b2c prompt=login not working as expected

Raj Seenivasan 0 Reputation points
2024-05-07T00:23:17.7033333+00:00

We are noticing an odd behavior with the prompt=login option using B2C custom policies and could use some help from this support forum.

My requirement is to force re-auth for the following use case: “Sign in as a different user” or “Hi John Doe! Not you? Click here”.

B2C is federated with Entra ID (SAML).

When passing prompt=login, user is forced to enter the credentials only 50% of the time. ie. getting prompted for every other attempt and this is very consistent.

--- Steps to reproduce ---

  1. Sign in with a federated account (Entra ID) using a test application - jwt.ms

https://xxxx.b2clogin.com/xxxxx.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1A_SIGNUP_SIGNIN&client_id=xxx-xxx-xxx-xxx-xxxx&nonce=defaultNonce&redirect_uri=https%3A%2F%2Fjwt.ms&scope=openid&response_type=id_token&prompt=login

  1. Within the same browser window, I paste the above link, opting for federated login, which then prompts for credentials by invalidating the session from previous step... this is expected and the correct experience.
  2. Attempt the link once more, and this time it would sign-in without prompting for password. This is my issue.
  3. Revisiting the link will again prompt for password.
  4. Repeat the step, and this time it would login using existing session.

I am looking for a fix to always prompt the user for credentials when prompt=login is passed to the url query parameters.

Thanks.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,913 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,089 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.