A second sign in prompt is still shown after completing an OAuth flow initiated by SessionManager.signIn

RyanTaylor — Thu, 16 Oct 2025 17:16:01 GMT

We developed an Experience Builder Dev Edition 1.17 experience that we deploy to our own web server, e.g., https://example.com/exb with our Enterprise 11.3 portal at https://example.com/portal.

We require that the user sign in to the application immediately, before any widgets are rendered and before they attempt to send HTTP/REST requests to any out of the box or custom services and rest apis. I.e., the out of the box "sign in when first accessing a protected resource" happens much too late in the worfklow for our custom services.

To that end we've implemented an app extension using APP_CONFIG_PROCESSOR that is called very early in the app startup. The extension calls SessionManager.signIn to initiate an OAuth flow against Enterprise Portal. (See the code at bottom for implementation details).

However, we've run into a couple issues.

P1. Running locally: The extension is not executed on a soft refresh.

When running everything locally via Experience Builder dev edition (i.e., npm run start) I've recently found that that extension code is not run on a soft refresh of the application (i.e., F5) however it is run on a hard refresh (CTRL-F5). If the extension code is not run I'm unable to set the token for some our our services and our widgets fail.

Q1. Shouldn't the extension point run regardless soft or hard page refreshes?

P2. Running the deployed app: Second out of the box sign prompt persists

When running the deployed application, after the user logs in via our initiated flow the application reloads and the user is prompted with a second out of the box sign in dialog. If they choose to sign in, they do so via a popup, and most things work. If they choose to cancel the sign in, the map and other widgets fail due to an invalid session/token/something else.

Q2. How do we initiate a sign in flow that fully signs in the user such that no subsequent sign prompts are required? Is SessionManager.signIn() insufficient?

Here is the code.

// extensions/login.ts export default class Login implements extensionSpec.AppConfigProcessorExtension { id = "my-awesome-login"; widgetId: string; async process(appConfig: AppConfig): Promise<AppConfig> { try { await signIn("<myportal>", "myclientid"); return Promise.resolve(appConfig); } catch (err) { console.error(err); return Promise.resolve(appConfig); } } } export async function signIn(portalUrl: string, clientId) { const sm = SessionManager.getInstance(); const mainSession = sm?.getMainSession(); const user = await mainSession?.getUser(); const loggedIn = !!mainSession && !!user; if (!loggedIn) { const userSession = await sm.signIn({ popup: false, desUrl: portalUrl, clientId: clientId, fromUrl: window.location.href, forceLogin: true, }); // when popup is false the following code is unreachable // as the window refreshes to sign the user but is left // in place in case we want to turn popup: true // Set private _token variable in Usage Tracking Module setUsageToken(userSession.token); } else { // Set private _token variable in Usage Tracking Module setUsageToken((userSession.token); } }

cc @JunshanLiu ?

Re: A second sign is still required after completing an OAuth flow initiated by SessionManager.signIn

JeffreyThompson2 — Thu, 09 Oct 2025 18:18:21 GMT

@Jianxia @Wei_Ying Using the Security options count as canceling the login popup and trigger the affects documented by @RyanTaylor.

Re: A second sign is still required after completing an OAuth flow initiated by SessionManager.signIn

RyanTaylor — Fri, 10 Oct 2025 18:42:34 GMT

Thanks for the post. I am using Experience Builder 1.17 and this does not seem to be available to me. I updated my post to reflect the version number.

Re: A second sign in prompt is still shown after completing an OAuth flow initiated by SessionManager.signIn

Wei_Ying — Mon, 17 Nov 2025 19:51:32 GMT

@XiaodongWang any idea?

Re: A second sign in prompt is still shown after completing an OAuth flow initiated by SessionManager.signIn

Jianxia — Mon, 22 Dec 2025 22:45:20 GMT

@RyanTaylor, Thank you for being patient with us. The team has performed the following tests. Unfortunately, we are unable to reproduce the problem on our side.

Tested with dev1.19 - issue cannot be reproduced in either the builder environment or the deployed environment.
Tested with dev1.17 - issue cannot be reproduced in either the builder environment or the deployed environment.
Tested with the app built with v1.17 and deployed to the same web server hosting the portal 12.0 - issue cannot be reproduced.

Please let us know if there is something we missed.

topic Re: A second sign is still required after completing an OAuth flow initiated by SessionManager.signIn in ArcGIS Experience Builder Questions

A second sign in prompt is still shown after completing an OAuth flow initiated by SessionManager.signIn

Re: A second sign is still required after completing an OAuth flow initiated by SessionManager.signIn

Re: A second sign is still required after completing an OAuth flow initiated by SessionManager.signIn

Re: A second sign in prompt is still shown after completing an OAuth flow initiated by SessionManager.signIn

Re: A second sign in prompt is still shown after completing an OAuth flow initiated by SessionManager.signIn