Bug Report: dotnet restore Fails to Trigger Interactive Device Flow Authentication in WSL with .NET 9 Preview SDK

[HuskyDanny]

Environment:

.NET SDK Version: 9.0.301 (Preview)

Operating System: Ubuntu 24.04 (running in WSL)

Architecture: x64

Target Feed: Private Azure DevOps Artifacts feed requiring authentication.

Problem Description:
When running on a project that requires authentication with a private Azure DevOps feed, the command fails. The process does not trigger the expected interactive device code authentication flow in the console. Instead, it hangs and eventually fails with a error or a generic "A task was canceled" warning.dotnet restore401 Unauthorized

This issue prevents developers from restoring NuGet packages from private feeds in a WSL environment when using the .NET 9 Preview SDK without resorting to secret-based authentication (like PATs ).

Expected Behavior:
When is run in a non-interactive terminal and requires credentials, the NuGet credential provider should initiate the device flow authentication. It should print a message to the console similar to the following, prompting the user to log in via a browser:dotnet restore

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXXX to authenticate.
This is the observed behavior when using stable .NET SDKs or when running the command in PowerShell on Windows.

Actual Behavior:
In WSL with the .NET 9 Preview SDK, the device flow prompt is never displayed. The command fails silently on the authentication step.

Verbose logging from the credential provider confirms it attempts an "MSAL Interactive" login but fails without falling back to the console-based device flow. The final log message is , indicating the provider incorrectly believes it has launched a graphical prompt, which is not possible in this environment.Use the opened dialog or browser window to log in

Steps to Reproduce:

Set up a WSL environment with Ubuntu 24.04.

Install only the .NET 9 Preview SDK (e.g., version 9.0.301).

Configure a .NET project to use a private NuGet feed hosted in Azure DevOps.

Ensure there are no cached credentials or PATs configured in the environment.

Run from the WSL terminal.dotnet restore

Observe that the command fails without providing a device flow code for login.

Tried Solutions:

1. restart/reinstall
2. Directly invoking the credential dll:
   [Verbose] [CredentialProvider] Running in stand-alone mode
   [Verbose] [CredentialProvider] Command-line v1.4.1+3c3ac17018f437ac773b126ebb87fc9accaeef16: /home/[your-username]/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll -U https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json -v Verbose
   [Verbose] [CredentialProvider] Handling auth request, Uri: https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json, IsRetry: False, IsNonInteractive: False, CanShowDialog: True
   [Verbose] [CredentialProvider] URI: https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json
   [Verbose] [CredentialProvider] VstsBuildTaskServiceEndpointCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet with external endpoint credentials. Appropriate environment variable needs to be set.
   [Verbose] [CredentialProvider] Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTaskServiceEndpoint.VstsBuildTaskServiceEndpointCredentialProvider, cannot provide credentials for https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json
   [Verbose] [CredentialProvider] VstsBuildTaskCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet. Appropriate environment variables must be set.
   [Verbose] [CredentialProvider] Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTask.VstsBuildTaskCredentialProvider, cannot provide credentials for https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json
   [Verbose] [CredentialProvider] VstsCredentialProvider - Matched well-known Azure DevOps Service hostname: [org-name].pkgs.visualstudio.com
   [Verbose] [CredentialProvider] Using NuGetCredentialProvider.CredentialProviders.Vsts.VstsCredentialProvider to try to get credentials for https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json.
   [Verbose] [CredentialProvider] IsRetry: False
   [Verbose] [CredentialProvider] Could not find cached SessionToken for https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json
   [Verbose] [CredentialProvider] GET https://[org-name].pkgs.visualstudio.com/[...]/v3/index.json
   [Verbose] [CredentialProvider] Found AAD Authority from 401 headers: https://login.windows.net/[your-tenant-id]
   [Verbose] [CredentialProvider] VstsCredentialProvider - Using Entra authority: https://login.windows.net/[your-tenant-id]
   [Verbose] [CredentialProvider] VstsCredentialProvider - Not running bearer token provider 'MSAL Service Principal'
   [Verbose] [CredentialProvider] VstsCredentialProvider - Not running bearer token provider 'MSAL Managed Identity'
   [Verbose] [CredentialProvider] VstsCredentialProvider - Attempting to acquire bearer token using provider 'MSAL Silent'
   [Verbose] [CredentialProvider] VstsCredentialProvider - Bearer token provider 'MSAL Silent' didn't acquire a token
   [Verbose] [CredentialProvider] VstsCredentialProvider - Attempting to acquire bearer token using provider 'MSAL Interactive'
   [Information] [CredentialProvider] Use the opened dialog or browser window to log in. It may be behind other windows.
   [Warning] [CredentialProvider] A task was canceled.
   [Verbose] [CredentialProvider] VstsCredentialProvider - Bearer token provider 'MSAL Interactive' didn't acquire a token
   [Verbose] [CredentialProvider] VstsCredentialProvider - Attempting to acquire bearer token using provider 'MSAL Device Code'
   ^C[Verbose] [CredentialProvider]Canceling credential provider

