MSGraphClient does not work for Guest user

[Oaden]

Category

• Question
• Typo
• Bug
• Additional article idea

Expected or Desired Behavior

When using the MSGraphClient as guest user, it should return data

Observed Behavior

When using a guest account to call the /users endpoint, i get the following error

"Error: AADSTS50058: A silent sign-in request was sent but none of the currently signed in user(s) match the requested login hint.
Trace ID: b69ceeca-9d68-433a-9263-482773fa1a00
Correlation ID: af8b56b0-c4d9-491a-bf2d-11a89fdaafe9
Timestamp: 2019-04-02 12:29:49Z
at Array. (https://spoprod-a.akamaihd.net/files/sp-client-prod_2019-03-15.008/sp-webpart-workbench-assembly_en-us_e89df8408f4d327c94e46017237276f5.js:1064:34992)
at _callBackMappedToRenewStates.(anonymous function)._callBackMappedToRenewStates.(anonymous function) (https://spoprod-a.akamaihd.net/files/sp-client-prod_2019-03-15.008/1.sp-http-adal_c2097657830cc37ce4b2.js:3:7561)
at AuthenticationContext.handleWindowCallback (https://secure.aadcdn.microsoftonline-p.com/lib/1.0.16/js/adal.min.js:2:24607)
at parseTokenFromUrl (https://devcrh.sharepoint.com/_forms/spfxsinglesignon.aspx:20:17)
at onload (https://devcrh.sharepoint.com/_forms/spfxsinglesignon.aspx#error=login_required&error_description=AADSTS50058%3a+A+silent+sign-in+request+was+sent+but+none+of+the+currently+signed+in+user(s)+match+the+requested+login+hint.%0d%0aTrace+ID%3a+b69ceeca-9d68-433a-9263-482773fa1a00%0d%0aCorrelation+ID%3a+af8b56b0-c4d9-491a-bf2d-11a89fdaafe9%0d%0aTimestamp%3a+2019-04-02+12%3a29%3a49Z&state=8cb0bf92-8759-4dbc-bec2-ba8ef20cc545%7ca5279774-f79f-4ec5-a3ee-a33a6b0e80c7:31:38)"

Steps to Reproduce

using SPFx 1.8
When a guest (so with a address from another tenant) tries to use a spfx webpart that uses the MSGraphClient, the endpoint returns the error: A silent sign-in request was sent but none of the currently signed in user(s) match the requested login hint.

[msft-github-bot]

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

[GeorgiBoykov]

We are into the same issue...

The problem is in the login_hint parameter within the auth request of guest users. Azure AD seems to add some additional fragments to the guest user`s UPN. For example, if my guest account is xxx@yyy.zzz, my Azure AD UPN will be xxx_yyy.zzz#ext#@company.onmicrosft.com. The SPFx webpart sends the formatted account as the login_hint but Azure AD does not recognize it as a valid login account and returns the above mentioned error!

I tried to replace the login_hint in the request while debugging with my original account (non-formatted) and it worked! So, there is nothing to do on the client side, because it is in the Microsoft SharePoint`s script. Here is the place where the login_hint parameter is sent as the formatted one (https://spoprod-a.akamaihd.net/files/sp-client-prod_2019-03-15.008/sp-pages-assembly_en-us_2676c0dcef2e33d08d5b8433ef878499.js:formatted):

Is there a solution for this issue, or it is a bug that will be fixed?

[justdevelopment]

We have the same issue as well. It this an issue in the SPFx SSO or with the underlying AAD things? Tagging in @VesaJuvonen & @patmill :)

[advdberg]

Also see the latest posts in #2629 AadHttpClient or MSGraphClient does not work with multiple live accounts
Seems to be discussing the same issue

[hornes9]

We are into the same issue...

The problem is in the login_hint parameter within the auth request of guest users. Azure AD seems to add some additional fragments to the guest user`s UPN. For example, if my guest account is xxx@yyy.zzz, my Azure AD UPN will be xxx_yyy.zzz#ext#@company.onmicrosft.com. The SPFx webpart sends the formatted account as the login_hint but Azure AD does not recognize it as a valid login account and returns the above mentioned error!

I tried to replace the login_hint in the request while debugging with my original account (non-formatted) and it worked! So, there is nothing to do on the client side, because it is in the Microsoft SharePoint`s script. Here is the place where the login_hint parameter is sent as the formatted one (https://spoprod-a.akamaihd.net/files/sp-client-prod_2019-03-15.008/sp-pages-assembly_en-us_2676c0dcef2e33d08d5b8433ef878499.js:formatted):

Is there a solution for this issue, or it is a bug that will be fixed?

We have the same issue in our company. Something is messed up between Azure AD guest accounts and Spfx while authenticating. The reason is definitely in the formatted user principal name (UPN) of guest accounts. Please, this is critical for our application. @VesaJuvonen

[andrewconnell]

@advdberg said:

Also see the latest posts in #2629 AadHttpClient or MSGraphClient does not work with multiple live accounts Seems to be discussing the same issue

That's a different issue with multiple accounts logged into the same session at the same time and SPo getting confused on which one to use...

[andrewconnell]

I'm checking with the Graph team if this scenario is supported... something doesn't seem right for guest users to be able to get all users in the org... but checking...

@Oaden what scope did you grab have you granted SPO on MSGraph?

[justdevelopment]

I can imagine guest users not having access to certain graph endpoints, but surely they should then get the same access denied you get when your account has no access instead of just failing badly on a token request? We don't use the /users endpoint, but we do have quite a few scopes in our project so it could be any of the others.