Adal.js - multiple user accounts belonging to different tenants/applications

Question

In our current SPA we have the same user setup in different tenants for dev, test, uat etc. e.g the user john doe will have the following a/cs.

[email protected]
[email protected]
[email protected]

We have separate applications registered in AAD for dev,test and uat. The problem occurs when [email protected] logs into the dev site has a cached token for uat and then tries to say authenticate for the uat or test site. We end up getting the following error.

Additional technical information: Correlation ID: xxxxxxx-fab9-4c08-a96f-a0c20gsgsgsgs Timestamp: 2015-12-06 17:14:34Z AADSTS50020: User account '[email protected]' from external identity provider 'https://sts.windows.net/xxxxxxxxx/' is not supported for application 'xxxxxxxx(uat ortest)'. The account needs to be added as an external user in the tenant. Please sign out and sign in again with an Azure Active Directory user account.

When the user tries to log in into the test/uat site I would like to force any existing cached tokens and force the user to relogin and grab a fesh token.

I have tried to use the

clearCache()

but that has not worked. I would like to avoid making a logout call before a login.

I am using adal.js v1.7.

vibronet vibronet · Accepted Answer · 2015-12-08T03:54:19

Assuming that your environments all have different domains, the token cache should not be a problem - as each domain has its own. If you reuse the same domain across environments then you do need to clean up tokens as well. The main problem you have here is the session cookie which track the sing in status with Azure AD of the user. If you don't want to do an explicit logout, the only alternative is to inject some parameter in the sing in request that signal to Azure AD that you want the user to have a choice instead of attempting single sign on - something like prompt=select_account. However that will require you to drop at the JS calls level, as the angular level extensibility point (the extraqueryparameter init property) would be added to every request, including the ones that must be silent like token renewal, making API calls impossible. Recap: do sign out when you switch environments, or perform sign ins with the JS level functions and inject promp=select_account. Other tricks include using inprivate, incognito, multiple browsers, etc

Adal.js - multiple user accounts belonging to different tenants/applications

1 Answers