MSAL ANDROID : MultiAccountMode issue with Logout

Question

MSAL ANDROID : MultiAccountMode issue with Logout

Prakash, Tinju 6

We are facing issues to logout from Android application after login. While logout, it displays a screen where the already logged in email displays, tapping on that allows the user to login to the application with out a password. The application is configured as MultiAccount mode. Below is the code for logout.
removeAccountButton.setOnClickListener(new View.OnClickListener() {
public void onClick(View v) {
if (mMultipleAccountApp == null) {
return;
}

            /**  
             * Removes the selected account and cached tokens from this app (or device, if the device is in shared mode).  
             */  
            mMultipleAccountApp.removeAccount(accountList.get(accountListSpinner.getSelectedItemPosition()),  
                    new IMultipleAccountPublicClientApplication.RemoveAccountCallback() {  
                        @Override  
                        public void onRemoved() {  
                            Toast.makeText(getContext(), "Account removed.", Toast.LENGTH_SHORT)  
                                    .show();  

                            /* Reload account asynchronously to get the up-to-date list. */  
                            loadAccounts();  
                        }  

                        @Override  
                        public void onError(@NonNull MsalException exception) {  
                            displayError(exception);  
                        }  
                    });  
        }  
    });

Prakash, Tinju 6 Reputation points

2022-12-12T12:12:28.097+00:00

We need the user to remember the email but enter the password every time they login.

1 answer

Your answer

Prakash, Tinju 6 Reputation points

2022-12-12T12:12:28.097+00:00

We need the user to remember the email but enter the password every time they login.

Answer 1

Shweta Mathur 30,296 Microsoft Employee Moderator

Hi @Prakash, Tinju ,

Thanks for reaching out.

From your query, I understand you are looking to prompt the user to enter the credentials to login into Android application.

Generally, you can achieve this by clearing the cache but in android we can't clear the cookies.

If your app is configured to use a broker, then only tokens associated with your client are removed but account won't be removed using removeAccount().

To prompt the user for credentials, you need to prompt the user by calling AcquireTokenInteractive().

Hope this will help.

Thanks,
Shweta

-----------------------------------------

Please remember to "Accept Answer" if answer helped you.

Prakash, Tinju 6 Reputation points

2022-12-14T11:03:58.5+00:00

Hi @Shweta Mathur

Thank you for the reply. But calling AcquireTokenInteractive() after calling removeAccount() is displaying the list of already logged in email ids, tapping on any of them allows me to login to the application without a password. As I mentioned in the comment, we need the system to remember the already logged in emails but should ask for the password every time they login.

Are we missing to implement anything?

Please help!
Prakash, Tinju 6 Reputation points

2022-12-14T17:01:12.387+00:00
Team, please find below the details for our implementation and the issues we are facing as part of 'MultiAccountMode' with logout. Please review our implementation and help us to resolve the issues,

Implementation:

Removes the selected account and cached tokens from the app. We are making use of the 'removeAccount' of the MSAL, 'mMultipleAccountApp.removeAccount'

In the 'onRemoved' success callback, we are clearing the cache and invoking the 'getAccounts' to get the updated account list.

Expected results:

Once the user is logged out by following the above steps(implementation), the MSAL should prompt the user for entering the 'Password' on selecting any of the removed account from the list or (the account should be removed completely ).

Issue:

Even after successful logout user can still sign in by selecting any of the account and can login to the app with out entering the credentials which is a security concern.

If the removeAccount API is not removing the already signed in account, Please suggest us a way to remove the logged in account or sign out from the app.
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-12-20T10:24:28.773+00:00

As a workaround, you can try conditional access to require users to enter their passwords at least once every x hours / days.

Details at https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime
From the developer perspective, when you call AcquireTokenSilent, MSAL will throw an MsalUiRequiredException and the user will have to re-enter their password.

Let me know if that will help you.

Thanks,
Shweta

Share via

MSAL ANDROID : MultiAccountMode issue with Logout

1 answer

Your answer