AADSTS1002014: Unable to complete request. The request was invalid since domain_hint and opaque login_hint cannot be used together.

[LuBu0505]

Core Library

MSAL.js (@azure/msal-browser)

Core Library Version

2.38.3

Wrapper Library

MSAL React (@azure/msal-react)

Wrapper Library Version

None

Public or Confidential Client?

Public

Description

When use MSAL React in SAP project. Business need use Domain_Hint to set the default domain at first. and then, The Entra ID registered App also enabled the ID Claim ( login_hint ) when issue ID_Token.

once the local cache expired. will call acquireTokenSilent, acquireTokenRedirect or LoginRedirect methods to refresh token or relogin.

At this conditions, will get "AADSTS1002014: Unable to complete request. The request was invalid since domain_hint and opaque login_hint cannot be used together." error.

Troubleshooting details
If you contact your administrator, send this info to them.
Copy info to clipboard
Request Id: 0283f61b-fdf0-470e-98be-507221a55800
Correlation Id: 018e55c0-e998-764a-b50c-bdff2f23814b
Timestamp: 2024-03-19T08:08:52Z
Message: AADSTS1002014: Unable to complete request. The request was invalid since domain_hint and opaque login_hint cannot be used together.
Flag sign-in errors for review: Enable flagging
If you plan on getting help for this problem, enable flagging and try to reproduce the error within 20 minutes. Flagged events make diagnostics available and are raised to admin attention.

Error Message

AADSTS1002014: Unable to complete request. The request was invalid since domain_hint and opaque login_hint cannot be used together.

MSAL Logs

No response

Network Trace (Preferrably Fiddler)

• Sent
• Pending

MSAL Configuration

import { LogLevel } from "@azure/msal-browser";
// Browser check variables
// If you support IE, our recommendation is that you sign-in using Redirect APIs
// If you as a developer are testing using Edge InPrivate mode, please add "isEdge" to the if check
const ua = window.navigator.userAgent;
const msie = ua.indexOf("MSIE ");
const msie11 = ua.indexOf("Trident/");
const msedge = ua.indexOf("Edge/");
const firefox = ua.indexOf("Firefox");
const isIE = msie > 0 || msie11 > 0;
const isEdge = msedge > 0;
const isFirefox = firefox > 0; // Only needed if you need to support the redirect flow in Firefox incognito

// Config object to be passed to Msal on creation
export const msalConfig = {
    auth: {
        clientId: process.env.REACT_APP_CLIENT_ID,
        authority: process.env.REACT_APP_AUTHORITY,
        redirectUri: "/mcd-boss-h5/otpLogin",
        postLogoutRedirectUri: "/portal",
        navigateToLoginRequestUrl: false
    },
    cache: {
        cacheLocation: "localStorage",
        storeAuthStateInCookie: isIE || isEdge || isFirefox,
    },
    system: {
        allowNativeBroker: false, // Disables WAM Broker
        loggerOptions: {
            loggerCallback: (level, message, containsPii) => {
                if (containsPii) {
                    return;
                }
                switch (level) {
                    case LogLevel.Error:
                        console.error(message);
                        return;
                    case LogLevel.Info:
                        console.info(message);
                        return;
                    case LogLevel.Verbose:
                        console.debug(message);
                        return;
                    case LogLevel.Warning:
                        console.warn(message);
                        return;
                    default:
                        return;
                }
            },
        },
    },
};

// Add here scopes for id token to be used at MS Identity Platform endpoints.
export const loginRequest = {
    scopes: ["User.Read"],
    domainHint: "xxxxxx.cn"
};

Relevant Code Snippets

if (!accessToken) {
        const account = msalInstance.getActiveAccount();
        if (!account) {
            throw Error("No active account! Verify a user has been signed in and setActiveAccount has been called.");
        }
        console.log("the output loginrequest : " + loginRequest);
        console.log(loginRequest)
        console.log("the output account: " + account);
        console.log(account);

        const response = await msalInstance.acquireTokenSilent({
            ...loginRequest,
            //scopes: loginRequest.scopes,
            account: account
        }).catch((error) => {
            console.log('getCasToken error', error);
       
            console.log(error);
            //delete account["idTokenClaims"]["login_hint"];
            const responsenew = msalInstance.acquireTokenRedirect({
                ...loginRequest,
                //scopes: loginRequest.scopes,
                account: account
            }).catch(error => {
                console.log('acquireTokenRedirect error', error);
            })

            console.log(responsenew)
        });


// For Login Methods.

    const { instance } = useMsal();

    const onReLogin = () => {

        const account = instance.getActiveAccount();
        //delete account["idTokenClaims"]["login_hint"];

        //instance.loginRedirect({ ...loginRequest, account: account });
        instance.loginRedirect(loginRequest);
    };

Update some Screenshot:

and the Account Login_hint :

Reproduction Steps

1. Call loginRedirect or acquireTokenRedirect or acquireTokenSilent if you input domain_hint & login_hint together.

Expected Behavior

As those methods allow input domain_hint , login_hint parameters together. It's cannot throw the confilct error.

We expected the no error and login successfully.

Identity Provider

Entra ID (formerly Azure AD) / MSA

Browsers Affected (Select all that apply)

Chrome, Firefox, Edge, Safari

Regression

No response

Source

Internal (Microsoft)