Search code examples
azureazure-ad-b2cchange-passwordforgot-password

Azure AD B2C password change custom policy, user needs to sign in every time

I’ve implemented the password change custom policy according to the documentation and use msal.js on the frontend to start the password change flow. This works accept that the user needs to sign in again although the user is already signed in to the application. So it asks the user credentials every time. Why isn’t B2C detecting that the user has already signed in and how can I solve this? Thanks!

Solution

  • MSAL.js is setting the prompt parameter, therefore, forcing B2C to ignore the cookie, therefore, forcing the sign-in.

    const urlNavigate = authenticationRequest.createNavigateUrl(scopes) + "&prompt=select_account" + "&response_mode=fragment";

    Source

    You can verify this by taking the URL MSAL.js redirects the user to and removing the prompt query parameter.

    Related GitHub Issue: Allow Controlling the prompt parameter. We need to convince the MSAL library owners we need control over this parameter.