[Frulfump]

Why is 9.0.301 (preview) being used? 9.0.301 and 9.0.302 is GA. How did you aquire 9.0.301 preview I don't see that anywhere?

Which version of the cred provider is being used? (surprised that isn't requested in the issue template.)

Does running the command with the flag --tl:off to turn off the terminal logger work?

[DSMitten]

I have this exact problem in Ubuntu 22.04 with dotnet 8.0.412, also running in WSL

[Frulfump]

I have this exact problem in Ubuntu 22.04 with dotnet 8.0.412, also running in WSL

Does it work outside of WSL for you?
Does supplying --tl:off make a difference for you?
And what version of the provider do you got?

[DSMitten]

Does it work outside of WSL for you?
I don't use Linux outside of WSL. I'm building a C# project in a powershell terminal in VSCode and the build script attempts to dotnet build and it just sits there saying "Determining projects to restore..."

Does supplying --tl:off make a difference for you?
It didn't affect anything

And what version of the provider do you got?
1.4.1

I have a nuget.config which has the following contents:

<configuration>
  <packageSources>
    <clear />
    <add key="myproductname" value="https://myteam.visualstudio.com/a_guid/_packaging/myproductname/nuget/v3/index.json" />
  </packageSources>
</configuration>

[Frulfump]

Ok that's unfortunate. I meant if it works on Windows outside of your WSL. Just trying to narrow down where the issue could be.

Hmm not sure what the problem could be, but doing dotnet build --interactive works just not the non-interactive way?

[DSMitten]

It does work on the Windows host machine. I'm not sharing the same binary between Windows and WSL though - I've installed https://github.com/microsoft/artifacts-credprovider/releases/download/v1.4.1/Microsoft.NuGet.CredentialProvider.tar.gz to:

/usr/share/dotnet/sdk/8.0.412/Plugins/netcore/CredentialProvider.Microsoft
/usr/share/dotnet/sdk/8.0.412/Plugins/netfx/CredentialProvider.Microsoft
$HOME/.nuget/plugins/netcore/CredentialProvider.Microsoft
$HOME/.nuget/plugins/netfx/CredentialProvider.Microsoft

I should mention - it works on one WSL machine and doesn't prompt/hangs on the other. I don't know what is different between the machines. I'm deleting the broken one and trying to reinstall.

[Frulfump]

Ah ok. Maybe you would see a difference with the net8 asset? I wasn't expecting netfx to be present in Linux since it doesn't work there but it shouldn't be chosen either and you have netcore present. I'm not sure what the asset without a TFM contains but I think it's just both netcore + netfx folders(even on Linux).

Hoping the maintainers will show up soon this repo has been a ghost town recently.

[embetten]

I was unable to reproduce the issue in wsl with net9 (not the preview version)

The .NET 8 asset for version 1.4.1 is not packaged as a dotnet tool, so placing it under /usr/share/dotnet/sdk/8.0.412/Plugins/ is unlikely to work. Instead, it should be placed under $HOME/.nuget/plugins/netcore/, which is the correct location for plugin discovery. As @Frulfump pointed out, netfx is not required in this context.

To investigate further, @DSMitten I’ll need more detailed logs. Please try running the DLL directly with the -verbosity flag enabled. This will help determine if any MSAL-related logging when attempting to initiate the device code flow.