search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.26k stars 21.43k forks source link

After Log-out, "use another account" does not work correctly #36903

Closed mvancamp closed 5 years ago

mvancamp commented 5 years ago

After logging out from the first (successful) session, getting information from the MS Graph API, when trying to log on with another account (from another user within the same organizations AAD on a computer logged on with my account to the network), does not work correctly. After putting in the other account name on the UI it goes immediately to the UI page "Taking you to your organisations' sign-in page" and returns the graph information from my original sign-on session. For our application it should be possible to log-on to a desktop application, no matter which user is logged on to the windows session. What am I missing?

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

frankhu-2021 commented 5 years ago

@mvancamp Thanks for your feedback! We will investigate and update as appropriate.

frankhu-2021 commented 5 years ago

Hey @mvancamp it sounds like there's an issue with the single sign on, is this on a work computer where you're machine is joined to the work's domain? Have you tried using a private browsing session?

frankhu-2021 commented 5 years ago

Hey @mvancamp I'm following up on this could you please respond at your earliest convenience? It looks like you might have an issue with your environment, and the github issues are really meant for issues with the docs.

I can continue troubleshooting with you in regards to this, but it may require a deeper look into the existing environment to figure out what's going on in regards to this.

mvancamp commented 5 years ago

Hi @FrankHu-MSFT, sorry for posting this on the wrong thread and I'm in the Central European Time zone, that's why I respond only now.
As you said the application runs on a work computer joined to the work's domain. It is an application with a WPF UI and WCF services that we are migrating towards Azure. Authentication was previously done on LDAP. For the migration we like to authenticate against Azure Active Directory using the MS Authentication Library (in a single tenant environment) and like to get rid of user/password (ROPC) authentication, therefor using AcquireTokenInteractive authentication. Since it is a desktop application I cannot test it in a private browsing session. The application tends to run on lab workstations logged on to the domain with a shared account. Users need to logon to the application with their credentials, for tracebility and auditing reasons. With the Interactive mode users should be able to select a different account than the account the workstation is logged on to the domain. Thanks for your thoughts.

frankhu-2021 commented 5 years ago

Hey @mvancamp i see, so this is a custom application is that right?

Is the issue with your custom application when you are calling the AcquireTokenInteractive call from the MSAL Library?

mvancamp commented 5 years ago

Hi @FrankHu-MSFT, it is actually with the sample code for this article. As a pre-test to verify the functionality for the real (custom) Application.

frankhu-2021 commented 5 years ago

Hello @mvancamp please see the help section. https://docs.microsoft.com/en-us/azure/active-directory/develop/tutorial-v2-windows-desktop#help-and-support

image

My suggestion is to file a github issue against the MSAL library that you're having issues with. Please see : https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues This is where you will file the github issue related to your issue. They will be better suited to help you with this, but there isn't much that can be done in regards to this as it's an issue with the sso on your machine and it will automatically log the user in as the user.

@mvancamp Please let us know if there are anymore questions within the scope of this git issue. If not, I will be closing out this git issue by end of day today. Please reopen this git issue if you have anymore concerns. Thanks

mvancamp commented 5 years ago

Hi @FrankHu-MSFT, many thx for you explanation. I will look into those documentation and verify my workstation settings. Please close this thread. Regards