Skip to content

Commit a2120ce

Browse files
Merge pull request #214730 from derisen/patch-13
Clarify cache sharing, add link to prompt doc
2 parents b0992b3 + f664c00 commit a2120ce

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

articles/active-directory/develop/msal-js-sso.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ const config = {
3939
const msalInstance = new msal.PublicClientApplication(config);
4040
```
4141

42+
In this case, application instances in different browser tabs make use of the same MSAL cache, thus sharing the authentication state between them.
43+
4244
## SSO between different apps
4345

4446
When a user authenticates, a session cookie is set on the Azure AD domain in the browser. MSAL.js relies on this session cookie to provide SSO for the user between different applications. MSAL.js also caches the ID tokens and access tokens of the user in the browser storage per application domain.
@@ -47,7 +49,7 @@ MSAL.js offers the `ssoSilent` method to sign-in the user and obtain tokens with
4749

4850
### With user hint
4951

50-
To improve performance and ensure that the authorization server will look for the correct account session. You can pass one of the following options in the request object of the `ssoSilent` method to obtain the token silently.
52+
To improve performance and ensure that the authorization server will look for the correct account session, you can pass one of the following options in the request object of the `ssoSilent` method to obtain the token silently.
5153

5254
- Session ID `sid` (which can be retrieved from `idTokenClaims` of an `account` object)
5355
- `login_hint` (which can be retrieved from the `account` object username property or the `upn` claim in the ID token)
@@ -181,7 +183,7 @@ For better performance and to help avoid issues, set the `redirectUri` to a blan
181183
InteractionRequiredAuthError: login_required: AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD
182184
```
183185

184-
To resolve the error, the user must create an interactive authentication request using the `loginPopup()` or `loginRedirect()`.
186+
To resolve the error, the user must create an interactive authentication request using the `loginPopup()` or `loginRedirect()`. In some cases, the prompt value **none** can be used together with an interactive MSAL.js method to achieve SSO. See [Interactive requests with prompt=none](msal-js-prompt-behavior.md#interactive-requests-with-promptnone) for more.
185187

186188
Additionally, the request object is required when using the **silent** methods. If you already have the user's sign-in information, you can pass either the `loginHint` or `sid` optional parameters to sign-in a specific account.
187189

@@ -220,6 +222,6 @@ Once the `cacheLocation` is configured, MSAL.js can read the cached state of the
220222

221223
For more information about SSO, see:
222224

223-
- [Single Sign-on SAML protocol](single-sign-on-saml-protocol.md)
225+
- [MSAL.js prompt behavior](msal-js-prompt-behavior.md)
224226
- [Optional token claims](active-directory-optional-claims.md)
225227
- [Configurable token lifetimes](active-directory-configurable-token-lifetimes.md)

0 commit comments

Comments
 (0)