AADSTS50058 - Unable authenticate on MS Teams Desktop App

Core Library

MSAL.js v2 (@azure/msal-browser)

Core Library Version

2.26.0

Wrapper Library

Not Applicable

Wrapper Library Version

0

Description

Using template tab-aad-msal2

And upgrade

"@azure/msal-browser": "^2.26.0",
"@microsoft/teams-js": "^2.0.0",

this.msalClient.loginRedirect(this.request) working on Teams Web, but not working on Teams Desktop App

Error Message

InteractionRequiredAuthError: AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in a different IE security zone than the Azure AD endpoint (login.microsoftonline.com). Trace ID: f6450045-e435-4fa7-8dcb-b1e7da7f2300 Correlation ID: b88afb3e-7b95-48fc-a68e-5875238dd1d3 Timestamp: 2021-01-28 08:56:59Z

Msal Logs

MSAL Configuration

const msalConfig = {
            auth: {
                clientId,
                authority,
                redirectUri
            },
            cache: {
                cacheLocation: "localStorage",
                storeAuthStateInCookie: false
            }
};

Relevant Code Snippets

this.msalClient.loginRedirect(this.request);

Reproduction Steps

1. Login in Microsoft Teams Desktop App
2. Select Tab
3. Click Login
4. Open devTool in Iframe Auth
5. Observe

Expected Behavior

loginRedirect successfully.

Identity Provider

Azure AD / MSA

Browsers Affected (Select all that apply)

Chrome

Regression

No response

Source

External (Customer)

[tiennguyen1293]

Many thanks team !!!

[jasonnutter]

Hi @derisen @jasonnutter

I’m understanding you are not sure about silently acquiring tokens will work on Teams Desktop App? For some reason, we still have to display a prompt to re-login again in the Teams Tab app.

I’m meaning Teams App => login => Tab App => get Token => re-login?

If you are not able to perform the OBO flow using the Teams SSO token (as shown in the sample) you can try invoking ssoSilent on page load to attempt to silently sign in. If that fails, you will need to invoke an interactive prompt.

So … Do we help update the DOC on this?

Just to clearly and for others to have the same question as me.

Yes, those docs should probably be updated. cc @EmLauber