[BUG] TeamsMsal2Provider - unable to determine if sso token exchange failed

[ebclark2]

Describe the bug TeamsMsal2Provider uncaught (promise) from constructor when ssourl configured when ssourl call fails. When constructing TeamsMsal2Provider it calls async internalLogin() if ssoUrl is configured. Exceptions from internalLogin are not handled. Is there a way to determine authentication failed? I am resorting to window.addEventListener('unhandledrejection', ...).

To Reproduce Steps to reproduce the behavior: let config: TeamsMsal2Config = { <Some valid configuration> ssoUrl: "https://some.url.that.will.fail/, }; const teamsMsal2Provider = new TeamsMsal2Provider(config);

Expected behavior I'd like to be notified authentication failed.

Screenshots

Environment (please complete the following information):

• OS: Windows 10
• Browser chrome
• Framework react
• Context Microsoft Teams
• Version 2.3.1
• Provider TeamsMsal2Provider

[ghost]

Hello ebclark2, thank you for opening an issue with us!

I have automatically added a "needs triage" label to help get things started. Our team will analyze and investigate the issue, and escalate it to the relevant team if possible. Other community members may also look into the issue and provide feedback 🙌

[sebastienlevert]

Can you clarify what is a SSO call failure? Is it that the service doesn't respond? We'd love to know more about the scenario! Thanks!

[ghost]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.

[ebclark2]

Apologies, I evidently wasn't setup to get a notification for responses. Can this be reopened?

In the TeamsMSAL2Provider library I provide an ssoUrl in the configuration, which is used for token exchange/validation. This call can fail because the backend service is down, or maybe validation fails because the app registration is configured for single tenant auth and the user is from another tenant.

[sebastienlevert]

Absolutely @ebclark2! Are you passing the token from the backend service to the client or you are handling the Graph calls from the backend? When reading a little bit more into the Microsoft Identity platform, this becomes clear that issuing tokens on the backend should prevent sending them to another party (your client). Reference Maybe the ProxyProvider would be better suited for your use case?

[ebclark2]

Here is the example I have used. https://docs.microsoft.com/en-us/graph/toolkit/get-started/build-a-microsoft-teams-sso-tab?tabs=unpkg%2CHTML

Is this okay to use? If so, my concern is with the user experience when the backend component in the example is down.

It has true I am only authenticating to make graph calls. Is it better to use the ProxyProvider in this case?

Thanks! Ed

[sebastienlevert]

This is definitely a valid scenario! When the backend service is working, is it working like it should? We'll be looking at catching this error but I want to make sure you have a happy path when your backend service responds OK! Thanks!

[ebclark2]

That sounds great, thanks. It works great when all goes well, and the user allowed.

[sadviramana]

Hey @sebastienlevert any updates on this? We also would like to gracefully handle the exception in SSO using TeamsMSALProvider

[gavinbarron]

Closing as this provider is deprecated and should no longer be used