Signout Behaviour change in Custom POlicy and Builtin user flow

Viewed 52

I am having this strange issue with my Custom Policies…. Based on SocialAndLocalAccountsWithMfa starter pack. The behaviour that we are looking for is as follows and is achieved with User flows is When the user sign-outs form the application and then hits sign in again, he should be prompted for a reauthentication. But when I use the same app to execute custom Policy it will reauthenticate without entering creds. I have adjusted the but nothing. I added and changed following in

<UserJourneyBehaviors>
      <SingleSignOn Scope="Policy" KeepAliveInDays="7" />
      <SessionExpiryType>Rolling</SessionExpiryType>
      <SessionExpiryInSeconds>900</SessionExpiryInSeconds>
      <JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="your-application-insights-key" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" /-->
</UserJourneyBehaviors>

is there a way to check if there is a failure to sign out for the user or any way to debug the issue? Or way to change the behaviour?

The application goes to the logout URL when the user hits Signout form application.

https://mytenanct.b2clogin.com/mytenanct.onmicrosoft.com/b2c_1a_signup_signin/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Flocalhost%3A44316%2F&x-client-SKU=ID_NET451&x-client-ver=5.4.0.0

Following is the url when user Clicks SignIn from the application and get logged in without authentication.

  1. Request URL: https://mytenanct.b2clogin.com/mytenanct.onmicrosoft.com/b2c_1a_signup_signin/oauth2/v2.0/authorize?client_id=ac8ca2c8-4cc3-43e3-8fd3-dcd592557f99&redirect_uri=https%3A%2F%2Flocalhost%3A44316%2F&response_mode=form_post&response_type=code%20id_token&scope=openid%20profile%20offline_access%20https%3A%2F%2FMYTENANCT.onmicrosoft.com%2Fdemoapi%2Fread%20https%3A%2F%2FMYTENANCT.onmicrosoft.com%2Fdemoapi%2Fwrite&state=OpenIdConnect.AuthenticationProperties%3Du1frIXk828jwoiEmCMuqTDTomxyjWAjDSV2---SUMJX7jDgjnKFPX4iO5VEbXPGHVgHA6GcLzPWjooSpDcTxM9iAoRUGXxDbyhBCLexjWNEMG7dqSu-wa2AqntAbcV1a0mk9dykGyrypS8gsuPtbNPvkgO_8YRuYSlRiJy8tYSA&nonce=637285777554418842.MjY2ZmVjYmEtMDY0ZS00ZTljLTk0MDUtMzk2MzkxODAyODUyZjc0NTkxZGEtN2I5YS00ODViLThkZTYtMWIwMjUyNjg3ZTc2&x-client-SKU=ID_NET451&x-client-ver=5.4.0.0

Any Help will be highly appreciated to track it down or change the behaviour

I have also configured [Single-Sigout][1] but doesn’t change the behaviour.

1 Answers

Please refer to the description on Azure Document

When you want to sign the user out of the application, it isn't enough to clear the application's cookies or otherwise end the session with the user. Redirect the user to Azure AD B2C to sign out. If you fail to do so, the user might be able to reauthenticate to your application without entering their credentials again.

GET https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Fjwt.ms%2F

Make sure you are redirect the browser to that endpoint and don't try to do a GET through a back-channel, or else it will not do anything as the Single Sign-in mechanism is based on browser cookies.

and also please refer the document

Related