MSAL.net prompt=select_account/forcelogin

Question

I am using MSAL.net Azure AD login in my project. But having issues on login when user have already sign in on a machine with multiple Microsoft accounts.And while logging in to the application it takes random account. I want to restrict user to select account every time they click on login.

Startup.auth.cs class

public void ConfigureAuth(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    app.UseCookieAuthentication(new CookieAuthenticationOptions());

    // Custom middleware initialization. This is activated when the code obtained from a code_grant is present in the querystring (&code=).
    app.UseOAuth2CodeRedeemer(
        new OAuth2CodeRedeemerOptions
        {
            ClientId = AuthenticationConfig.ClientId,
            ClientSecret = AuthenticationConfig.ClientSecret,
            RedirectUri = AuthenticationConfig.RedirectUri
        });

    app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            Authority = AuthenticationConfig.Authority,
            ClientId = AuthenticationConfig.ClientId,

            RedirectUri = AuthenticationConfig.RedirectUri,
            PostLogoutRedirectUri = AuthenticationConfig.PostLogoutUrl,
            Scope = AuthenticationConfig.BasicSignInScopes,
            TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false
            },
            Notifications = new OpenIdConnectAuthenticationNotifications()
            {
                AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                AuthenticationFailed = OnAuthenticationFailed,
            },
            CookieManager = new SameSiteCookieManager(
                             new SystemWebCookieManager())
        });
}


Login Action Code:-
HttpContext.GetOwinContext().Authentication.Challenge(
                        new AuthenticationProperties { RedirectUri = "/account/logincallback" },
                        OpenIdConnectAuthenticationDefaults.AuthenticationType);

user_6638547 · Answer

I found the solution for this. Inside RedirectToIdentityProvider need to set extra params by adding context.ProtocolMessage.SetParameter(, )

Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    RedirectToIdentityProvider = context =>
                        {
                            context.ProtocolMessage.SetParameter("prompt", "login");
                            return Task.FromResult(0);
                        },
                    
                }
            };

MSAL.net prompt=select_account/forcelogin

1 Answers