[Identity] Handle MSAL string response scenario

sdk/identity/azure-identity/CHANGELOG.md

@@ -10,6 +10,8 @@
 
 ### Bugs Fixed
 
+- Fixed an issue with error handling in MSAL-based credentials when the response content is a string rather than a dictionary. ([#40281](https://github.com/Azure/azure-sdk-for-python/pull/40281))
+
 ### Other Changes
 
 ## 1.21.0 (2025-03-11)

sdk/identity/azure-identity/azure/identity/_internal/msal_client.py

@@ -131,7 +131,8 @@ def _store_auth_error(self, response: PipelineResponse) -> None:
             # response to an auth request, so no credential will want to include it with an exception
             content = response.context.get(ContentDecodePolicy.CONTEXT_NAME)
             if content and "error" in content:
-                self._local.error = (content["error"], response.http_response)
+                error_code = content["error"] if isinstance(content, dict) else "oauth_error"
+                self._local.error = (error_code, response.http_response)
 
     def __getstate__(self) -> Dict[str, Any]:  # pylint:disable=client-method-name-no-double-underscore
         state = self.__dict__.copy()

sdk/identity/azure-identity/tests/test_msal_client.py

@@ -50,3 +50,28 @@ def test_get_error_response():
     assert response is second_response
 
     assert not client.get_error_response(first_result)
+
+
+def test_string_response_content():
+    """Test client handling string response content with error message"""
+    # String response content with error message
+    string_error = "Some string error message containing the word error"
+    response = mock.Mock(status_code=401, headers={})
+    response.text = lambda encoding=None: string_error
+    response.headers["content-type"] = "text/plain"
+    response.content_type = "text/plain"
+
+    # Create a transport that returns the string response
+    transport = validating_transport(
+        requests=[Request(url="https://localhost")],
+        responses=[response],
+    )
+
+    client = MsalClient(transport=transport)
+
+    # Make a request to store the auth error.
+    client.get("https://localhost")
+    error_code, saved_response = getattr(client._local, "error", (None, None))
+
+    assert error_code == "oauth_error"
+    assert saved_response is response