Share via

MSAL sign out does not appear to clear cache

Yousef Shahien [KP-Mobility] 36 Reputation points
2021-02-08T08:33:27.71+00:00

We have an android application integrated with azure authentication using MSAL and it's configured to be single tenant. After signing out, I would expect the app to clear its cache and require users to provide credentials when signing in again. But what happen actually that users can sign out and sign in again with same user or a previous logged in users without having to authenticate the user again (No credentials required on second logins).

Is there a way to clear cached users, or to totally sign out from the user ?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Emad Al Abed 6 Reputation points
    2021-02-08T13:04:10.453+00:00

    I have the same issue on my project , and will be waiting for an answer as well, hopefully someones from Microsoft answers this ,
    Regards

    1 person found this answer helpful.
    0 comments
  2. VipulSparsh-MSFT 16,316 Reputation points Microsoft Employee
    2021-02-09T05:02:07.69+00:00

    @Yousef Shahien [KP-Mobility] Have you tried calling the Signout API in MSAL.
    This will remove all tokens from the cache for this application for the provided account. Additionally, this API will remove account from the system browser or the embedded webView by navigating to the OIDC end session endpoint if requested in parameters. As a result of the signout operation, application will not be able to get tokens for the given account without user entering credentials.

    If you also want to do a browser sign out, you can have a look here.

    Read the code here on Github

    -----------------------------------------------------------------------------------------------------------------

    If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

  3. VipulSparsh-MSFT 16,316 Reputation points Microsoft Employee
    2021-02-10T12:44:57.22+00:00

    @Yousef Shahien [KP-Mobility]

    MSAL libraries can't control the browser cache. You do have some level of control over the interactive experience when using prompts - for example to force the user to re-enter their password, you can do:

    AcquireTokenInteractive(scopes).WithPrompt(Prompt.ForceLogin);

    On Android, the use of Chrome Custom Tabs means that we don't have any control over cookies as they are shared with the external Chrome app and thus not accessible. The user would have to manually open the website in Chrome and then log out from any identity providers. Theoretically we could automatically open the logout URL, if one exists, but clearly that would be extremely bad UX.

    Right now the issue has been handled for few frameworks by using embedded webview in MSAL.
    Check further here.

    Workaround suggested:

    A better way to deal with requirement however would be via Conditional Access. You ask the tenant admin to require users to enter their passwords at least once every x hours / days.

    Details at https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime

    From the developer perspective, when you call AcquireTokenSilent, MSAL will throw an MsalUiRequiredException and the user will have to re-enter their password.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.