(MSAL) Force require password login with Microsoft account - Android Studio

Question

I'm working on an app for android phones to be used by multiple users, where they can log in with google or microsoft accounts, to connect the app info to microsoft teams and/or sharepoint if desired.

I'm coding on Android Studio, using MSAL supporting multiple accounts.

Underneath is a method I have to remove accounts from the current PublicClientApplication.MultipleAccountPublicClientApplication. It also returns the result for each removal, if they were removed or not, in a list of booleans.

When testing, all the accounts are removed successfully, but when signing in again and the microsoft sign in intent is opened, the accounts can just be clicked to sign in without password. Signing out seems kind of pointless because of this, since one can just select their user and be logged in again right away. Is it possible to require or force the Microsoft intent to log in with password?

public CompletableFuture> signOutAll() {

    List removedList = new ArrayList<>();
    CompletableFuture> future = new CompletableFuture();

    for (IAccount account : accountList) {

        mPCA.removeAccount(account,
                new IMultipleAccountPublicClientApplication.RemoveAccountCallback() {
                    @Override
                    public void onRemoved() {

                        removedList.add(true);

                        if (accountList.size() == removedList.size()) {

                           future.complete(removedList);
                        }
                    }

                    @Override
                    public void onError(@NonNull MsalException exception) {

                        removedList.add(false);

                        if (accountList.size() == removedList.size()) {

                            future.complete(removedList);
                        }
                    }
                });
    }

    return future;
}

--

Thank you, Didrik

user_14592431 · Answer

This is happening because MSAL automatically refreshes your token after expiration. When user opens your app it checks if that token is already present and valid. So you can remove the token from the Android KeyStore in onStop().

So yes you also need to remove the cache as well to remove the account from the cache, find the account that need to be removed and then call PublicClientApplication.removeAccount()

Set accounts = pca.getAccounts().join();

IAccount accountToBeRemoved = accounts.stream().filter(
 x -> x.username().equalsIgnoreCase(
UPN_OF_USER_TO_BE_REMOVED)).findFirst().orElse(null);
pca.removeAccount(accountToBeRemoved).join();

(MSAL) Force require password login with Microsoft account - Android Studio

2 Answers