b2c prompt=login not working as expected
We are noticing an odd behavior with the prompt=login option using B2C custom policies and could use some help from this support forum.
My requirement is to force re-auth for the following use case: “Sign in as a different user” or “Hi John Doe! Not you? Click here”.
B2C is federated with Entra ID (SAML).
When passing prompt=login, user is forced to enter the credentials only 50% of the time. ie. getting prompted for every other attempt and this is very consistent.
--- Steps to reproduce ---
- Sign in with a federated account (Entra ID) using a test application - jwt.ms
- Within the same browser window, I paste the above link, opting for federated login, which then prompts for credentials by invalidating the session from previous step... this is expected and the correct experience.
- Attempt the link once more, and this time it would sign-in without prompting for password. This is my issue.
- Revisiting the link will again prompt for password.
- Repeat the step, and this time it would login using existing session.
I am looking for a fix to always prompt the user for credentials when prompt=login is passed to the url query parameters.
Thanks.