Sign Out with 'logout' method doesn't close webView automatically

[pavelsokolov21]

Issue

Hi Team!

I want to logout from the system by the method logout. It works but with this errors:

For iOS:

[Error: The operation couldn’t be completed. (org.openid.appauth.general error -3.)]

For Android:

[Error: User cancelled flow]

This error happens because I click on the close button after successfully signing out on the third-party screen. But I know that logout was successful because I don't see the label Signed In under the profile.
Looks like that might be related to redirect URL or something like that. Could someone help me with this issue?

Screenshots

Third-party screen: https://www.dropbox.com/s/jobnd7svfcvqswx/Screenshot%202022-02-25%20at%2010.49.42%20AM.png?dl=0
Error Android: https://www.dropbox.com/s/3u8s2hckabljrvs/Screenshot%202022-02-25%20at%2010.50.08%20AM.png?dl=0

Code

Config:

const config = {
  issuer:
    'https://login.microsoftonline.com/tenant_id/v2.0',
  clientId: AZURE_AD_CLIENT_ID,
  redirectUrl: 'rtprn://react-native-template/',
  scopes: ['openid', 'offline_access', 'profile'],
  additionalParameters: { prompt: 'select_account' },
}

logout:

await logout(config, {
    idToken: idToken,
    postLogoutRedirectUrl: 'rtprn://react-native-template/',
});

---

Environment

• Your Identity Provider: Azure
• Platform that you're experiencing the issue on: both
• Are you using Expo?: no

[carlosag012]

I also have the same issue in iOS.

When I get to the login.microsoftline.com it says:

"You signed out of your account
it's a good idea to close all browser windows"

However, I am not redirected back to the app, there is not close button on this window and if I press Cancel,
I get the same error:

"org.openid.appauth.general error -3"

Thank you

[Jay-A-McBee]

👋 heyo @pavelsokolov21 - I was able to reproduce the issue and it looks like this is somewhat of a known problem when using Azure AD. The linked issue popped up in the MSAL js repo, but I found a solution in this comment. The following necessary requirements are outlined in the comment.

First and foremost the postLogoutRedirectUrl has to be https. This means your app must support Universal Links for iOS and AppLinks for Android. I admit that I only tested this on iOS so I'm not that familiar with setting up AppLinks on Android.

Second the redirect only works when targeting the common endpoints (ex. https://login.microsoftonline.com/common/v2.0). Using a tenant id in the issuer url won't work. I tried with both common and my tenant id and can confirm that only the common endpoints seem to work. See this comment.

Final step is to add the postLogoutRedirectUrl as a valid redirect uri in the Azure AD registered app's Authentication section.

I suggest reading through those issues/comments. There's a lot of info in them and there are also a few MSFT devs that offer helpful comments and suggestions.

Once I had an https redirect url/universal link set up, I was able to logout and get redirected back to the example app.

// various auth endpoints

serviceConfiguration: {
  authorizationEndpoint: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
  tokenEndpoint: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
  endSessionEndpoint: 'https://login.microsoftonline.com/common/oauth2/v2.0/logout',
}


// postLogoutRedirectUrl

https://xxxxxxx.com/oauth (this is just a random domain I own where I'm hosting the apple-app-site-association file)

aad_logout_redirect.mp4

Using the common endpoints might not work for your use case, but I don't think there's anything this library can do to fix this third-party issue.

[Jay-A-McBee]

closing this out

[carlosag012]

Thanks for posting a solution. My project is kind of stalled right now but will give that a try soon.

Thanks

[kkaplinski]

What do you think about using iosPrefersEphemeralSession: true in 7.0.0-rc2. It seems that after login there is no active session in the background and when we try to call logout() webview automatically redirect to "successfully logged out" screen. We can either use finally/catch to make some clearing function after we cancel webview (rejected promise) or we can resign from using logout() because there is no active session. Do we need to use logout() with iosPrefersEphemeralSession: true ?

Important difference is that previously without iosPrefersEphemeralSession prop using "catch/finally" to make workaround was unavailable because we did not know if user completed signing out

Hey @Jay-A-McBee should I use solution you provided here ? Comment or it doesn't make sense since I'm using iosPrefersEphemeralSession prop ?

[Uzef1997]

@Jay-A-McBee it would be a big help if you share the example of the attached video can you please share it?

[anehustorov]

Thanks, @kkaplinski, good solution. Did you find the solution for Android?

[anehustorov]

Found it, sorry
additionalParameters: {prompt: 'login'} in config forcing the user to log in again in authorize method

[avinash-capsitech]

Is there any way to logout without redirect to browser, because by using additionalParameters: {prompt: 'login'} we can forcefully redirect to login page but the session is not clear, This is not a correct flow for logout.