search

AzureAD / microsoft-authentication-library-for-js

Microsoft Authentication Library (MSAL) for JS
http://aka.ms/aadv2
MIT License
3.64k stars 2.65k forks source link

App continuously reloading the page while trying to make a request to a protected API #3026

Closed karrocon closed 3 years ago

karrocon commented 3 years ago

Originally posted here.

Library

Framework

Description

When trying to make a request to a protected API client app keeps looping without actually making the request.

Error Message

Logs:

core.js:27701 Angular is running in development mode. Call enableProdMode() to enable production mode. app.module.ts:23 [Mon, 15 Feb 2021 10:12:29 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectStart core.js:27701 Angular is running in development mode. Call enableProdMode() to enable production mode. app.module.ts:23 [Mon, 15 Feb 2021 10:12:43 GMT] : : @azure/msal-common@4.0.0 : Info - in acquireToken call client:52 [WDS] Live Reloading enabled. app.module.ts:23 [Mon, 15 Feb 2021 10:12:44 GMT] : : @azure/msal-browser@2.11.1 : Info - BrowserCacheManager.cleanRequestByState: Removing temporary cache items for state: eyJpZCI6ImEwZmMwNzJiLTUxYjUtNDc5NC04ZTBlLTc5YTg0YjkyNzViYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0= app.module.ts:23 [Mon, 15 Feb 2021 10:12:50 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenSuccess app.module.ts:23 [Mon, 15 Feb 2021 10:12:50 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectEnd app.module.ts:23 [Mon, 15 Feb 2021 10:12:50 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectStart app.module.ts:23 [Mon, 15 Feb 2021 10:12:51 GMT] : : @azure/msal-browser@2.11.1 : Info - handleRedirectPromise called but there is no interaction in progress, returning null. app.module.ts:23 [Mon, 15 Feb 2021 10:12:51 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectEnd app.module.ts:23 [Mon, 15 Feb 2021 10:12:51 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Info - Interceptor - 1 scopes found for endpoint app.module.ts:23 [Mon, 15 Feb 2021 10:12:51 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenStart app.module.ts:23 [Mon, 15 Feb 2021 10:12:58 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenFromNetworkStart app.module.ts:23 [Mon, 15 Feb 2021 10:12:59 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenSuccess app.module.ts:23 [Mon, 15 Feb 2021 10:12:59 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Error - Interceptor - acquireTokenSilent resolved with null access token. Known issue with B2C tenants, invoking interaction to resolve. app.module.ts:23 [Mon, 15 Feb 2021 10:12:59 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenStart

Screenshot:

image

MSAL Configuration

export function MSALInstanceFactory(): IPublicClientApplication {
  return new PublicClientApplication({
    auth: {
      clientId: 'e28c4d7c-0b43-4670-b709-f5657ec3d4af',
      authority: b2cPolicies.authorities.signUpSignIn.authority,
      redirectUri: '/',
      postLogoutRedirectUri: '/',
      knownAuthorities: [b2cPolicies.authorityDomain]
    },
    cache: {
      cacheLocation: BrowserCacheLocation.LocalStorage,
      storeAuthStateInCookie: isIE, // set to true for IE 11
    },
    system: {
      loggerOptions: {
        loggerCallback,
        logLevel: LogLevel.Info,
        piiLoggingEnabled: false
      }
    }
  });
}

export function MSALInterceptorConfigFactory(): MsalInterceptorConfiguration {
  const protectedResourceMap = new Map<string, Array<string>>();
  protectedResourceMap.set(apiConfig.uri, apiConfig.scopes);

  return {
    interactionType: InteractionType.Redirect,
    protectedResourceMap,
  };
}

export function MSALGuardConfigFactory(): MsalGuardConfiguration {
  return {
    interactionType: InteractionType.Redirect,
    authRequest: {
      scopes: [...apiConfig.scopes],
    },
  };
}

b2c-config.ts

const baseAuthorityUrl = 'https://frontsystemsincubation.b2clogin.com/frontsystemsincubation.onmicrosoft.com';
/**
 * Enter here the user flows and custom policies for your B2C application,
 * To learn more about user flows, visit https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-flow-overview
 * To learn more about custom policies, visit https://docs.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-overview
 */
export const b2cPolicies = {
    names: {
        signUpSignIn: "b2c_1_susi",
        forgotPassword: "b2c_1_reset",
        editProfile: "b2c_1_profile"
    },
    authorities: {
        signUpSignIn: {
            authority: `${baseAuthorityUrl}/b2c_1_susi`,
        },
        forgotPassword: {
            authority: `${baseAuthorityUrl}/b2c_1_reset`,
        },
        editProfile: {
            authority: `${baseAuthorityUrl}/b2c_1_profile`
        }
    },
    authorityDomain: "frontsystemsincubation.b2clogin.com"
};

/**
 * Enter here the coordinates of your Web API and scopes for access token request
 * The current application coordinates were pre-registered in a B2C tenant.
 */
export const apiConfig: {scopes: string[]; uri: string} = {
    scopes: ['https://frontsystemsincubation.onmicrosoft.com/api/authentication/permissions.read'],
    uri: 'http://localhost:5000'
};

Reproduction steps

Using this sample client and API with my own Azure AD B2C.

