Does using one registered app for two web apps only allow a user to login to one app at a time via EntraID?

Question

Does using one registered app for two web apps only allow a user to login to one app at a time via EntraID?

Juwon Park 0

I have two Blazor web app project: App1 & App2. Both of them are deployed to one Azure app service. App1 is deployed to root "/" and App2 is deployed to virtual application as "/app2".

I'm trying to use one app registration, so App1 and App2 will share the same registered app in Azure. However, this blocks user to login to App1 when the user is already logged in to App2 and vice versa. I'm using EntraID for user authentication.

Is there a way to allow user to login to both of the app at the same time?

1 answer

Your answer

Answer 1

brtrach-MSFT 17,741 Microsoft Employee Moderator

@Juwon Park Using a single app registration for multiple web apps can indeed cause issues with simultaneous logins due to how session cookies and tokens are managed. Here are a few strategies to address this:

Single Sign-On (SSO): Ensure that both apps are configured to use Single Sign-On (SSO) with Microsoft Entra ID. This allows users to authenticate once and access both applications without needing to log in again
Separate App Registrations: Consider creating separate app registrations for App1 and App2. This way, each app will have its own set of tokens and session cookies, preventing conflict.
Token Sharing: If you prefer to use a single app registration, you might need to implement a mechanism to share tokens between the two applications. This can be complex and requires careful handling of security and token lifetimes
Custom Authentication Logic: Implement custom authentication logic that can handle multiple sessions for the same user across different applications. This might involve custom middleware or modifications to how tokens are issued and validated

Juwon Park 0 Reputation points

2024-12-10T14:49:23.1466667+00:00

What would be the best method to enable the token sharing between the two applications?
Juwon Park 0 Reputation points

2024-12-10T14:50:40.99+00:00

What would be the best method to token share between the two applications?
Juwon Park 0 Reputation points

2024-12-10T19:26:37.4633333+00:00

I tried 1 and 2. It seems like there can't be more than one authentication happening in a single web service server. Is that right?
Bruce (SqlWork.com) 77,926 Reputation points Volunteer Moderator

2024-12-10T23:06:22.3566667+00:00
no. the azure login site has a cookie. once the browser logins into one site this cookie is set. when the other site redirects to azure ad, azure finds the user already logged and redirects back with the access code. the access code is used to get the id token, access token and optional refresh token.

each site will have its own authentication cookie. this cookie is loaded from the id token. then the Blazor app is loaded it used the identity loaded from this cookie to create the Blazor authentication state.

if you wanted access tokens to use a bearer tokens in webapi calls, then:

for Blazor server you need to use a distributed cache (say redis) to store the access token in (its keyed by user id).

for Blazor wasm, you would use the msal library directly, and store the access token locally (often local storage).
Juwon Park 0 Reputation points

2024-12-10T23:13:05.0433333+00:00

Got it. My app deployed to root directory can login correctly but when I open the app deployed to virtual application path “/app2” it keeps trying to login and fails to login after few tries and return login page with "We couldn't sign you in. Please try again." message . What might cause this issue?
Bruce (SqlWork.com) 77,926 Reputation points Volunteer Moderator

2024-12-16T20:59:24.3566667+00:00

the app registration needs both reply urls. also be use the subsite is using its own authentication cookie path. if you want to share authentication cookie between sites, then you need to configure common data protection services.

note: be sure the two sites have separate app pools.

Share via

Does using one registered app for two web apps only allow a user to login to one app at a time via EntraID?

1 answer

Your answer