Unanswered

Portal Portal User able to sign in without Azure AD B2C credentials after Session Time Out

(0) Share

Report

Posted on by SamirPrusty

Hi Guys,

I have added site setting values to configure session time out for Power Portal users once they are signed in via Azure AD B2C. However, upon testing, I can see that once the session gets timed out, if the user clicks on Sign In again, it is not asking for the credentials. Rather it automatically signs in for the user without redirecting to Azure AD B2C user flow for authentication.

These are the site settings I have configured -

Authentication/ApplicationCookie/ExpireTimeSpan - 00:30:00

Authentication/OpenIdConnect/AAD-B2C_1/ExternalLogoutEnabled - true

Authentication/ApplicationCookie/LoginPath - /SignIn

Can you please let me know how to solve this?

@Fubar @OliverRodrigues @ragavanrajan

Categories:

Design & build

I have the same question (0)

All responses (2)

Answers (0)

Fubar 8,338 Super User 2025 Season 2 on at

Like (0)

Report
There's a Portal/PowerPages Site Setting for timeout (that you have)
There's a Portal/PowerPages Site Setting for a nonce lifetime (off the top of my head I can't remember what this one is called, if you configure OpenID Connect you will see it listed under advanced settings https://learn.microsoft.com/en-us/power-pages/security/authentication/openid-provider#configure-the-openid-connect-provider)
There's also a B2C Setting for session timeout

They can all play a role - you need to make sure they are aligned to each other (e.g. one session timeout setting can keep its session open and then reopen/renew the other session).

I think from memory one scenario where the nonce one comes into play is where the user Starts on the Portal, then goes to sign on at (for example) B2C but sits at the B2C interface too long, then hits the b2c sign-in button, when B2C pushes them back to the Portal the portal can reject the sign-in as the nonce has expired.

Was this reply helpful? Yes No
SamirPrusty 2 on at

Like (0)

Report

@Fubar , thanks for the reply. I have configured 30 mins as session timeout duration in both Power Portal and Azure AD B2C user flow. Still, unable to force user to sign in after being signed out.

I am not updating the nonce lifetime, as it is not currently relevant to my scenario.

Was this reply helpful? Yes No