You have signed out of your account during Azure AD login via Edge SWG

Products

• ProxySG Software - SGOS

Issue/Introduction

Users attempting to sign in to an application using Microsoft Azure AD B2C authentication are immediately logged out after submitting valid credentials. The browser displays the message: "You have signed out of your account. It’s a good idea to close all browser windows." This typically indicates a failure in the OpenID Connect (OIDC) token exchange process caused by proxy interception.

Symptoms

• User enters credentials successfully at the Identity Provider (IdP) page.
• Browser redirects to the application callback URL (e.g., https://[application-url]/oidc/login-redirect).
• The connection hangs for 20+ seconds during the redirect.
• The application server terminates the session and redirects the user to logout.
• User sees the message: You have signed out of your account.

Environment

 

• Edge SWG (ProxySG)
• SSL Interception enabled
• Microsoft Azure AD / B2C
• OIDC (OpenID Connect) Authorization Code Flow

 

Cause

In an OIDC Authorization Code flow, the application backend server must perform a "back-channel" request to Azure AD to exchange an authorization code for an access token. If SSL Interception is enabled for these domains on the Edge SWG, the proxy may interfere with the TLS handshake or modify the Authorization headers in the backend request. This leads to a network timeout or authentication failure at the application level, forcing the user to be logged out.

Resolution

Bypass SSL Interception for the application and Identity Provider domains to allow the encrypted token exchange to proceed unmodified.

1. Open the Visual Policy Manager (VPM) on the Edge SWG.
2. Navigate to the SSL Intercept Layer.
3. Create a new rule:
   • Source: Any (or specific user/IP range).
   • Destination: Create a new Request URL Object and add the following domains:
     • The application domain (e.g., example.com).
     • The Azure B2C login domain (e.g., [tenant-name].b2clogin.com).
   • Action: Set to Disable SSL Interception.
4. Install Policy to apply the changes.
5. Verify the login by clearing browser cookies and attempting a fresh sign-in.

To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.

Additional Information

Additional Information

• Subscribe to this article for updates
• Contact Broadcom Support