CODEWITHSUNDEEP
angularsafariadalcross-site
skATsof
skATsof

Reputation: 251

Error: AADSTS50058: A silent sign-in request was sent but no user is signed in - Angular ADAL authentication issue in mobile safari browser

We have a site developed using Angular 7 and it uses Adal-Angular4 library for Azure Active Directoty authentication. When the site is browsed in safari on iPhone, it runs into below error.

Error: AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com).

When Prevent Cross-Site Scripting option of Safari browser is off then authentication gets through fine. We also observed that in Chrome browser on one of the Samsung Galaxy S8+ phones this issue occurs. Any idea what exactly is the reason for this issue and what are the ways to remediate it.

Upvotes: 14

Views: 32188

Answers (6)

Matt Corwin
Matt Corwin

Reputation: 161

I was also seeing this error because of blocked third party cookies. Since I didn't want to ask my users to allow third party cookies, I added a fallback to another sign-in method, which works even on browsers with third party cookies blocked.

try {
  const response = await instance.acquireTokenSilent({
    ...loginRequest,
    account: account,
  });

  return response.accessToken;
} catch (error) {
  if (error instanceof InteractionRequiredAuthError) {
    // fallback to interaction when silent call fails
    const response = await instance.acquireTokenPopup(loginRequest);
    return response.accessToken;
  } else {
    throw error;
}

Upvotes: 1

VAIBHAV NIRMAL
VAIBHAV NIRMAL

Reputation: 384

I faced same error on chrome while login with microsoft you just need to allow coockies that blocked on this pageallow coockies image

this will solve your issue!

Upvotes: 0

Patrick Sierak
Patrick Sierak

Reputation: 189

Make sure you aren't in incognito mode.

Upvotes: 0

munizig
munizig

Reputation: 191

I have faced this issue when accessing my angular application through the Chrome browser on incognito mode. By default, it disables third-party cookies with a toggle at the home page. I just disabled it and did not face the error again.

Disabling the option

Upvotes: 19

skATsof
skATsof

Reputation: 251

On top of what "Raghavendra- MSFT Identity" mentioned in his answer (possible resolution #2), we managed to get it working by catching the error of acquireToken call and then acquiring token using acquireTokenRedirect call. It adds up one more redirection but does the job. Please note that either with ADAL or MSAL v1, this is the only option I found from whatever research I could do. MSAL v2 i.e. @azure/msal-browser package specifically which is based on OAuth 2.0 Authorization Code Flow with PKCE eliminates any need of third-party cookies and can be an appropriate option; however, it is currently under Beta so it would take some more time before it can be used for production code.

Upvotes: 4

Raghavendra beldona
Raghavendra beldona

Reputation: 2102

Reason: The error occurs because a silent sign in is sent to the login.microsoftonline.com endpoint, however the AAD SSO cookie is not being detected. This cookie determines if the user is logged in or not. The silent sign in is only meant to be used if the user is already known to be logged in or has a refresh token to exchange for a new access token.

Possible Resolution #1 Proactively Check for Expiration You can attempt to prevent this error from ever occurring by checking if you have a valid id token. If you're ID token is not valid, you will ask the user to login again.

Possible Resolution #2 Catching the Error and Asking the User to Login Again To resolve this error you will need to catch this error in a callback that you can pass into the acquiretoken ADAL JS function. If the AADSTS50058 error occurs, you'll ask the user to login again.

Possible Resolution #3 Browser Extension Cookie Blockers and Third Party Cookies Disabled Some users may experience this issue due to a browser extension that is blocking cookies for tracking purposes. This will cause this AADSTS50058 error to occur, you will need to whitelist the login.microsoftonline.com endpoint in your browser extension in order to avoid receiving this error again.

This error can also occur if the third party cookies have been disabled in your browser. Re-enable third party cookies in your browser to prevent this error from occurring.

Please refer this link

Upvotes: 13

Related Questions