Login Enterprise 6.8 is out now. See what's new
Breadcrumbs

Handling CredentialBrokerUI Prompts in Windows 365 Connector Sessions

Overview

Some authentication methods, including ADFS and legacy hybrid authentication models, open the Windows security prompt through CredentialBrokerUI at a high integrity level. Because the Launcher normally runs at a medium integrity level, it cannot interact with this prompt.

The Launcher supports two modes for handling this scenario:

  • Recommended mode: Launcher runs without elevated privileges. The Login Enterprise-shipped Launcher is digitally signed, and its manifest includes the required flag to interact with the high-integrity prompt.

  • Troubleshooting mode: Launcher runs with elevated privileges while launching the Windows 365 app in the signed-in user’s context.

Tip: Use the recommended mode by default. Use the troubleshooting mode when the recommended mode does not work.

Use this mode by default to run the Launcher without elevated privileges.

This mode might not be compatible with Script Editor or Script Recorder. If the Launcher cannot interact with the Windows security prompt in one of these environments, use the troubleshooting mode.

The Launcher manifest sets uiAccess to true, allowing the non-elevated Launcher to interact with the high-integrity Windows security prompt.

This mode requires the following on the customer side:

  • UAC to be enabled.

  • The Launcher to be installed in a secure location, such as Program Files.

Troubleshooting Mode: Elevated Launcher with launchNonElevated (since 6.7)

Use this mode when CredentialBrokerUI opens the Windows security prompt at a high integrity level, so a non-elevated Engine cannot interact with it, and the script stalls.

Running the Launcher elevated solves that, but the Windows 365 app then inherits the elevation, Windows forwards the wrong primary refresh token, and the connection fails with the following error:

An authentication error has occurred. The token supplied to the function is invalid.

To resolve both, run the Launcher with elevated privileges and pass launchNonElevated: true to START / StartApplication. Note that you need to add this to the custom connection script.

When this option is enabled, the elevated Engine launches the Windows 365 app without elevated privileges. With this configuration:

  • The Windows 365 app runs in the signed-in user’s context and uses the correct primary refresh token.

  • The elevated Engine can interact with the high-integrity Windows security prompt.