AD B2C SSO between two applications

Question

AD B2C SSO between two applications

Vasant Horapeti 1

We have two applications which are AD B2C for SSO

App 1 - Sitecore (Based on .NET core)
App 2 - React Web app (SPA)

We would like to have SSO behavior between these two applications. Currently we have the policy set to as follows . <SingleSignOn Scope="Tenant" />

Both the applications are using same tenant. But still the if App1 sign in, when clicked on App2, it is not automatically taking the signed in session, instead, it is asking to sign-in again on App2, What is the configuration we have to achieve SSO behavior?

1 answer

Your answer

Answer 1

AmanpreetSingh-MSFT 56,871 Moderator

Hi @Vasant Horapeti • Thank you for reaching out.

From your question, I understood that in your custom policy you have set Single-sign-on configuration to Tenant. Despite that, when you authenticate two different applications via the same User flow, you have to authenticate for each application.

The only reason I can think of, that could be contributing to the issue, is the usage of the prompt parameter in the authentication request. This parameter indicates the type of user interaction that is required. When prompt=login parameter is present in the authentication request, it forces the user to enter their credentials on that request, negating single-sign on.

If you are passing prompt=login in authentication request, try removing it and test again.

Other valid values that can be set for this parameter, are:

prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error.
prompt=consent triggers the OAuth consent dialog after the user signs in, asking the user to grant permissions to the app.
prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Vasant Horapeti 1 Reputation point

2022-02-27T11:13:35.653+00:00

Hi @AmanpreetSingh-MSFT . Thanks for quick response on this. When the application redirects to login, I don't see this prompt parameter. How and where I can set to none?
AmanpreetSingh-MSFT 56,871 Reputation points Moderator

2022-02-27T11:20:54.323+00:00
@Vasant Horapeti • Please refer to the below example in Prompt behavior in MSAL.js interactive requests

var request = { scopes: ["user.read"], prompt: 'select_account', } userAgentApplication.loginRedirect(request);
Vasant Horapeti 1 Reputation point

2022-02-27T11:45:08.247+00:00

@AmanpreetSingh-MSFT .. I changed prompt to select_account, still I am getting login prompt. As far as I understand, the session details are stored in session cookies. Is there any specific session cookies that I should verify? Also don't see any session cookies on React app, even though we have settings storeAuthStateInCookie: true.

Please let me know if both the application need to follow any settings that make session cookies common between two application
AmanpreetSingh-MSFT 56,871 Reputation points Moderator

2022-02-27T12:00:11.397+00:00

@Vasant Horapeti • Did you try setting prompt=none?

As mentioned in the Cookies definitions for Azure AD B2C document, the x-ms-cpim-sso:{Id} cookie is used to maintain the SSO session. Do you see this cookie being set? Also, try copying the Run Now endpoint from the B2C policy that you are using, modify the URL parameters such as client_ID, Redirect_URI, and any other parameter that is unique to these apps and test if SSO is working or not.
Vasant Horapeti 1 Reputation point

2022-02-27T12:54:43.123+00:00

@AmanpreetSingh-MSFT .. I see this cookie is being set - x-ms-cpim-sso:{Id} , but still it's prompting for sign-in, I also tried with prompt=none
AmanpreetSingh-MSFT 56,871 Reputation points Moderator

2022-02-28T12:51:30.197+00:00

@Vasant Horapeti • Please refer to these samples and compare them with your code:
.Net Core Sample: https://github.com/Azure-Samples/ms-identity-dotnetcore-b2c-account-management
React SPA Sample: https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/blob/main/1-Authentication/2-sign-in-b2c/README.md

Share via

AD B2C SSO between two applications

1 answer

Your answer