多个应用程序的 B2C SSO 行为

Question

We need to support SSO for multiple applications within the same Azure B2C tenant. Azure B2C supports this and I have configured my relying party custom policies accordingly.

My custom policies have a journey step in which additional information of the user is validated against an API. When this validation fails an error is thrown and the JWT token is not issued for that user journey. This user journey works, but has issues with SSO:

After the user has signed in successfully into application A, he tries to sign into application B. When validation of the user information is successful, the user is signed in to application B.

When the validation step in the custom policy for application B fails, however, an error is passed to the application without issuing a JWT token.

What happens in the latter case is that the sso (x-ms-cpim-sso) cookie is removed, too, and the user is in fact signed out from all applications, also from application A and SSO is not working anymore. The user has to sign into application A again.

I tried changing the underlying technical profile from using Web.TPEngine.SSO.NoopSSOSessionProvider to Web.TPEngine.SSO.DefaultSSOSessionProvider, but then the user is signed into application B without any validation errors, while he should not be signed in.

Is there any way to control this behaviour, such that the user keeps signed in with B2C after successfully signing in to application A, but is not issued a token for application B when one of the policies fail to execute normally?

Answer 1

I just had the same requirement and solved it by changing the SSO Azure AD B2C session behavior to Application :

<UserJourneyBehaviors>
   <SingleSignOn Scope="Application" />
</UserJourneyBehaviors>

This setting allows you to maintain a user session exclusively for an application, independent of other applications. For example, you can use this setting if you want the user to sign in to Contoso Pharmacy regardless of whether the user is already signed into Contoso Groceries.

Further reading: Configure Azure AD B2C session behavior