How to logout?

[bokzzzz]

I tried to logout from Azure ADB2C with remove_account() but unsuccessful. Can you add example (in Sample) for logout like for javascript: https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/logout.md

[rayluo]

Your current question was posted in the repo of Microsoft Authentication Library (MSAL). MSAL's remove_account() removes account and its tokens from MSAL's own token cache, therefore effectively logs a user out from your app. Does that not work for you?

If, on the other hand, you were working on a web app, then there is a log out behavior there. Please checkout our Flask web app sample or Django web app sample and post your questions there.

[bokzzzz]

I found this: , but why this can't be done through msal lib (not to manually call this)?.

[bgavrilMS]

MSAL is not in the browser (well, MSAL JS is, if you are building a SPA). MSAL.PY runs on the backend and it is agnostic of the web framework used (Django, Flask). MSAL is responsible for token caching and for communication with the /token endpoint of an identity provider.

[bokzzzz]

@bgavrilMS So, conclusion is MSAL doesn't have functionality to invalidate token on Azure side?

[rayluo]

So, conclusion is MSAL doesn't have functionality to invalidate token on Azure side?

I figure, this can be a feature request that MSAL builds that logout url for you, by:

• either extending the current remove_account() API to return that url (but then the onus is on the calling app - such as az logout - to launch a browser with that url), or
• add a new lougout_interactive() api which launches the browser (when not using broker). This behavior matches the acquire_token_interactive().

Shall we take this feature request, @bgavrilMS ?

On the other hand, @bokzzzz , if all you want is to alter step 4 that you described,

It's client app (CLI app). Scenario is like this:

1. Through msal, trigger Interactive login (browser is opened, 2mfa, logged in successful)

2. Token cache is deleted, nothing about token is on system

3. User wants to login with other account

4. Interactive login is triggered again but previous user is logged in automatically (browser used cookies with login request)

you just need to call acquire_token_interactive(..., prompt="select_account"). That is what Azure CLI does, all the time. And they do not worry about the actual logout from the Identity Server.

[bgavrilMS]

@bokzzzz - please confirm the type of app that you have? Is it a desktop app (e.g. CLI) or web site (Django, Flask)?

[bgavrilMS]

In public client apps, there is no way for MSAL to clear cookies from the browser. Browser belongs to the user. A better question is - why are you trying to do this?

[bokzzzz]

@rayluo Actually, acquire_token_interactive(..., prompt="select_account") partially solved the problem, because user still have valid token on Identity Server, but if Azure CLI does it, probably I shouldn't care. My opinion is that it would be nice to have logout in MSAL to be sure that token is invalid also on Identity Server, but I don't know is it good by architecture. logout_interactive() sounds good to me 😄 .

@bgavrilMS I'm using python without any framework to build Command Line Interface Application. Yes, browser belongs to user, but I don't know that is good approach to tell user to clear cookies to get again "Select Account" web page, otherwise SSO will log you again.

[bokzzzz]

@rayluo Sorry, thank you for acquire_token_interactive(..., prompt="select_account") suggestion.