Problem signing out when app runs under MS Managed Home Screen in Kiosk mode

[MihaMarkic]

Describe the bug

ISingleAccountPublicClientApplication.signOut doesn't clear the token even though it seems to succeed when app runs under MS Managed Home Screen and Kiosk mode. Next time app starts, the token is still available (through ISingleAccountPublicClientApplication.acquireTokenSilentAsync)
When app is not in kiosk mode, it behaves correctly.

Smartphone (please complete the following information):

• Device: Samsung A53
• Android Version: 16
• Browser: N/A
• MSAL Version: 8.2.0
• Managed Home Screen 2.2.0.108880

To Reproduce

Run app under MS Managed Home Screen in Kiosk mode, authenticate and then try to sign out.

I can't reproduce it myself as this happens to the client and I don't have access to their network. Will try to collect more data. Interesting enough, app has no problem authenticating. Its just token clearing that doesn't work for a reason or another.

Expected behavior

After successful sign out, token should be cleared.

Actual Behavior

After successful sign out ISingleAccountPublicClientApplication.acquireTokenSilentAsync stil returns a valid token.

[github-actions]

Thank you for opening this issue!

Labels Applied:
User-Error: The issue seems to arise primarily due to the specific behavior of the MS Managed Home Screen in Kiosk mode rather than a library bug within MSAL. The sign-out operation may not function as expected because of the restrictions or policies in Kiosk mode, particularly regarding app data clearing and token storage..
needs-more-info: The user mentions they cannot reproduce the issue as it occurs in the client's network and under specific conditions (MS Managed Home Screen and Kiosk mode). More information is needed about how Kiosk mode interacts with local app storage and token clearing behaviors, as well as logs from the client environment..

🤖 AI Analysis

This issue points to token persistence behavior when using MS Managed Home Screen in Kiosk mode. Follow these steps to ensure proper handling:

1. Check Token Clearance:
   Ensure that the signOut implementation is correctly invoked and that any potential MsalException errors are handled appropriately. Add logging to verify the completion of both signOut and the token clearance process.

   mSingleAccountApp.signOut(new ISingleAccountPublicClientApplication.SignOutCallback() {
       @Override
       public void onSignOut() {
           Log.d("MSAL", "Sign out completed successfully.");
       }
   
       @Override
       public void onError(@NonNull MsalException exception) {
           Log.e("MSAL", "Sign out failed: " + exception.getMessage());
       }
   });

2. Kiosk Mode Storage Limitations:
   Kiosk mode and MS Managed Home Screen may restrict how app storage (including shared preferences and cache) is cleared. This could lead to persistent tokens despite invoking signOut(). Work with the IT admin managing the Kiosk environment to understand storage behavior in Kiosk mode.

3. Force Token Clearance:
   Consider programmatically clearing MSAL's cache and app data explicitly:

   public void clearMsalCache(Context context) {
       try {
           context.getSharedPreferences("com.microsoft.identity.client", Context.MODE_PRIVATE).edit().clear().apply();
           Log.d("MSAL", "MSAL cache cleared.");
       } catch (Exception e) {
           Log.e("MSAL", "Failed to clear MSAL cache: " + e.getMessage());
       }
   }

   Additionally, ensure the client has attempted to manually clear app data in their environment to verify if the issue persists.

4. Broker Behavior:
   If the app uses the MSAL broker (e.g., Microsoft Authenticator), ensure the broker is also signed out during the process. Include broker_redirect_uri_registered: true in the configuration and confirm that the broker functions properly in Kiosk mode with no interference.

5. Additional Debugging:
   Enable detailed logging to capture more information about what's happening during the sign-out operation. Logs are crucial for understanding if any policy or environmental restriction is causing the issue.

   Logger.getInstance().setLogLevel(Logger.LogLevel.VERBOSE);
   Logger.getInstance().setEnableLogcatLog(true);
   Logger.getInstance().setEnablePII(true); // For debugging only.

6. Latest MSAL Version:
   Although the app uses MSAL version 8.2.0, ensure that the latest version (8.2.1) is implemented. Review release notes for potential fixes or additional configurations for Kiosk environments.

7. Collaboration with Microsoft Intune / Managed Home Screen Teams:
   Raise the issue with the Managed Home Screen or Intune teams. They may have specific guidance for working with MSAL and token management in Kiosk mode.

See also: #1570, #1737, #1842, #2026, #2157

Related Issues: #1570, #1737, #1842, #2026, #2157

---

📦 MSAL Version Update Available

You are using MSAL version 8.2.0. The latest version is 8.2.1.

We recommend updating to the latest version to benefit from bug fixes, security improvements, and new features.

implementation "com.microsoft.identity.client:msal:8.+"

Using 8.+ automatically gets patch updates within the 8.x series.

---

To help us assist you, please provide:

• Android version and device
• Complete error message/stack trace
• Steps to reproduce

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.