MSGraphClient Error AADSTS50058

[schurlinga]

Category

• Question
• Typo
• Bug
• Additional article idea

We have a webpart which is using MSGraphClient. Everything is working as expected, except if you don't close the sharepoint site including the webpart and the browser over night, the next day you will receive the error: AADSTS50058: A silent sign-in request was sent but no user is signed in

Even though it says "no user is signed in" it is possible to browse every sharepoint online site without hitting a login screen.

Errors thrown:

• AADSTS50058: A silent sign-in request was sent but no user is signed in
• Refused to display 'https://login.microsoftonline.com/common/oauth2/authorize?response_type=id_token&client_id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&redirect_uri=https%3A%2F%2Fwebshell.suite.office.com%2Fiframe%2FTokenFactoryIframe&state=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&client-request-id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&x-client-SKU=Js&x-client-Ver=1.0.15&nonce=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' in a frame because it set 'X-Frame-Options' to 'deny'.

Expected or Desired Behavior

As the webpart is embedded on a sharepoint site, there should be no error saying "no user signed in".
The MSGraphClient should handle this error internally by initiating all steps necessary to log in the user again.

Observed Behavior

Microsoft Graph resources can't be accessed due to silent sign-in error

Steps to Reproduce

1. Create a SPFx1.6 webpart solution
2. Use MSGraphClient to access graph resources
3. Login to SharePoint Online site where the webpart is added
4. Leave the site open and untouched over the night
5. Come back the next day and refresh the page -> AADSTS50058: A silent sign-in request was sent but no user is signed in

SPFx version 1.6.0
SharePoint Online Standard Release
Browsers:

• Chrome Version 68.0.3440.75 (Official Build) (64-bit)
• Internet Explorer 11

[schurlinga]

As a workaround we can redirect the user to:

`https://login.microsoftonline.com/login.srf?wa=wsignin1.0&whr=domain.com&wreply=${window.location.href}`

[gagan2singh]

Do we have any update on this. We are also facing the same issue. Closing all the browser and opening it again works sometimes.

[maps05]

Just to add that I'm having the same issue in SPFx1.7 extension. Also interested in the outcome of this.

[aslanovsergey]

Yeah, confirm. After a user hibernates their computer or turns into sleep over night the next day they get Error: AADSTS50058: A silent sign-in request was sent but no user is signed in.
Would be nice if it will send to Sign-in page.

[MatthiasWeibel]

Is there any update on this issue? Are you able to provide an estimated release date of a fix?

[dashberg]

Same goes for AadHttpClient in Chrome -SPFx1.7 Webpart. After token expire users need to reopen the browser.

[MarksPoint]

We have this exact issue in our Graph-powered web parts based on SPFx 1.8.1.

As soon as a user refreshes a browser window that was open over night, the Graph-calls fail and raises the error AADSTS50058: A silent sign-in request was sent but no user is signed in.

Some more details about what we've found out so far:

• Navigating to Delve or logging in to the Graph Explorer fixes the issue for that day
• Navigating to https://tenant.sharepoint.com/_forms/default.aspx?returnUrl=https%3A%2F%tenant.sharepoint.com%2Fsites%2Fsite fixes the issue for that day
• It appears that for some users restarting the browser fixes the issue as well, but that might be because the navigate to the site in a different way
• We've seen the issue both in IE 11 and in Edge
• (At least) one user has this issue even after shutting down her computer and restarting the next day, opening a new instance of the browser after booting
• Because of some SSO configuration, users don't get to see the window where they get to check the KMSI (Keep Me Signed In) checkbox. Could it be that this causes the authentication cookie to expire?
• We've got Conditional Access configured. Not sure what this has to do with the issue but we only have the issue in our 'production' tenant, where this is set up, and not in our test tenant, so maybe it's related...
• (At least) one user was having a different error: AADSTS50158: External security challenge not satisfied. It's unclear what caused this specific error...

For now the workaround is to detect the error and redirect the user to the above url, but it would be great if it's somehow fixed in ADAL or PnP JS...

[Hatallia]

We are having the same issue with SPFx 1.8.1. We are using Graph API in the web part and receiving the same error over the night if the browser was not closed. More details from our end: in addition to the "AADSTS50058: A silent sign-in request was sent but no user is signed in" there is also an error message that we caught regarding the token renewal: "Token Renewal operation failed due to timeout". The adal.error variable in Local Storage is saying that "Login is required".

We made a recent change to the service that prompts the user with the following message
"To view the information on this page, you need to verify your identity. Click Here"

Do you see this behavior? Does it resolve the silent sign-in error?