Federated Google Login - Microsoft Entra External ID

Question

Hi,

I have setup an "Entra External Id" and federated login to google. I works all fine from my SPA application. But after like a day or so when i open my app again and i think the tokens needs to refresh it goes:

My App -> Ciam Login -> Google

But it gets stuck showing "parameter not allowed for this message type: username"
I can just hit F5 and then it works. But i would like to know why this hapens and if this is something i need to fix on my end or if there are some config i forgot in Azure or maybe a bugg in Azure Entra Extenal Id.

Answer 1

Hello,

Just in case it helps others, I implemented the workaround advised above by Rukmini in my .Net Core 9 c# Razor Pages web app by adding an options.Events.OnRedirectToIdentityProvider handler to AddMicrosoftIdentityWebApp, and it works. However, of course the user experience is degraded as there is no silent login even when the token would still be valid. Any updates on getting a proper fix for this?

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(options =>
    {
        builder.Configuration.Bind("AzureAd", options);
        options.SaveTokens = true;
        options.Events.OnRedirectToIdentityProvider = (context =>
        {
            context.ProtocolMessage.Prompt = "select_account";
            return Task.CompletedTask;
        });
    });