From 45700b1258e16c00421c69ae68f45964a3ff9677 Mon Sep 17 00:00:00 2001
From: Gladwin Johnson <90415114+gladjohn@users.noreply.github.com>
Date: Wed, 16 Sep 2026 06:16:38 -0700
Subject: [PATCH] Fix Azure Arc pre-challenge errors

Preserve Azure Arc endpoint errors returned before the managed identity Basic authentication challenge instead of replacing them with a misleading WWW-Authenticate exception. Add coverage for an identity selector rejected on the initial request.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 2a68a512-5f7b-487b-956e-dfc6aee127c2
---
 msal/managed_identity.py |  5 +++++
 tests/test_mi.py         | 25 +++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/msal/managed_identity.py b/msal/managed_identity.py
index 8caf4717..7fc9e4bd 100644
--- a/msal/managed_identity.py
+++ b/msal/managed_identity.py
@@ -815,6 +815,11 @@ def _obtain_token_on_arc(http_client, endpoint, resource, managed_identity=None)
         params=params.copy(),
         headers={"Metadata": "true"},
         )
+    if resp.status_code != 401:
+        return {
+            "error": "invalid_request",
+            "error_description": resp.text,
+            }
     www_auth = "www-authenticate"  # Header in lower case
     challenge = {
         # Normalized to lowercase, because header names are case-insensitive
diff --git a/tests/test_mi.py b/tests/test_mi.py
index 92c2f33d..f0d0260c 100644
--- a/tests/test_mi.py
+++ b/tests/test_mi.py
@@ -672,6 +672,31 @@ def test_arc_error_should_be_normalized(self, mocked_stat):
                 if sys.platform in _supported_arc_platforms_and_their_prefixes:
                     self.fail("Should not raise ArcPlatformNotSupportedError")
 
+    def test_arc_error_before_challenge_should_be_normalized(self, mocked_stat):
+        error = '{"error":"invalid_request","error_description":"The requested identity was not found"}'
+        app = ManagedIdentityClient(
+            UserAssignedManagedIdentity(client_id="system-assigned-client-id"),
+            http_client=requests.Session())
+        with patch.object(app._http_client, "get", return_value=MinimalResponse(
+            status_code=400,
+            text=error,
+            headers={"content-type": "application/json"},
+        )) as mocked_method:
+            self.assertEqual({
+                "error": "invalid_request",
+                "error_description": error,
+            }, app.acquire_token_for_client(resource="R"))
+            mocked_method.assert_called_once_with(
+                "http://localhost/token",
+                params={
+                    "api-version": "2020-06-01",
+                    "resource": "R",
+                    "client_id": "system-assigned-client-id",
+                },
+                headers={"Metadata": "true"},
+            )
+            self.assertEqual({}, app._token_cache._cache)
+
     def _assert_user_assigned_selector(self, managed_identity, selector_name, selector_value):
         app = ManagedIdentityClient(managed_identity, http_client=requests.Session())
         with patch.object(app._http_client, "get", side_effect=[