Unknown HTTP error while retrieving PRT token with smart-card logon

Question

We are currently migrating our proprietary smart-card logon system to Entra ID in combination with Entra CBA. Our machines are (successfully) Hybrid Joined. We have the single sign-on system working for password-based logons on the PC. The user gets a PRT and dsregcmd /status shows a working configuration.

This is not the case when a user signs in with his smart-card. The user get access to the machine, but for some reason the retrieval of the PRT fails with an error that I cannot find anywhere online:

+----------------------------------------------------------------------+
| SSO State                                                            |
+----------------------------------------------------------------------+

                AzureAdPrt : NO
       AzureAdPrtAuthority :
     AcquirePrtDiagnostics : PRESENT
      Previous Prt Attempt : 2024-11-21 10:41:42.574 UTC
            Attempt Status : 0xc0090027
             User Identity : my.user@my-domain.tld
           Credential Type : Certificate
            Correlation ID : <GUID>
              Endpoint URI : https://login.microsoftonline.com/<GUID>/oauth2/token
               HTTP Method :
                HTTP Error : 0x80090027
               HTTP status : 0
         Server Error Code :
  Server Error Description :
             EnterprisePrt : NO
    EnterprisePrtAuthority :

I cannot find anything related for both the attempt status and HTTP error codes. They are also not mentioned in the Troubleshooting page on https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current#step-3-troubleshoot-further-based-on-the-found-error-code

The user identity correctly shows the UPN of my account (which is the same in Entra ID). I've removed the Correlation ID, but it shows a GUID. When I compare the output of the status command between a password-login and a smart-card login, the only difference is in this block. All other blocks are exactly the same.

When I try a interactive login via the browser and supply my certificate as the first-factor, I can succesfully login to the Entra account with my smart-card certificate, so the CBA system seems to work correctly.

I've been digging in the AAD logs in Event Viewer, both the Operation and Analytic logs. But I can't find anything verbose enough to determine the issue.

How can I debug this issue, as this is the only thing holding back a successfull deployment.

Answer 1

Hi and sorry for barging in.

Good luck finding a solution for this. Our dsregcmd /status output looks exactly as yours.

+----------------------------------------------------------------------+
| SSO State                                                            |
+----------------------------------------------------------------------+
                AzureAdPrt : NO
       AzureAdPrtAuthority :
     AcquirePrtDiagnostics : PRESENT
      Previous Prt Attempt : 2024-12-13 17:09:54.629 UTC
            Attempt Status : 0xc0090027
             User Identity : user@domain.tld
           Credential Type : Certificate
            Correlation ID : ...
              Endpoint URI : https://login.microsoftonline.com/.../oauth2/token
               HTTP Method :
                HTTP Error : 0x80090027
               HTTP status : 0
         Server Error Code :
  Server Error Description :
             EnterprisePrt : NO
    EnterprisePrtAuthority :

We already opened a ticket, but were passed from one authentication engineer to another, always requiring a new log capture and upload. After 10 engineers I gave up :)

Browser-Login works with CBA, Windows-Login works with Smartcard, but no PRT so far - only with a successful username/password-login. Seems like anything is missing between the Smartcard-Login on the device and EntraID, that is issuing the PRT.

We're using a ECDSA certs from our CA with Yubikeys, also in a Hybrid Environment.