MicrosoftEdge / MicrosoftEdge/WebView2Feedback
Device Compliance policy cannot be satisfied if AllowSingleSignOnUsingOSPrimaryAccount is not used
Nobody has claimed this yet.
- Dominant language
- PowerShell
- Stars
- 526
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
Ref: https://github.com/MicrosoftEdge/WebView2Feedback/issues/550
Description
We are using WebView2 to facilitate SAML logins to Azure AD. If AllowSingleSignOnUsingOSPrimaryAccount is used everything goes smoothly. However, sometimes we need to force the user to enter his credentials, which can only be accomplished by turning AllowSingleSignOnUsingOSPrimaryAccount off. This seems to disable device information from being passed to the login server, which makes it impossible to sign in if there's a device-based policy in place, even if the entered credentials are the same as the primary OS account. Login fails, listing the device as "unregistered".
Version
SDK: 1.0.774.44
Runtime: 95.0.1020.53
Framework: Win32
OS: Win10
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the referenced WebView2Feedback issue 550 and reproducing the login flow with SDK 1.0.774.44, Runtime 95.0.1020.53, Win32, and Windows 10. Done would mean device-based Azure AD compliance succeeds when AllowSingleSignOnUsingOSPrimaryAccount is disabled, or the supported limitation is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100