We have a plugin where we are showing some user data and allowing single sign-on to the providers of that data. In our testing, some of our users that have multiple profiles were seeing issues of the original profile’s data being loaded into the plugin after they switch onto a different profile. The outcome is always the same, whichever profile was logged into first at the time they open the app/website is the profile they’ll see after they switch to a different one.

We have three basic routes when it hits the plugin:

1. We’ll check if there’s a refresh token for the API that we stored into a session thats still active. If so, we’ll get the user’s info using that token.
2. We’ll check if there’s a code url parameter. If not, we’ll redirect to the Banno sign-in page for our institution.
3. If those conditions aren’t met we’ll get the user’s info by retrieving a new token.