Microsoft Oauth Flow shows the Signed In users but then hides it quickly and allow only email input

Question

Microsoft Oauth Flow shows the Signed In users but then hides it quickly and allow only email input

sarath 120

When we tried to use Microsoft Oauth Flow, sometimes it shows the Signed in user and hides it immediately. Attached a GIF below for the same

Microsoft Accounts List Hiding Immediately.gif

Don't know why it does like that , is there any oauth prompt which we are giving wrong.

Please let us know

Thanks,

Sarathprasath

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-10-24T18:33:39.4166667+00:00

@sarath

I wanted to check in and see if you had any other questions or if you were able to review my previous comment?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
sarath 120 Reputation points

2023-10-25T05:55:02.8366667+00:00

@JamesTran-MSFT My bad, sorry for the delayed reply. It was a long holidays here in India. I have added my comment to your reply. Please check

1 answer

Your answer

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-10-24T18:33:39.4166667+00:00

@sarath

I wanted to check in and see if you had any other questions or if you were able to review my previous comment?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
sarath 120 Reputation points

2023-10-25T05:55:02.8366667+00:00

@JamesTran-MSFT My bad, sorry for the delayed reply. It was a long holidays here in India. I have added my comment to your reply. Please check

Answer 1

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@sarath

Thank you for your post and for sharing the GIF of your issue!

Based on the GIF you provided, it looks like the Microsoft OAuth flow is working as expected. The flow seemed to be checking if the user was already signed into their Microsoft account, which could be the reason why you saw the user displayed briefly before being redirected to the sign-in page.

To gain a better understanding of your issue to ensure this is expected behavior, can you share some more info below.

What is the expected behavior of the Microsoft OAuth flow in your application?
Are you experiencing any issues with the OAuth flow other than the brief display of the user's name?
Have you tested the OAuth flow with multiple users to see if the behavior is consistent?
Are there any error messages or indications of an issue with the OAuth flow?

Any additional information would be greatly appreciated.

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

sarath 120 Reputation points

2023-10-25T05:52:55.3066667+00:00

Hi @JamesTran-MSFT

Thanks for the reply

I have attached the gif For Gif (4).gif and I can clearly see its logged in the other tab and I try to "Sign in with Microsoft" it still shows for brief second and goes off

Here is the URL:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?access_type=offline&client_id=<client_id>&prompt=select_account&redirect_uri=https%3A%2F%2Fauth.kulastg.com%2Fapi%2Fv1%2Fauth%2Fmicrosoft_graph%2Fcallback&response_type=code&scope=offline_access+openid+email+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=6c5a19c87280b53fe6624668a5a2cc8a9e0144d7353fcb9f

Ideally I would expect it to show the already signed in account(s)

Even for Multiple accounts its still showing for a brief period and hides, here is the gif for the same

Multiple accounts.gif

Ideally I would expect it to show those 2 accounts and i have given the URL which we are giving to microsoft, do you see any change we should make there? to show the accounts which are signed in?

Please let me know

Thanks again,

Sarathprasath
sarath 120 Reputation points

2023-10-27T07:00:06.7533333+00:00

@JamesTran-MSFT : Any update on my above comment?
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-10-27T19:39:00.58+00:00

@sarath

Thank you for following up on this and for sharing another GIF so I can better understand your issue! I've reached out to my team regarding the info you sent and will update as soon as possible.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-10-31T18:09:20.0633333+00:00
@sarath

Thank you for your time and patience on this!

Based on the GIFs you provided, I can clearly see the issue you're having with the sign-in window briefly showing the signed-in accounts.

When looking at the URL you provided, it seems to be correct and includes the prompt=select_account parameter, which should prompt the user to select an account if they are already signed in.

prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.

To help further troubleshoot your issue, can you check the following:

Do you have any browser settings, extensions, firewalls, or caching that could be affecting the account selection during sign-in?

I noticed that you're using the /common endpoint, have you tried replacing /common with your tenantID or tenant name to see if that helps?

Can you capture a browser trace to see if there are any errors, hints, or messages relating to the accounts only appearing briefly. For more info - Fiddler.

Additional links:

Prompt behavior with MSAL.js - If you're using MSAL.js, it allows passing a prompt value as part of its login or token request methods.

