Silent authentication is denied after a redirect

Library

msal@1.4.6

Framework

React 16

Description

When I use the redirect flow , the accessToken in the response I receive from handleRedirectCallback is set to null (from #1688 I gather that this is expected). As suggested in https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/1688#issuecomment-637669135 I called acquireTokenSilent from within handleRedirectCallback to obtain the actual accessToken. When I do this, however, I get the following error:

InteractionRequiredAuthError: Silent authentication was denied. The user must first sign in and if needed grant the client application access to the scope 'files.read.all openid profile'.

Error Message

AuthError.ts:25 Uncaught (in promise) InteractionRequiredAuthError: Silent authentication was denied. The user must first sign in and if needed grant the client application access to the scope 'files.read.all openid profile'.
    at InteractionRequiredAuthError.AuthError [as constructor] (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:12066:24)
    at InteractionRequiredAuthError.ServerError [as constructor] (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:12640:24)
    at new InteractionRequiredAuthError (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:12571:24)
    at UserAgentApplication.saveTokenFromHash (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:10110:17)
    at UserAgentApplication.processCallBack (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:9482:23)
    at UserAgentApplication.handleAuthenticationResponse (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:9543:10)
    at UserAgentApplication.<anonymous> (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:9201:20)
    at step (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:15670:17)
    at Object.next (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:15601:14)
    at fulfilled (http://localhost:3000/plaain/static/js/vendors~main.chunk.js:15556:24)

MSAL Configuration

{
  auth: {
    clientId: CLIENT_ID,
  },
}

My scopes are ['user.read', 'files.read.all'].

Reproduction steps

My redirect handler:

userAgentApplication.handleRedirectCallback((_, response) => {
  if (response === undefined)
    throw new AuthenticationFailure(ProviderKind.OneDrive)
  resolve(silentLogIn(userAgentApplication))
})

with

const silentLogIn = async (
  userAgentApplication: UserAgentApplication,
): Promise<OneDriveAuthResponse> => {
  const {
    accessToken,
    account,
    expiresOn,
  } = await userAgentApplication.acquireTokenSilent({
    scopes: SCOPES,
  })
  return buildAuthResponse(accessToken, account.userName, expiresOn)
}

Expected behavior

Identity Provider

• Azure AD
• Azure B2C Basic Policy
• Azure B2C Custom Policy
• ADFS
• Other

Browsers/Environment

• Chrome
• Firefox
• Edge
• Safari
• IE
• Other (Please add browser name here) Probably happens in the other browsers too

Source

• Internal (Microsoft)
• Customer request

[tnorling]

@jonhue You can look through the fiddler docs or use any network traffic capture software you’re more familiar with.

3rd party cookies are required for silent token acquisition in msal.js 1.x. If you need to support Safari I would highly recommend moving to msal-browser v2 as it uses the Auth Code flow with PKCE and does not rely on 3rd party cookies in most scenarios. If you have an existing app on 1.x that you’re not ready to migrate, the only solution is to use an interactive flow instead of silent.

v1 to v2 Migration Guide

[jonhue]

@tnorling sorry for the late response! I just got around migrating to v2 and as far as I can see, all works well! Thank you for helping out!