We've added Single Sign on via Azure/Microsoft Graph to our web app using OAuth 2.0 Authorization code flow (with PKCE).
On our login page, the user enters their email. If they are set as an SSO user, they are redirected to Microsoft to login. The Microsoft login page launches in a new tab. After logging in on the Microsoft login (or if browser recognises user is already logged in to Microsoft in another tab)
- Sometimes Microsoft redirects back to our original tab (our login page) and our system reacts and we're logged in (perfect)
However,
- If I logout and go to our login page again and follow the steps above, we redirect back to our redirect URL in the new tab with our original tab still awaiting a response so we're not logged in in either tab.
- If I try again in incognito, it also just redirects in the same new tab
I can't work out why sometimes it redirects back to the original tab and logs in successfully and sometimes we get stuck redirected in the new tab resulting in no login.
It doesn't seem to matter if we're logged into Microsoft already (e.g. emails in another tab) or logged out of Microsoft. I've tried clearing browser cache/hard reloading to clear any tokens but that also doesn't change the redirect in the same tab issue.
I've spent hours trying to Google this and can't find the answer on here too so sorry if I've missed it.
Is there anything obvious we've missed?