Search code examples
javaazureauthenticationsingle-sign-onazure-ad-msal

MSAL Java Servlet Example: How to avoid Sign-In button prompting "Pick an account"?

I installed the MSAL Java Servlet example. It basically works, however when I click on the "Sign In" button it sends me to https://login.microsoftonline.com to present a prompt "Pick an account" (only 1 account listed). I can select my account manually and then it let's me into the MSAL sample app "You are signed in" page. (I should also note, that for the first time after clicking the account, it sends me to a MFA page, but not subsequent logins)

QUESTION: How can I configure it to not prompt me to pick my account since there is only 1 account? (And avoid the MFA page?)

https://github.com/Azure-Samples/ms-identity-msal-java-samples/tree/main/3.%20Java%20Servlet%20Web%20App%20Tutorial/1-Authentication/sign-in

I expected to click on "sign in" and for it to authenticate and redirect to main app index page. Instead, it asks me to select which windows account, and then if the first time, will also issue a MFA page.

Solution

  • I have gone through your problem and found a fix which will not let the prompt to choose the account again and again.
    I found that in your AuthHelper class there is a method called redirectToAuthorizationEndpoint. and the configuration for AuthorizationRequestUrlParameters as

    AuthorizationRequestUrlParameters  parameters  =  AuthorizationRequestUrlParameters.builder(Config.REDIRECT_URI, Collections.singleton(Config.SCOPES)).responseMode(ResponseMode.QUERY)
.prompt(Prompt.SELECT_ACCOUNT).state(state).nonce(nonce).build();

    I have reproduced with the same configuration and I was getting the prompt repeatedly to choose the account to signin. enter image description here

    When I sign in below, it was redirecting to the prompt to choose the account as shown below:. enter image description here

    enter image description here

    Prompt method allow to choose the account even if you have only one account.

    Fix:

    To avoid this issue, we have to just remove the whole prompt method and configure like below:

    AuthorizationRequestUrlParameters  parameters  =  AuthorizationRequestUrlParameters.builder(Config.REDIRECT_URI,  Collections.singleton(Config.SCOPES)).responseMode(ResponseMode.QUERY)
.state(state).nonce(nonce).build();

    enter image description here

    In this case, even If u have only one account to login, it will not redirect to choose account blade.
    When I click on signin, it is not redirecting to the prompt to choose account as I have already signed in with my account once:

    enter image description here