Skip to content

Instantly share code, notes, and snippets.

@matdcooper
Last active October 30, 2023 15:28
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save matdcooper/5b20c31078a75d7c102297fed4729525 to your computer and use it in GitHub Desktop.
Save matdcooper/5b20c31078a75d7c102297fed4729525 to your computer and use it in GitHub Desktop.
Azure AD B2C Custom Policy Notes

Disclaimer: The content of this Gist is not official documentation. It is based purely on my own observations / findings. Use at your own risk! But please correct me if you spot any errors :-)

Turning off email verification

Add the following Item to the Metadata element of the TechnicalProfile in which an email address is requested:

<Item Key="EnforceEmailVerification">False</Item>

e.g. the TechnicalProfile containing the following OutputClaim:

<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />

DateTime, Date etc.

DateTime vs Date

You cannot write extension attributes with dataType of date to AAD. date is not supported by AAD.

You cannot use DateTimePicker with dataType of DateTime. You will get a 500 error within the user flow.

But... You can create an extension attribute of dataType of DateTime, upload the policy to create the extension attribute on the B2C application, then change the DateTime attribute to a date attribute. This will then successfully write to AAD, and can be edited by DateTimePicker.

See: https://stackoverflow.com/questions/52206738/azure-ad-b2c-internal-error-uploading-custom-policy

Reading DateTime from AAD

You seem to get errors when reading DateTime attributes from AAD inside a ValidationTechnicalProfiles. Instead, read the attribute in a user journey step technical profile.

Writing to AAD

objectId

If the user (ClaimsPrinciple) already exists, the objectId claim needs to be an input claim, and a persisted claim. I.e.:

<InputClaim ClaimTypeReferenceId="objectId" Required="true" />

<PersistedClaim ClaimTypeReferenceId="objectId" />

REST exchanges

If trying to save claims returned from a REST function call to AAD, perform the write in the next step as opposed to in a ValidationTechnicalProfiles within the REST TechnicalProfile.

Can you pass password claim between steps?

No

See:

https://stackoverflow.com/questions/51892902/can-you-pass-password-claims-between-steps-in-azure-ad-b2c-custom-policies/51892936

https://stackoverflow.com/questions/49206782/azure-ad-b2c-multi-steps-custom-policy

Returning tfp claim

How to do it:

https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-manage-sso-and-token-configuration

https://stackoverflow.com/questions/46683705/how-can-i-return-the-policyid-claim-after-executing-my-custom-signupsignin-polic

acr vs tfp:

https://stackoverflow.com/questions/46688455/in-azure-ad-b2c-should-the-acr-or-tfp-claim-have-the-policy-name

Returning emails claim

How to do it:

https://stackoverflow.com/questions/47145452/return-emails-on-custom-policies

UI

Language fields

Key Default Value
month Month
ver_but_default Default
ver_fail_server We are having trouble verifying your email address. Please enter a valid email address and try again.
ver_intro_msg Verification is necessary. Please click Send button.
ver_fail_throttled There have been too many requests to verify this email address. Please wait a while, then try again.
months January, February, March, April, May, June, July, August, September, October, November, December
ver_input Verification code
ver_fail_retry That code is incorrect. Please try again.
error_requiredFieldMissing A required field is missing. Please fill out all required fields and try again.
error_passwordEntryMismatch The password entry fields do not match. Please enter the same password in both fields and try again.
helplink_text What is this?
alert_yes Yes
ver_sent Verification code has been sent to:
verifying_blurb Please wait while we process your information.
ver_but_edit Change e-mail
ver_but_send Send verification code
ver_success_msg E-mail address verified. You can now continue.
cancel_message The user has cancelled entering self-asserted information
ver_incorrect_format Incorect format.
error_fieldIncorrect One or more fields are filled out incorrectly. Please check your entries and try again.
alert_message Are you sure that you want to cancel entering your details?
button_continue Create
alert_title Cancel Entering Your Details
ver_fail_no_retry You've made too many incorrect attempts. Please try again later.
alert_no No
preloader_alt Please wait
ver_fail_code_expired That code is expired. Please request a new code.
button_cancel Cancel
ver_info_msg Verification code has been sent to your inbox. Please copy it to the input box below.
ver_but_verify Verify code
required_field This information is required.
ver_but_resend Send new code
initial_intro Please provide the following details. You will not be able to continue until you have verified your email address.
year Year
day Day

Links

Repos

Custom Policy Starter Pack

https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack

Advanced Policies

https://github.com/Azure-Samples/active-directory-b2c-advanced-policies

YouTube

Microsoft Identity Conference, 2017

https://www.youtube.com/channel/UCP2Px7fpUsYBbzROwK7w3tw

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment