Add sign-out functionality to MSAL

Please do correct me if I am wrong, but I have not been able to find any sign-out functionality in MSAL.

It would be useful to have something like a PublicClientApplication.SignOut() method to perform the following tasks:

• Remove cached tokens in MSAL
• Send a OIDC sign-out request to the tenant, in our case AAD B2C, to complete the sign-out (see here
• Remove all locally cached cookies, local storage entries, etc. from WKWebView belonging to the tenant hostname, in our case login.microsoftonline.com (see here and of course the equivalent on other platforms

It might make sense to have two overloads:

• PublicClientApplication.SignOut(IUser user) to do this for a given cached IUser
• PublicClientApplication.SignOut() to do it for all

I’m not sure about the technical feasibility of the former; for our scenario the latter would be perfect because we are only supporting one signed-in user at a time.

[bgavrilMS]

Yeah, as I said, MSAL libraries can’t control the browser cache. You do have some level of control over the interactive experience when using prompts - for example to force the user to re-enter their password, you can do:

AcquireTokenInteractive(scopes).WithPrompt(Prompt.ForceLogin);

A better way to deal with requirement however would be via Conditional Access. You ask the tenant admin to require users to enter their passwords at least once every x hours / days. Details at https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime. From the developer perspective, when you call AcquireTokenSilent, MSAL will throw an MsalUiRequiredException and the user will have to re-enter their password.

[jmprieur]

Also, on the backlog we want to provide a good sign-out (which involves the service removing the cookie), and sign-out from device.