force user to login (using user/password) #3496

yarivc88 · 2021-04-20T14:15:05Z

yarivc88
Apr 20, 2021

Hi all,
using msal.js version 1.3.4
seems like once a user login with username/password and the accessToken is successfully extracted
the session/ token is never expired and user able to login again without reentering his username/password
is there a way to control it in the client side?
although i do see that the token is expired (session Storage browser => expiresIn
but it doesn't reflected when login (i think that this "expiresIn" may related to the refresh token time, so it is not what I looking for )

anyhow the best if to have an option to automatically logout a user after a certain time

is it possible?
see my snippets code

<script
  type="text/javascript"
  src="https://alcdn.msauth.net/lib/1.3.4/js/msal.js"
></script>
<script>
  let client = new Msal.UserAgentApplication({
    auth: {
      clientId: "<clientId>",
      authority:"<authority",
      redirect_uri: "<redirect_uri>",
    },
  });
  async function login() {
    var request = {
      scopes: ["user.read"]
    };

    let loginResponse = await client.loginPopup(request);

    client
      .acquireTokenSilent(request)
      .then(function (tokenResponse) {
        console.log(tokenResponse.accessToken);
      })
      .catch(function (error) {
        console.log(error);
        if (requiredInteraction(error.errorCode)) {
          client
            .acquireTokenPopup(request)
            .then(function (tokenResponse) {
              console.log(tokenResponse.accessToken);
            })
            .catch(function (error) {
              console.log(error);
            });
        }
      });
  }
  function logout() {
    client.logout();
  }

  function requiredInteraction(errorCode){
	  return errorCode === "consent_required"
    		|| errorCode === "interaction_required"
    		|| errorCode === "login_required";
  }

</script>

<html>
  <button onclick="login()">login</button>
  <button onclick="logout()">logout</button>
</html>

jasonnutter · 2021-04-20T15:27:14Z

jasonnutter
Apr 20, 2021

You can force login by setting prompt to login:

var request = {
      scopes: ["user.read"],
      prompt: "login"
    };

    let loginResponse = await client.loginPopup(request);

2 replies

yarivc88 Apr 20, 2021
Author

that right, but in this way the user will always required for username/password
is there a way to do it based on token expiration ? or any other time mechanism ?
thanks

jasonnutter Apr 20, 2021

You do not need to pass it every time you invoke an interactive method (i.e. you can pass it only when invoking acquireTokenRedirect and not when invoking loginRedirect).

MSAL does not offer an API to do this purely based on time. If you want to the prompt the user to login after a certain amount of time, your app will need to implement that logic.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

force user to login (using user/password) #3496

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment 2 replies

{{title}}

{{title}}

{{title}}

Select a reply

force user to login (using user/password) #3496

yarivc88 Apr 20, 2021

Replies: 1 comment · 2 replies

jasonnutter Apr 20, 2021

yarivc88 Apr 20, 2021 Author

jasonnutter Apr 20, 2021

yarivc88
Apr 20, 2021

Replies: 1 comment 2 replies

jasonnutter
Apr 20, 2021

yarivc88 Apr 20, 2021
Author