MSAL exception: Bound token requests fail with a non-actionable error message #5868
Description
Bug: Bound token request fails with MSAL
Summary
When acquiring a bound token using System-Assigned Managed Identity in MSAL, the following exception is thrown:
MSAL.NetCore.4.79.2.0.MsalClientException: ErrorCode: mtls_pop_token_not_supported_in_imds_v1
A mTLS PoP token cannot be requested because the application's source was determined to be ImdsV1.
Details & Feedback
- The error message is confusing to users, as distinguishing v1 vs v2 is not intuitive.
- It was agreed in conversation that MSAL should improve this error message and reference documentation on IMDS requirements.
- See attached images for conversation details:
What's expected
- Clear error message, guidance (documentation) on IMDSv1/v2 prerequisites
Additional Notes
- MSAL logs could help diagnose the problem further
- Asked for MSAL logs