ADB2C How to share user token between two different applications? - azure-ad-b2c

Question

I would like to achieve this:
I have two applications using adb2c for authentication. I would like a user to be able to sign in interactively in the first application and then be logged in silently in the second application.
What I have for now:
Both applications are registered in Azure environment, with two different client id.
Both applications share the exact same code, same cache and same configuration, except for the client id.
I am coding in C# and using the Microsoft.Identity.Client dll .
My issue is:
If I use the same client id for both applications (as if they were registered as a single application), the user can sign interactively in one application and then be logged in silently in the second one.
But, if I use two different client id, it is no longer working. If the user first signed in interactively in application 1, when I call GetAccountsAsync() in application 2 to get the user account in cache, it returns no account.
My code:
To acquire token interactively:
private async Task<AuthenticationResult> AcquireTokenInteractiveAsync()
{
try
{
AuthenticationResult ar = await pubClientApp.AcquireTokenInteractive(config.ApiScopes).WithB2CAuthority(config.GetAuthoritySignUpSignIn()).WithExtraQueryParameters(ui_locale).ExecuteAsync();
return ar;
}
catch (MsalException ex)
{
}
catch (Exception ex)
{
}
return null;
}
 
To acquire token silently:
private async Task<AuthenticationResult> AcquireTokenSilentAsync()
{
try
{
var accounts = await pubClientApp.GetAccountsAsync();
if (accounts.Count() > 0)
{
AuthenticationResult ar = await pubClientApp.AcquireTokenSilent(config.ApiScopes,accounts.FirstOrDefault()).ExecuteAsync();
return ar;
}
}
catch (Exception ex)
{
}
return null;
}
Thanks for your help :)

Answer 1

You cannot share tokens between the apps, what your observe is expected.
You have to acquire a token interactively on the second app once a silent call fails, and the interactive flow will rely on AAD B2C session cookies to give the user Single Sign On.
You can read about sessions and single sign on here:
https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy