Help Understanding Single sign-on session management and UseTechnicalProfileForSessionManagement reference

Question

Hi All,

Looking for some help to clarify how something works: Regarding this section in the documentation:

When an orchestration step is executed, the technical profile associated with the step is queried for a UseTechnicalProfileForSessionManagement reference. If one exists, the referenced SSO session provider is then checked to see if the user is a session participant. If so, the SSO session provider is used to repopulate the session. Similarly, when the execution of an orchestration step is complete, the provider is used to store information in the session if an SSO session provider has been specified.

If I have a technical profile like:

And then SM-MFA technical profile of:

So back to the documentation "checked to see if the user is a session participant" - Does this mean IF session participant is found to be true then the technical profile is NOT run but SM-MFA is run?

Also if this technical profile had a content definition reference to capture some information this screen would not be displayed?

How does it determine IF the user is a session participant?

Appreciate any help.

Answer 1

@NigelW61 · After successful authentication, along with id_token, Azure AD B2C also issues Session Cookies. These session cookies are then sent as part of the request for subsequent sign-ins if user tries to authenticate using same browser session.

E.g. after successful sign-in via signup/signin user flow, user triggers profile editing user flow. The orchestration steps defined for profile editing may call a Technical Profile which will check its UseTechnicalProfileForSessionManagement reference for session management. If user has already done MFA in the same browser session, SM-MFA won't trigger MFA during profile editing user flow.

Does this mean IF session participant is found to be true then the technical profile is NOT run but SM-MFA is run?
SM-MFA has to be called by a technical profile which is referenced in Orchestration step and can't be run without running Technical profile.

Also if this technical profile had a content definition reference to capture some information this screen would not be displayed?
If technical profile is configured to capture information, that will be displayed.

How does it determine IF the user is a session participant?
This is determined on the basis of weather user has provided valid session cookies in the request or not.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.