ADAL.js：如何在令牌到期后强制用户重新输入密码

Question

我有一个使用 adal-angular (https://github.com/AzureAD/azure-activedirectory-library-for-js) 进行安全访问的单页应用程序。 每当令牌过期（1 小时后），我想将用户重定向到 AD 登录屏幕，重新输入他们的密码。 我已修改 adal-angular.js 以在令牌过期时调用 _adal.login() ，但这似乎会自动重新验证用户并使用更新的令牌将他们直接带到重定向 URI。 我不确定缓存的是什么，它允许自动续订。

如何在令牌过期时强制用户重新输入密码？

Answer 1

AFAIK，当令牌过期时，adal.js 使用 iframe 中的隐式流获取令牌。不支持强制用户重新登录。

要实现此功能，您可以修改源代码。下面是修改adal.js中acquireToken和login方法的代码示例，供大家参考：

AuthenticationContext.prototype.acquireToken = function (resource, callback) {
    if (this._isEmpty(resource)) {
        this.warn('resource is required');
        callback('resource is required', null, 'resource is required');
        return;
    }

    var token = this.getCachedToken(resource);
    if (token) {
        this.info('Token is already in cache for resource:' + resource);
        callback(null, token, null);
        return;
    }
    //add by me-begin
    var expiry = this._getItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + resource);

    var isExpired = true;
    // If expiration is within offset, it will force renew
    var offset = this.config.expireOffsetSeconds || 300;

    if (expiry && (expiry > this._now() + offset)) {
        isExpired = false;
    }

    //add by me-end
    if (!this._user) {
        this.warn('User login is required');
        callback('User login is required', null, 'login required');
        return;
    }
    //add by me-begin
    else if (isExpired) {
        this.login(null,"prompt=login");
    }
    //add by me-end
    // refresh attept with iframe
    //Already renewing for this resource, callback when we get the token.
    if (this._activeRenewals[resource]) {
        //Active renewals contains the state for each renewal.
        this.registerCallback(this._activeRenewals[resource], resource, callback);
    }
    else {
        if (resource === this.config.clientId) {
            // App uses idtoken to send to api endpoints
            // Default resource is tracked as clientid to store this token
            this.verbose('renewing idtoken');
            this._renewIdToken(callback);
        } else {
            this._renewToken(resource, callback);
        }
    }
};

//add the extraParameters to force user sign-in
AuthenticationContext.prototype.login = function (loginStartPage,extraParameters) {
    // Token is not present and user needs to login
    if (this._loginInProgress) {
        this.info("Login in progress");
        return;
    }
    var expectedState = this._guid();
    this.config.state = expectedState;
    this._idTokenNonce = this._guid();
    this.verbose('Expected state: ' + expectedState + ' startPage:' + window.location.href);
    this._saveItem(this.CONSTANTS.STORAGE.LOGIN_REQUEST, loginStartPage || window.location.href);
    this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, '');
    this._saveItem(this.CONSTANTS.STORAGE.STATE_LOGIN, expectedState);
    this._saveItem(this.CONSTANTS.STORAGE.NONCE_IDTOKEN, this._idTokenNonce);
    this._saveItem(this.CONSTANTS.STORAGE.ERROR, '');
    this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, '');
    var urlNavigate = this._getNavigateUrl('id_token', null) + '&nonce=' + encodeURIComponent(this._idTokenNonce);
    urlNavigate = urlNavigate + "&"+extraParameters;//add by me
    this._loginInProgress = true;
    if (this.config.displayCall) {
        // User defined way of handling the navigation
        this.config.displayCall(urlNavigate);
    }
    else if (this.popUp) {
        this._loginPopup(urlNavigate);
    }
   else {
        this.promptUser(urlNavigate);
    }
};

如果您对这个库有任何想法或反馈，可以从here 提出新问题。