Hi
We're using MSAL login for our own Web Application (https://app.condense.ch).
Starting last week we have the following error, when a user is asked for a relogin.
(We do the login with the official MSAL npm package, and it looks something like this:
const client = new UserAgentApplication(/* my paramter */);
client.loginRedirect([/* m< scopes */], {login_hint: "go@**.onmicrosoft.com"});
)
AADSTS90100: login parameter is empty or not valid.
There were NO changes from our side.
We tried to track the problem down and are quite sure the problem is the 'login_hint' parameter.
If this parameter is specified and the user has already been logged in once (i.e. something is in the local storage), then it won't work.
We're also pretty sure that Microsoft updated something on the login flow pages (we can see that there are new animations etc.). We think that this broke the existing behavior and is therefore most likely a bug with quite a high impact! For users without technical background it's almost impossible to log in anymore (since they have to clean the local storage, remove the login_hint parameter from the URL or do it in a private window).
Can anyone from Microsoft confirm that this is a bug?
This is the URL which is called when the login button (see below) is clicked:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=api%3A%2F%2Fd492530a-8cff-481c-90da-9c3c3f1be7da%2Faccess_as_user%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read%20https%3A%2F%2Fgraph.microsoft.com%2FUser.ReadBasic.All%20openid%20profile&client_id=d492530a-8cff-481c-90da-9c3c3f1be7da&redirect_uri=https%3A%2F%2Fapp.condense.ch%2Flogin-complete&state=2eaa3abc-c87d-4fac-adb8-02c2c800a83a&nonce=66e105c8-d47b-45bc-a15b-18d76caf0abd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=0.2.4&login_hint=go%40*.onmicrosoft.com&client-request-id=1fe6dcea-82bc-43a0-8014-60b47e922fbe&response_mode=fragment
A screenshot of the error page:
Also here are 2 GIF's which show the different behavior (if you look closely you can even see the different behavior in the way it redirects):
NOT working (i.e. the user has been logged in before and now tries to login again), you can even see that the "auto password" also doesn't work here:
Working, anonymous window:
*** Email address is removed by moderator for privacy ***
