one-liner /path/to/your/chrome/executable https://example.com.

Besides, both Google and TensorFlow are developed by Google. So, you know Chrome is the culprit here, and MSAL is not. :-)

[choonchernlim]

@rayluo I think I solved it. You are right the TensorFlow message comes from the Chrome browser.

# PARTIALLY WORKING SOLUTION ON MAC
# Works ONLY IF the Chrome browser is already opened. 
# Hangs when going through the OAuth flow if MSAL opens the Chrome browser using webbrowser
os.environ['BROWSER'] = '/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome %s'

# FULLY WORKING SOLUTION ON MAC
# Works on existing the Chrome browser.
# Also works if MSAL opens the Chrome browser using webbrowser.
os.environ['BROWSER'] = 'open -a /Applications/Google\\ Chrome.app %s'

I will update the answer above. This is much better than the rest of the workarounds I tried. :)