"RuntimeError: 0. The ID token is not yet valid." can be refined

[jiasli]

Azure CLI users frequently see

RuntimeError: 0. The ID token is not yet valid. Current epoch = 1637158952.  The id_token was: {

All issues are summarized at

• Can't do az login: RuntimeError: 0. The ID token is not yet valid. Azure/azure-cli#20388

MSAL can refine the error message so that users can know what to do next:

microsoft-authentication-library-for-python/msal/oauth2cli/oidc.py

Lines 47 to 50 in 9f78b6b

	if _now + skew < decoded.get("nbf", _now - 1): # nbf is optional per JWT specs
	# This is not an ID token validation, but a JWT validation
	# https://tools.ietf.org/html/rfc7519#section-4.1.5
	err = "0. The ID token is not yet valid."

microsoft-authentication-library-for-python/msal/oauth2cli/oidc.py

Lines 70 to 71 in 9f78b6b

	if _now - skew > decoded["exp"]:
	err = "9. The current time MUST be before the time represented by the exp Claim."

[rayluo]

Thanks for sharing the real-world cases with us. How about we adjust those 2 messages like this? If you are fine with them, I can get them fixed in MSAL code base.

err = "0. The ID token is not yet valid."

err = "0. Is the time on this computer correct? We seem to encounter an ID token issued in the future."

err = "9. The current time MUST be before the time represented by the exp Claim."

err = "9. Is the time on this computer correct? We seem to encounter an ID token already expired."

[jiasli]

Another occurrences of this error today:

• az login issue: RuntimeError: 0. The ID token is not yet valid.  Azure/azure-cli#20825
• Azure login issue: RuntimeError: 0. The ID token is not yet valid.  Azure/azure-cli#20822
• Can't login to the Azure from visual studio code: RuntimeError: 0. The ID token is not yet valid. Azure/azure-cli#20816

This definitely works. I would personally prefer an imperative sentence:

err = "0. The ID token is not yet valid. Make sure your computer's time is correctly synchronized."

A question like "Is the time on this computer correct?" is not obvious for what to do next.

BTW, Azure CLI actually has a whole error recommendation system:

1. Manually: https://github.com/Azure/azure-cli/blob/6751048cd85921081e3d033624f6109d7d6a01ec/src/azure-cli-core/azure/cli/core/util.py#L76-L83
2. AI-driven: https://github.com/Azure/azure-cli/blob/8f28e98186ad7db242b004da78c3f1ce7f94c11e/src/azure-cli-core/azure/cli/core/command_recommender.py#L122

+@chasewilson

[rayluo]

OK. I will adopt your suggestion on "error 0". How about the shortened "error 9"?

err = "0. The ID token is not yet valid."

err = "0. The ID token is not yet valid. Make sure your computer's time is correctly synchronized."

err = "9. The current time MUST be before the time represented by the exp Claim."

err = "9. The ID token already expires. Make sure your computer's time is correctly synchronized."

[jiasli]

I like the error message!

[rayluo]

Implemented and merged in PR #449
(Note: It turns out a PR can not automatically close a Discussion topic. Let me manually close/lock it here.)