[embetten]

Fixes #646 — MacMainThreadScheduler.StartMessageLoop() throws "Message loop must be started on the main thread" when Environment.CurrentManagedThreadId is not 1, which can happen when launched via dotnet tool run or dotnet run where internal runtime threads consume thread ID 1 before Main() executes.

MSAL's MacMainThreadScheduler assumes ManagedThreadId == 1 means "main thread." This is a .NET runtime implementation detail, not a guarantee. The dotnet tool shim and certain hosting configurations cause Main() to run on a thread where this check fails.

This change proposes falling back to no longer use the MacMainThreadScheduler when the thread != 1. Windows and Linux brokers will be unaffected, but mac broker will become unavailable and fall back to browser or DCF.

[embetten]

validated on linux-x64, win x64, arm64. Need to finialze mac testing

[embetten]

finished mac testing

[Alex Torres (AlexVTor)]

Looking to improve my understanding of the space:

I understand the bug lies in the thread scheduler expecting the main thread.
Is this fix to add a check for the current thread and to fallback to interactive auth (for macos) if needed?
If that is the case, does that mean that users in this scenario will always have to interact to provide auth, and the broker auth scenario isn't usable?

[embetten]

Looking to improve my understanding of the space:

I understand the bug lies in the thread scheduler expecting the main thread. Is this fix to add a check for the current thread and to fallback to interactive auth (for macos) if needed? If that is the case, does that mean that users in this scenario will always have to interact to provide auth, and the broker auth scenario isn't usable?

The fix here is more for non-mac platforms by removing the managed thread id =1 that is only a requirement for the mac broker. But i did add some messages and checks for mac to fail early if possible.

But for all platforms, if brokered auth is not available or fails for some reason (e.g. not on main thread for mac, network issues for WAM, missing dependencies for Linux), we will try the next authentication method, which would be browser auth in this scenario. And Brokered auth is considered interactive, so it would be interactive auth regardless.

[Alex Torres (AlexVTor)]

LGTM