OAuth 2.0 authorization code flow

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
sarath 120 Reputation points

2023-11-03T04:37:40.3166667+00:00
Hi @JamesTran-MSFT

Thanks for the response. I can't change the /common endpoint, since at Kula, we are planning to support both Personal and work / school accounts

Also, regarding the firewall - we don't have any firewall

Also, regarding the extension - as you can see I don't have any extension in my chrome browser profile

Also regarding the cache - I haven't disabled any cache or changed any cache in my chrome browser profile

Also I somehow couldn't upload any zip file in this, so attaching in drive link. <<Removed link due to potential PII>> In that I have attached a video and the .har file which you asked for the tracing

Also, the URL in the video is https://login.microsoftonline.com/common/oauth2/v2.0/authorize?access_type=offline&client_id=<client_id>&prompt=select_account&redirect_uri=https://somedomain.com/some_path&response_type=code&scope=offline_access openid email profile https://graph.microsoft.com/User.Read&state=2f70ec8c602291ee86c4f9423d30b2ef7de40544757788c9

Please check & let know

Thanks again

Sarathprasath
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-11-03T22:14:20.7933333+00:00
@sarath

Thank you for the detailed follow up on this!

I've reached out to our MS Entra ID (Azure AD) team to see if they can look into your issue and will update as soon as possible! In the meantime, when it comes to updating the /common endpoint with your tenantID or tenant name, are you able to change it for testing purposes?

Since the /common endpoint encompasses all Microsoft Entra tenants, when the Microsoft identity platform receives a request on the /common endpoint, it signs the user in, thereby discovering which tenant the user is from. When it comes to supporting personal and work/school accounts, this should still be supported if your App Registration's supported account type is Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox).

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator

2023-11-10T00:55:45.9733333+00:00

Hello @sarath , let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.
sarath 120 Reputation points

2023-11-10T08:27:28.11+00:00

Hi @Alfredo Revilla - Upwork Top Talent | IAM SWE SWA :
Thanks for asking, the problem is not resolved yet and I'm waiting for @JamesTran-MSFT to comeback from their team

Also regarding the suggestion given by @JamesTran-MSFT for replacing the /common endpoint with /tenantId it doesn't work for me

It gave the below error, when we tried to sign

here is our replaced url with tenantId: https://login.microsoftonline.com/f3df610a-c697-4a90-9423-e099050c2149/oauth2/v2.0/authorize?access_type=offline&client_id=4654be32-d09b-486a-98f6-c1072cb45585&prompt=select_account&redirect_uri=https%3A%2F%2Fauth.opspals.com%2Fapi%2Fv1%2Fauth%2Fmicrosoft_graph%2Fcallback&response_type=code&scope=offline_access+openid+email+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=3011a67941e47644713780a25b87191c5045bcaefea859cf

Please help

Thanks,

Sarathprasath
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-11-10T18:57:18.4566667+00:00
Thank you for following up on this and I apologize for the delayed response! I'm still waiting on our engineering team to look into your issue and will provide an update as soon as possible.

In the meantime, when looking at your error message can you see if adding the user that you're trying to sign-in with to the tenant helps? For more info.

Because you've been running into this issue for a while - if have an active Azure Subscription ID and would like to work closer with our MS Entra ID support team on this, please let me know.

I'd be happy to enable a one-time free technical support request for your subscription so you can work with our support engineers to get this issue resolved.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
sarath 120 Reputation points

2023-11-13T07:52:55.2233333+00:00

Hi @JamesTran-MSFT

Thanks for actively following up on this.

Since we are having Multitenant Architecture, we can't invite the each of our account user's to our tenant. If the user is already with our portal, its not happening.

For example, since "@getkula.io" is already registered user in our tenant, this is not happening. For "@outlook.com" which is a personal live account, which is not registered in our tenant, this is consistently getting reproduced & I have been giving the gif's and other things which you asked for debugging

Regarding your ask on whether we have an active Azure Subscription Id, here is our Id: ...ce5deab38b02 and please do the needful with Entra ID Support

Let me know if any

Thanks,

Sarathprasath
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-11-13T21:53:50.4866667+00:00
@sarath

Thank you for the quick response on this! I enabled your subscription (...ce5deab38b02) for a free technical support request, this will be available to you for the next 72hrs.

To create the support request, please do the following:

Go to the Health Advisory section within the Azure Portal: https://aka.ms/healthadvisories

Select the Issue Name You have been enabled for one-time Free Technical Support

Details will populate below in the Summary Tab within the reading pane, and you can click on the link Create a Support Request to the right of the message.

If you have any issues opening the support request, please let me know.

Thank you for your time and patience throughout this issue.

Share via

Microsoft Oauth Flow shows the Signed In users but then hides it quickly and allow only email input

1 answer

Your answer