Authentication Failure in Edge for iframe Embedded in Sharepoint

[m4ngo5]

Hi, I have a PowerApp embedded in a SharePoint page using an iframe in an embed web part.  The app loads and runs great for users in Chrome, Firefox, and IE, but on some devices it does not work in Edge.  This is a big issue for us, because we encourage the use of Edge due to the Windows Authentication.

 

After encountering the issue on my device, I tried to replicate the issue.  I have tried this in Edge with 8 devices and with 7 users. Of those 8 devices, 5 are Azure-AD joined and 3 are Azure AD registered.  This has affected 2 devices of those 8 devices tested so far; in testing, the issue did not show user affinity.  1 affected device was Azure-AD joined, the other 1 device was Azure-AD registered.  Edge on both types of affected devices pulls user credentials from Windows.


For the embedded iframe in SharePoint, on devices where it is not working in Edge, the user gets a message that says "Sign in to start using PowerApps", "Sign in".  When you click the "Sign in" button, it opens a popup, the popup closes, then the webpart displays a loading spinner for a few hundred milliseconds before displaying the "Sign In" message again.  I have looped this sign in a few dozen times to cover my bases.


In addition to the iframe embedded in SharePoint, I have also tried to use the PowerApps SharePoint web part, which also failed, most likely due to the same sort of authentication issue.  When it fails in the native PowerApps SharePoint web part, it says "This app isn't working. Refresh your browser or try again later."  And there is a "More" button where you can find details on the "Session ID".  In any case, I want to use an iframe, not the PowerApps SharePoint web part, because it is easier to size the PowerApp when using an iframe.


Things I have tried and their effect:

• Clear all browser data including cookies and cache.
  • No effect.
• Use an inPrivate browser window in Edge
  • No effect.
• Signing in the affected user on a different device.
  • This works except when the device is an affected device.
• Signing into Office 365 in Edge on the affected device with different user credentials.
  • No effect.
• Signing into Office 365 in an inPrivate Edge window on the affected devices with different user credentials.
  • No effect.
• Performing a "Repair" in the advanced options in Windows Settings for Edge (not the settings you can access from the browser).
  • No effect.
• Performing a "Reset" in the advanced options in Windows Settings for Edge (again, not the settings you can access from the browser).
  • This works! When you load the page, there is no sign-in prompt whatsoever, authentication is automatic.  However, once you close Edge, relaunch, and load the page the sign-in loop is back.
• Putting the PowerApp on a different page; using a different PowerApp; trying a different site; trying a different site collection.
  • No effect.
• Embedding the PowerApp in a PowerBi dashboard instead of a SharePoint page.
  • Same sign in issue as seen in SharePoint.
• Embedding a PowerBi dashboard on the SharePoint page instead of a PowerApp -- both using iframes and the PowerBi SharePoint web part.
  • Both ways worked, no problem.

The core issue is some sort of authentication failure.  I have used dev tools to examine network requests, cookies, etc, and though my analysis is quite amateur, I can conclude there is something wrong during authentication.  Compared to a successful authentication, there are lot's of 302s in the network activity and there are some dangling authentication cookies.

This issue is specific to PowerApps in Edge and has something to do with authentication in Edge.  I'm not sure what to do next.  I need this working and I would appreciate any help from people on the forums or Microsoft personnel.  I can supply more information upon request. Thanks.

--Stuart

[cherie]

Wow that was pretty extensive testing!

Could you please do the following?

Where it navigates to the error page, please provide the session id located there.

In the other cases, can you please provide the session id for the form?

You can fetch it in one of two ways:

- With keyboard and mouse - Alt + right click

- With touch - Touch with two fingers for 1 to 2 seconds then release.

What devices are you using?

Thanks!

Cherie

[m4ngo5]

Thanks for responding so quickly, Cherie.  I wanted to be extensive so we could get straight to the issue!

Here is the session ID from a PowerApp web part in Edge that was getting the error. Session ID: 46e523fb-177b-482f-9420-eb792c61fab4

Here is the session ID from the same PowerApp web part but from a Firefox browser that ran successfully with nosSign in error.  Session ID: ba1b66be-12f4-4214-a08f-1a4683bd1fdb

It would not give me the session ID from an iframe in Edge.  I was able to click "Session details" using the Alt + right click, but it did nothing.

All the devices tested are Windows 10 desktops or laptops.  The specific device I am doing most my testing on is a Lenovo M710 running Windows 10 Pro.

[cherie]

Can you let me know if it works in Edge if you visit web.powerapps.com (and sign in there) first?

Thanks

Cherie

[m4ngo5]

Hi Cherie,

I just tried it, and that does not make it work.

--Stuart

[cherie · Accepted solution]

Do you have sharepoint in your trusted sites (Internet explorer settings)? If so, can you try either removing that, or putting web.powerapps.com into your trusted sites and see if that fixes it?

You will need to restart Edge for that to take effect.

[m4ngo5]

Hi Cherie,

I tried a few permutations of that.  Ultimately, here is what worked:

• When only PowerApps is in trusted sites, neither the PowerApps web part nor the iframe work.
• When only SharePoint is in trusted sites, the PowerApps web part works, but not the iframe.
• When both SharePoint and PowerApps are in trusted sites, both the PowerApps web part and the iframe work!

At least on my machine.  I will get in touch with the other use who experienced problems and see if this works for them.  Is there something the PowerApps team or Edge team can do to fix this issue so the trusted sites workaround isn't necessary?

[cherie]

Hey,

That was actually something I recently uncovered myself and it is a security feature in Edge and Internet Explorer. We're working on providing some better error messaging in this case, but at this point in time, I'm not sure there is anything we can do to fix.

I will try reach out to the Edge team to see if they have any suggestions, but I believe it is part of their security model.

Thanks

Cherie

[m4ngo5]

Okay, thanks for the info.  If you are able to provide an update here after getting in contact with the Edge team, that would be awesome. 

I appreciated your help Cherie.  I will mark your reply as a solution once I am able to try this on the other affected device.

[cherie]

This is a pretty good explanation on the security zones in internet explorer (even though it is rather old)

https://www.itprotoday.com/security/guide-internet-explorer-security-zones