Share via

Enterprise App oAuth2 SSO gets invalid session key

Jeff Noël 21 Reputation points
2019-12-17T13:11:48.52+00:00

I added my Moodle instance as an Azure AD Enterprise app.
The login works well, but fails in a very specific way (which tends to be quite popular amongst users).

When people click on the login button, they get redirected to the Microsoft login page. Most of the time, through SSO, they're already logged in... so they just click on their account instead of waiting for the auto redirect to do its job. This is when everything crashes.

If people just wait it out and let the autologging work, they'll access Moodle successfully.
Here's the Login page I'm talking about:

Microsoft AzureAD Enterprise App oAuth2 SSO login page

If people click their account on the Microsoft login page, they'll get Incorrect SessKey error.

The Azure AD Enterprise App connection logs shows the following error when an error happens:

50058
The application tried to perform a silent sign in and the user could not be silently signed in. The application needs to start an interactive flow giving users an option to sign in. Contact app owner.

Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,933 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,208 questions
0 comments
Accepted answer
  1. Marilee Turscak-MSFT 36,886 Reputation points Microsoft Employee
    2019-12-17T23:48:08.73+00:00

    Some others have mentioned a similar issue in the Moodle discussion board. You can pass a parameter that disables the auto-login, and this can fix it. Edit your oauth-issuer for Microsoft and add the following in the field "additional login parameters": "prompt=select_account" https://zcusa.951200.xyz/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow

    Let me know if this helps at all. Others have said that you just need to wait it out, which isn't ideal...

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.