I'm writing a JS application where the user can do front-end authentication with Microsoft, oAuth2 & openId connect. I need the user to be able to switch accounts, so logout then login another account. In the logout flow, the user is asked to "pick an account to sign out of" even if there is only one account (see popup screenshot). How could I skip this prompt?
I know that for login you can pass login_hint or sid (session ID from ID token). I tried this without success:
- With the login_hint in the url's querystring I still have the 'select account' prompt (the login_hint is the preferred_username for the user, which I successfully use for login)
- With the sid and iss in the url's querystring I get an InvalidSessionId error: AADSTS90007 Bad request. The passed session ID can't be parsed. The url looks like this :
https://login.microsoftonline.com/common/oauth2/v2.0/logout?sid=M.1234567890123456789&iss=https%3A%2F%2Flogin.microsoftonline.com%2F1234567a-1a23-1a2b-a123-12a345b67cde%2Fv2.0
(i tried with both encoded url as above and with the raw url for the iss, with the same result) What am I doing wrong here?
To give a bit more context, this prompt bothers me because I need to achieve a silent logout. The reason for this is that the oAuth popup to login is blocked by the browser, since it arrives long after the user clicked the button to switch accounts. Also, it seems that this prompt disables the post_logout_redirect_uri, so I can't use a redirect flow either.
See this github issue : https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/735