Sign out does not clear SSO token

[clairernovotny]

Looking at the code, I don't see Sign Out being properly implemented. There is a way to remove the user tokens from the local cache, but it does not appear to invoke the system web view to hit the end_session_endpoint endpoint value. That may leave the cookie between the system and the device valid such that a subsequent authenticate call may not prompt for credentials.

Seems like the end_session_endpoint value should be read from the OIDC metadata and then invoked on a sign out?

[kpanwar]

Yep, that's the plan. We need a few more things sorted out on STS side, hence we did not push it out for preview.

[clairernovotny]

@kpanwar good to hear -- I didn't see it implemented in any of the MSAL libraries either, so I filed an issue on the iOS and Android ones too.

[wmwood]

Any updates? or a work around. In general when a user clicks "log out" they trust that it will indeed log them out. In the current state my user clicks log out and if they choose to login again - they click once and they're logged in without prompt. So much for logout...

[jmprieur]

@wmwood this is something we still need to do.

[jmprieur]

Sign-off currently clears tokens. We need to update the code to lauch the web-view to do a sign-off from device (by telling the IDP to sign-off, now that AAD implements it)

[teelinmaloney]

@jmprieur Any timeframe on the web-view for sign-off and is there a temporary work around? If users enter the wrong creds they are unable to re-auth using the correct account. Also, I would expect UIBehavior.ForceLogin to prompt the user for credentials but this doesn't seem to have any effect.

[jmprieur]

This is on our backlog
cc: @henrik-me @jennyf19

[jmprieur]

@teelinmaloney : as far as a work around is concerned, did you notice that in the sign-in web view, there is a vertical … on identities. this triggers a contextual menu with 2 options:

• disconnect
• sign-out and forget.
  

[ismael9291]

Any updates on the possibility of signing out for iOS

[henrik-me]

@ismael9291 : do you mean in the Xamarin iOS or native iOS library? if native iOS please post the question here: https://github.com/AzureAD/microsoft-authentication-library-for-objc

[henrik-me]

We are still awaiting for the service to be able to support sign-out. Also this needs to be aligned with other libraries to ensure consistent behavior.

[shripathi-kamath]

Any progress on this? Or any workarounds? The use case for me is the desktop. I need to implement an inactivity timeout to sign out the logged in user and prompt him to log in again. Trouble is, the sign-on screen shows the last logged in user as already logged in. Despite removing the accounts as described in the API.

[bgavrilMS]

Hi @shripathi-kamath - you have some control over the browser by using the .WithPrompt method. AFAIK Prompt.ForceLogin will always force the user to enter their password.

var result = await pca.AcquireTokenInteractive(_scopes)
                        .WithPrompt(Prompt.ForceLogin)
                        .ExecuteAsync()

[shripathi-kamath]

Thank you kindly, Bogdan. I tried your suggestion and it appears to be adequate for my workflow.

[ffwdq]

ForceLogin doesnt seem to work with social idps, is there a way around that?

[bgavrilMS]

@ffwdq - ForceLogin sets a URL param of prompt=login. The prompt param is OAuth2 standard, but I don't think the values are. For example Google seems to allow only "none", "consent" and "select_account".

In fact, B2C recommends that you do not use Prompt and B2C wants to handle this on their own. I am not sure how to achieve your scenario with B2C, @jennyf19 - any ideas?

[ffwdq]

Thanks for the answer, ended up using CefSharp in ICustomWebUi and running it in incognito mode

[bgavrilMS]

@ffwdq - wow, cool!

[frolific]

Any update on this? IMO, this should not be marked as an enhancement - it's a defect that can potentially lead to PII issues.

[jennyf19]

In the UI, you can click the vertical three dots, and hit "forget the account", this is the way suggested by Azure AD. The user has to make this decision, not the SDK.
closing as external.

[suchithm]

AcquireTokenInteractive(scopes).WithPrompt(Prompt.ForceLogin);

This option not working for B2C login. Any alternat options?