0

I've integrated Azure AD B2C into my web app and I'm using MSAL on the client. I'm using Google for a social IDP.

Using Chrome, I start out with only one Google identity (foo1@gmail.com). My app calls loginRedirect(...) and I'm able to use foo1@gmail.com to successfully login with Google. If I then close that browser tab (but not the browser), open a new one and have my app call MSAL's loginRedirect() again, I am automatically logged in as foo1@gmail.com and everything is good. Presumably a b2clogin.com cookie is being used to remember the previous login info.

If I then add another Google identity to the mix (foo2@gmail.com) the behavior changes. Repeating the scenario above, when my app first calls loginRedirect() and I try to login via Google, I'm asked to choose between foo1@gmail.com and foo2@gmail.com as expected. I choose foo1@gmail.com and I am logged in just fine. If I then close that tab, open a new one and have my app call loginRedirect() again, I am automatically taken to Google's "Sign in with Google / Choose an account" page where I have to pick between foo1@gmail.com and foo2@gmail.com. It appears that enough information was stored by AADB2C to know that I was previously logged in via Google, but the actual Google identity that was used previously is not automatically selected as I expected.

Following the guidance in this article I can work around this by a) storing the last used email address in a session cookie and then b) passing the email address in to Google as a login_hint, but it seems that this will only work with Google. We would prefer a solution that will work for any social IDP.

Is there a way to get AADB2C/Google to automatically select the previous identity without using login_hint?

Andrew Miller
  • 105
  • 1
  • 9

1 Answers1

0

What you are experiencing is the login behavior of Google rather than Azure AD B2C.

Google remembers who is signed in to the current session (e.g. foo1@gmail.com) as well as who has signed in to the current browser in recent sessions (e.g. foo1@gmail.com and foo2@gmail.com).

(Google also allows multiple sign-in.)

The use of login_hint by Google is documented at here.

login_hint is an OpenID Connect concept -- which is why Google, as an OpenID Connect provider, supports it but many OAuth 2.0 providers don't do so (at least support it in a standardized way).

Chris Padgett
  • 14,186
  • 1
  • 15
  • 28