nonce_mismatch_error when using msal.js to authenticate with a tenant authority and Microsoft personal account authority asynchronously

1
votes

I'm writing a web app that supports Azure AD authentication to a tenant as well as personal Microsoft Account authentication and requests access to the MS Graph for both of these auth providers. I'm using the msal.js library on the client to handle the authentication.

I have experienced the following which makes me think that the underlying UserAgentApplication object in msal is sharing state and preventing me from authenticating asynchronously with both providers.

Background:

I have an AadAuthProvider class, which is used to authenticate against the tenant authority. I have an MsaAuthProvider class, which is used to authenticate against the personal Microsoft Account authority. Each of these classes instantiates their own UserAgentApplication object with their own different Msal.Configurations.

Observations

  1. Attempting to return a Promise from calling AadAuthProvider.acquireToken silently and a Promise from calling MsaAuthProvider.acquireToken silently asynchronously always fails with a nonce_mismatch_error: Nonce is not matching, Nonce received: e5xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, nonce expected : a7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.
  2. Most of the time the first call will succeed and the second will fail with the nonce_mismatch_error. If I am debugging, then depending on the time spent at various breakpoints, the first or the second will fail with the nonce_mismatch_error.
  3. If I await AadAuthProvider.acquireToken and then await MsaAuthProvider.acquireToken, the operations both succeed.

It strikes me as unexpected that you cannot make multiple calls through the msal library to different providers at the same time. I would expect that the UserAgentApplication could be instantiated multiple times with different configs and a consumer of msal could interact with them independently.

Is there a way to instantiate the UserAgentApplication class such that I can use them independently in the different providers?

1
azure-active-directorymsalmsal.js
Since Azure AD V2.0, why do you not use common endpoint, it can be used to sign in users with work and school accounts or a Microsoft personal account? If you do that, you just need one instance. For more details, please refer to docs.microsoft.com/en-us/azure/active-directory/develop/… – Jim Xu

1 Answers

0
votes

You can use “https://login.microsoftonline.com/common” as your authority. It supports work account and Microsoft personal account. For more details, please refer to https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options