Expected behavior

The client should be able to retrieve the token using the authorization code flow to make the request to the API with the required scope.

Identity Provider

Browsers/Environment

Regression

Security

Source

pkanher617 commented 3 years ago

@karrocon Could you provide the "verbose" level logs? Also, are you able to reproduce this issue with this sample?

karrocon commented 3 years ago

Yes. I'm using that sample for the client code.

These are the "verbose" level logs:

[Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Event callback registered with id: aa5d5687-2652-4854-9abd-6af453eb2bd1 core.js:27701 Angular is running in development mode. Call enableProdMode() to enable production mode. app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:handleRedirectStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - BroadcastService - msal:handleRedirectStart results in setting inProgress to handleRedirect app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - handleRedirectPromise called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getRedirectResponseHash called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Hash contains known properties, returning response hash app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - validateAndExtractStateFromHash called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Returning state from hash app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - State extracted from hash app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Current page is loginRequestUrl, handling hash app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - handleHash called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - initializeServerTelemetryManager called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - createAuthCodeClient called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getClientConfiguration called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getDiscoveredAuthority called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Creating discovered authority with request authority core.js:27701 Angular is running in development mode. Call enableProdMode() to enable production mode. app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-common@4.0.0 : Info - in acquireToken call app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - BrowserCacheManager.cleanRequestByState: Removing temporary cache items for state: eyJpZCI6IjE2MTU1ZmZmLTc3MWUtNDYzOC05MGNmLTQyM2UzNThiZjg4MSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0= app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenSuccess app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:acquireTokenSuccess app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - BroadcastService - msal:acquireTokenSuccess results in setting inProgress to none app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - handleRedirectResponse returned result, acquire token success app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectEnd app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:handleRedirectEnd app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - BroadcastService - msal:handleRedirectEnd results in setting inProgress to none app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - Guard - canActivate app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - MSAL Guard activated app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:handleRedirectStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - BroadcastService - msal:handleRedirectStart results in setting inProgress to handleRedirect app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - handleRedirectPromise called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - handleRedirectPromise called but there is no interaction in progress, returning null. app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:handleRedirectEnd app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:handleRedirectEnd app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - BroadcastService - msal:handleRedirectEnd results in setting inProgress to none app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - Guard - account retrieved, can activate or load app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - MSAL Interceptor activated app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - Interceptor - getting scopes for endpoint app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getActiveAccount: No active account app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - Interceptor - no active account, fallback to first account app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Info - Interceptor - 1 scopes found for endpoint app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - preflightBrowserEnvironmentCheck started app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - acquireTokenSilent called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Initializing BaseAuthRequest app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:acquireTokenStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - initializeServerTelemetryManager called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - createSilentFlowClient called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getClientConfiguration called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getDiscoveredAuthority called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Creating discovered authority with request authority app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenFromNetworkStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:acquireTokenFromNetworkStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Initializing BaseAuthRequest app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - initializeServerTelemetryManager called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - createRefreshTokenClient called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getClientConfiguration called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getDiscoveredAuthority called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Creating discovered authority with request authority app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenSuccess app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:acquireTokenSuccess app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Error - Interceptor - acquireTokenSilent resolved with null access token. Known issue with B2C tenants, invoking interaction to resolve. app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-angular@2.0.0-alpha.5 : Verbose - Interceptor - error acquiring token silently, acquiring by redirect app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - preflightBrowserEnvironmentCheck started app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - acquireTokenRedirect called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getAllAccounts called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Info - Emitting event: msal:acquireTokenStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Emitting event to callback aa5d5687-2652-4854-9abd-6af453eb2bd1: msal:acquireTokenStart app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - BroadcastService - msal:acquireTokenStart results in setting inProgress to acquireToken app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - preflightInteractiveRequest called, validating app environment app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - initializeAuthorizationRequest called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getRedirectUri called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Initializing BaseAuthRequest app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getActiveAccount: No active account app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - initializeServerTelemetryManager called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - createAuthCodeClient called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getClientConfiguration called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getDiscoveredAuthority called app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - Creating discovered authority with request authority app.module.ts:23 [Tue, 16 Feb 2021 17:40:06 GMT] : : @azure/msal-browser@2.11.1 : Verbose - getRedirectStartPage called

pkanher617 commented 3 years ago

Error - Interceptor - acquireTokenSilent resolved with null access token. Known issue with B2C tenants, invoking interaction to resolve.

@karrocon It looks like this is stemming from this issue here where B2C requests are returning a null or empty access token.

Could you check whether you are getting an access token back in the token response? If you aren't, please try the mitigations in the link above. If you are getting an access token, then it may be that the login call is being invoked before the redirect promise has resolved (although from the logs it doesn't look like this is the case). Please make sure you aren't doing any login calls before the handleRedirectObservable has resolved and the InteractionType has been set to InteractionType.None.

github-actions[bot] commented 3 years ago

This issue has not seen activity in 14 days. If your issue has not been resolved please leave a comment to keep this open. It will be closed in 7 days if it remains stale.

karrocon commented 3 years ago

I finally found out that the issue was caused by a misconfiguration in the Azure AD B2C directory.

I'm closing this issue.