Auth signOut after signInWithSocialWebUI does not clear browser session

[rohitmahajan-ap]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.

Language and Async Model

Kotlin

Amplify Categories

Authentication

Gradle script dependencies

// Put output below this line

  def amplify_version = "1.37.5"
    def amplify_kotlin_version = "0.21.0"

 implementation "com.amplifyframework:core:$amplify_version"
    implementation "com.amplifyframework:aws-api:$amplify_version"
    implementation "com.amplifyframework:aws-api-appsync:$amplify_version"
    implementation "com.amplifyframework:aws-auth-cognito:$amplify_version"
    implementation "com.amplifyframework:aws-datastore:$amplify_version"
    implementation "com.amplifyframework:aws-storage-s3:$amplify_version"
    implementation "com.amplifyframework:core-kotlin:$amplify_kotlin_version"
    implementation "androidx.browser:browser:1.4.0"

Environment information

# Put output below this line
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists

Please include any relevant guides or documentation you're referencing

No response

Describe the bug

When a user installs the app, he is able to login using Microsoft by entering email and password. But when the user is logged out and tries again to login, signInWithSocialWebUI doesn't let the user enter email and password, it just automatically logs in with the previous account.

Reproduction steps (if applicable)

No response

Code Snippet

// Put your code below this line.
Amplify.Auth.signInWithSocialWebUI(provider, requireActivity(),
                    {
                            result ->
                        session.isSsoLogin = true
                        session.loggedInEmailId = email
                        authViewModel.fetchTokenAmplify()
                    },
                    {
                            error ->
                        Log.e("AuthQuickstart", "Sign in failed", error)
                    }

Log output

// Put your logs below this line

amplifyconfiguration.json

{
    "UserAgent": "aws-amplify-cli/2.0",
    "Version": "1.0",
    "api": {
        "plugins": {
            "awsAPIPlugin": {
                "ap-qa-api": {
                    "endpointType": "GraphQL",
                    "endpoint": "https://*********4.appsync-api.us-east-1.amazonaws.com/graphql",
                    "region": "us-east-1",
                    "authorizationType": "AMAZON_COGNITO_USER_POOLS",
                    "apiKey": "da2-dwmairjnb5c2jibyqy6hfjeivi",
                    "realtimeEndpoint": "wss://*********4.appsync-realtime-api.us-east-1.amazonaws.com/graphql"

                }
            }
        }
    },
    "auth": {
        "plugins": {
            "awsCognitoAuthPlugin": {
                "UserAgent": "aws-amplify/cli",
                "Version": "0.1.0",
                "IdentityManager": {
                    "Default": {}
                },
                "AppSync": {
                    "Default": {
                        "ApiUrl": "https://*********4.appsync-api.us-east-1.amazonaws.com/graphql",
                        "Region": "us-east-1",
                        "AuthMode": "AMAZON_COGNITO_USER_POOLS",
                        "ClientDatabasePrefix": "ap-qa-api_AMAZON_COGNITO_USER_POOLS",
                        "realtimeEndpoint": "wss://*********4.appsync-api.us-east-1.amazonaws.com/graphql"
                    },
                    "ap-qa-api_API_KEY": {
                        "ApiUrl": "https://*********4.appsync-api.us-east-1.amazonaws.com/graphql",
                        "Region": "us-east-1",
                        "AuthMode": "API_KEY",
                        "ApiKey": "da2-*************",
                        "ClientDatabasePrefix": "ap-qa-api_API_KEY",
                        "realtimeEndpoint": "wss://*********4.appsync-api.us-east-1.amazonaws.com/graphql"
                    }
                },
                "CognitoUserPool": {
                    "Default": {
                        "PoolId": "us-east-1_vP0W8cs8h",
                        "AppClientId": "***********",
                        "Region": "us-east-1"
                    }
                },
                "Auth": {
                    "Default": {
                        "OAuth": {
                            "WebDomain": "ap-wdfwef-****.auth.us-east-1.amazoncognito.com",
                            "AppClientId": "*****************",
                            "SignInRedirectURI": "assetpanda://sign-in",
                            "SignOutRedirectURI": "assetpanda://sign-out",
                            "Scopes": [
                                "aws.cognito.signin.user.admin",
                                "email",
                                "openid",
                                "phone",
                                "profile"
                            ]
                        },
                        "authenticationFlowType": "USER_SRP_AUTH",
                        "socialProviders": [],
                        "usernameAttributes": [
                            "EMAIL"
                        ],
                        "signupAttributes": [
                            "EMAIL"
                        ],
                        "passwordProtectionSettings": {
                            "passwordPolicyMinLength": 8,
                            "passwordPolicyCharacters": [
                                "REQUIRES_LOWERCASE",
                                "REQUIRES_UPPERCASE",
                                "REQUIRES_NUMBERS",
                                "REQUIRES_SYMBOLS"
                            ]
                        },
                        "mfaConfiguration": "OPTIONAL",
                        "mfaTypes": [
                            "TOTP"
                        ],
                        "verificationMechanisms": [
                            "EMAIL"
                        ]
                    }
                }
            }
        }
    }
}

GraphQL Schema

// Put your schema below this line

Additional information and screenshots

No response

[phantumcode]

@rohitmahajan-ap Thanks for submitting the issue. We will investigate and provide updates here.

[tylerjroach]

This is true for all social sign ins (Facebook, Google, Microsoft Entra, etc). It is a limitation with HostedUI and how Android CustomTabs function. In your case, the signed in cookie is owned by Microsoft. We can only clear credentials on the Cognito side.

For SAML providers, there is an additional config to add a SAML Sign Out flow that is meant to allow clearing all SAML credentials. However, Microsoft Entra does not appear to support sending the LogoutResponse in the required format. See #2839 and specifically #2839 (comment).

The customer on that ticket is stating a difference in behavior between Amplify v1 and v2 that we are still looking into. Since this ticket is a duplicate of #2839, I will close this one. Please follow the linked ticket for future updates with Entra.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.