CODEWITHSUNDEEP
azure-active-directory
Geist
Geist

Reputation: 21

Is it possible to prevent automatic sign-on through Azure Active Directory

We're working on a SAAS application that has recently been configured to use Azure ADAL for authentication. If it matters, we're going the oauth2 route, with response_type: code.

However, when we're testing the application, if the browser has been signed into an Azure account that does not belong to the tenant acting as identity provider, the prompt for password is bypassed, and the login fails on the Azure screen, saying AADSTS50020 - user not found in tenant.

On the one hand, congratulations to Azure for finding an already signed in user! On the other hand, there is no recourse to elect to not use this signed in user; it does not give the user the chance to interject with credentials that work.

How can we prevent this?

The core issue is we don't want users, visiting our site and ready to sign in, to have to have already signed out of Azure before trying to log in with our site.

Thanks in advance.

Upvotes: 1

Views: 3542

Answers (1)

Nan Yu
Nan Yu

Reputation: 27538

Please refer to https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-code

You could find when requesting an authorization code during code flow , there is a Parameter :prompt indicates the type of user interaction that is required .

Valid values are:

login: The user should be prompted to reauthenticate.

select_account: The user is prompted to select an account, interrupting single sign on. The user may select an existing signed-in account, enter their credentials for a remembered account, or choose to use a different account altogether.

consent: User consent has been granted, but needs to be updated. The user should be prompted to consent.

admin_consent: An administrator should be prompted to consent on behalf of all users in their organization

You could use prompt=login forces the user to enter their credentials on that request, negating single-sign on

Upvotes: 6

Related Questions