Windows11 23H1升级后InteractiveBrowserCredential认证失败问题

问题详情 #

InteractiveBrowserCredential authentication failed: The browser based authentication dialog failed to complete. Reason: The download has failed (the connection was interrupted)

需求：通过交互式登录从Azure AD获取当前用户属性（邮箱、UPN等），不使用证书或密钥。

问题现象：代码此前运行正常，升级到Windows 11 23H1后出现间歇性异常——有时弹出登录界面，有时不弹出；弹出后有时能正常获取用户属性，有时失败；不弹出则完全无法获取属性，怀疑是令牌缓存问题。

相关代码：

static async Task getMyDetailsFromAzure(string tenantId, string clientId, string logToFile)
{
    try
    {
        RegistryKey keyHKCU = Registry.CurrentUser.OpenSubKey(@"Software\AppName", true);
        try
        {
            if (keyHKCU == null)
            {
                keyHKCU = Registry.CurrentUser.CreateSubKey(@"Software\AppName");
            }
        }
        catch { }

        if (keyHKCU != null)
        {

            string[] requiredAttribs = {
            "BusinessPhones"
            ,"City"
            ,"CompanyName"
            ,"Country"
            ,"Department"
            ,"DisplayName"
            ,"EmployeeId"
            ,"FaxNumber"
            ,"GivenName"
            ,"JobTitle"
            ,"Mail"
            ,"MailNickname"
            ,"MobilePhone"
            ,"OfficeLocation"
            ,"PostalCode"
            ,"State"
            ,"StreetAddress"
            ,"Surname"
            ,"UserPrincipalName"};
            var scopes = new[] { "User.Read" };
            var options = new InteractiveBrowserCredentialOptions
            {
                TenantId = tenantId,
                ClientId = clientId,
                AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
                RedirectUri = new Uri("https://login.microsoftonline.com/common/oauth2/nativeclient"),
            };
            var interactiveCredential = new InteractiveBrowserCredential(options);
            var graphClient = new GraphServiceClient(interactiveCredential, scopes);

            try
            {
                
                var result = await graphClient.Me.GetAsync((requestConfiguration) =>
                {
                    requestConfiguration.QueryParameters.Select = requiredAttribs;
                });
                
                var propertyNames = result.GetType().GetProperties();

                foreach (var property in propertyNames)
                {
                    if (requiredAttribs.Contains(property.Name, StringComparer.OrdinalIgnoreCase))
                    {
                        if (property.Name.ToLower().Equals("businessphones"))
                        {
                            int counter = 1;
                            foreach (var phone in result.BusinessPhones)
                            {
                                if (phone != null)
                                    try
                                    {
                                        keyHKCU.SetValue("az_" + property.Name.ToLower() + counter, phone);
                                        counter = counter + 1;
                                    }
                                    catch { }
                            }
                        }
                        else
                        {
                            if (property.GetValue(result) != null)
                                try
                                {
                                    keyHKCU.SetValue("az_" + property.Name.ToLower(), property.GetValue(result));
                                }
                                catch { }
                        }
                    }
                }

            }
            catch (Exception ex)
            {
                cLogger.WriteToFileThreadSafe($"Error fetching user details from Azure AD (1) : {ex.Message}", logToFile);
            }
        }
        else
        {
            cLogger.WriteToFileThreadSafe($"Could not create the registry path.", logToFile);
        }

    }
    catch (Exception ex) { cLogger.WriteToFileThreadSafe($"Error fetching user details from Azure AD (2) : {ex.Message}", logToFile); }

}

解决方案 #

1. 清理令牌缓存 #

MSAL默认会在本地存储令牌缓存，Windows 11 23H1的权限变化可能导致缓存损坏或读取异常：

• 手动删除缓存文件：路径为%LOCALAPPDATA%\.IdentityService\msal.cache，删除后重新运行程序。
• 代码中配置自定义缓存策略，避免默认缓存的兼容性问题：

  var options = new InteractiveBrowserCredentialOptions
  {
      TenantId = tenantId,
      ClientId = clientId,
      AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
      RedirectUri = new Uri("https://login.microsoftonline.com/common/oauth2/nativeclient"),
      TokenCachePersistenceOptions = new TokenCachePersistenceOptions
      {
          Name = "YourAppUniqueCacheName", // 自定义缓存名称，避免与其他应用冲突
          UnsafeAllowUnencryptedStorage = true // 若系统不支持加密存储时启用
      }
  };
  

2. 禁用嵌入式WebView，使用系统默认浏览器 #

Windows 11 23H1对嵌入式WebView的行为做了调整，切换到系统默认浏览器可避免兼容性问题：

var options = new InteractiveBrowserCredentialOptions
{
    TenantId = tenantId,
    ClientId = clientId,
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
    RedirectUri = new Uri("https://login.microsoftonline.com/common/oauth2/nativeclient"),
    UseEmbeddedWebView = false // 启用系统默认浏览器完成认证
};

3. 添加网络异常重试逻辑 #

针对连接中断的临时性错误，添加重试机制提升稳定性：

int maxRetries = 3;
for (int retry = 0; retry < maxRetries; retry++)
{
    try
    {
        var result = await graphClient.Me.GetAsync((requestConfiguration) =>
        {
            requestConfiguration.QueryParameters.Select = requiredAttribs;
        });
        // 原有的结果处理逻辑...
        break; // 成功获取结果后跳出重试循环
    }
    catch (Exception ex) when (retry < maxRetries - 1 && ex.Message.Contains("connection was interrupted"))
    {
        await Task.Delay(1000 * (retry + 1)); // 指数退避等待后重试
    }
}

4. 检查Windows系统权限与网络设置 #

• 确认应用在Windows设置的隐私和安全性 > 网络权限中被允许访问网络。
• 临时关闭VPN或代理，排查是否是网络路由导致认证请求中断。
• 检查Windows Defender防火墙规则，确保应用的出站请求未被拦截。

5. 更新依赖库版本 #

确保Microsoft.Identity.Client（MSAL）和Microsoft.Graph SDK使用最新稳定版本，新版本通常会修复Windows 11 23H1的兼容性问题。

内容的提问来源于stack exchange，提问作者toparge nz