Fixing one of the Azure AD B2C samples that refers to a disabled federated user.

B2C_1A_DisableSocialAcct_TrustFrameworkExtensions.xml

<?xml version="1.0" encoding="utf-8" ?>
<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                      xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="yourtenant.onmicrosoft.com" PolicyId="B2C_1A_DisableSocialAcct_TrustFrameworkExtensions" PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_DisableSocialAcct_TrustFrameworkExtensions">
  
	<BasePolicy>
		<TenantId>yourtenant.onmicrosoft.com</TenantId>
		<PolicyId>B2C_1A_DisableSocialAcct_TrustFrameworkBase</PolicyId>
	</BasePolicy>
  
	<BuildingBlocks>
	
		<ClaimsSchema>
	
			<ClaimType Id="issuerUserId">
				<DisplayName>Username</DisplayName>
				<DataType>string</DataType>
				<UserHelpText/>
				<UserInputType>TextBox</UserInputType>
				<Restriction>
					<Pattern RegularExpression="^[a-zA-Z0-9]+[a-zA-Z0-9_-]*$" HelpText="The username you provided is not valid. It must begin with an alphabet or number and can contain alphabets, numbers and the following symbols: _ -"/>
				</Restriction>
			</ClaimType>
			
			<ClaimType Id="errorMessage">
				<DisplayName>This account is locked.</DisplayName>
				<DataType>string</DataType>
				<UserHelpText>Add help text here</UserHelpText>
				<UserInputType>Paragraph</UserInputType>
			</ClaimType>
	  
		</ClaimsSchema>
		
		<ClaimsTransformations>
		
			<!-- <ClaimsTransformation Id="AssertAccountEnabledIsTrue" TransformationMethod="AssertBooleanClaimIsEqualToValue"> -->
				<!-- <InputClaims> -->
					<!-- <InputClaim ClaimTypeReferenceId="extension_accountEnabled" TransformationClaimType="inputClaim"/> -->
				<!-- </InputClaims> -->
				<!-- <InputParameters> -->
					<!-- <InputParameter Id="valueToCompareTo" DataType="boolean" Value="true"/> -->
				<!-- </InputParameters> -->
			<!-- </ClaimsTransformation> -->
			
			<ClaimsTransformation Id="CreateRegErrorMessage" TransformationMethod="CreateStringClaim">
				<InputParameters>
					<InputParameter Id="value" DataType="string" Value="Please contact support - code 123568"/>
				</InputParameters>
				<OutputClaims>
					<OutputClaim ClaimTypeReferenceId="errorMessage" TransformationClaimType="createdClaim"/>
				</OutputClaims>
			</ClaimsTransformation>
	
		</ClaimsTransformations>
	</BuildingBlocks>

	<ClaimsProviders>
		<ClaimsProvider>
			<DisplayName>Local Account SignIn</DisplayName>
			<TechnicalProfiles>
				<TechnicalProfile Id="login-NonInteractive">
					<Metadata>
						<Item Key="client_id">997...f04</Item>
						<!-- Native App -->
						<Item Key="IdTokenAudience">2ef...86dc</Item>
						<!-- Web Api -->
					</Metadata>
					<InputClaims>
						<InputClaim ClaimTypeReferenceId="client_id" DefaultValue="997...f04"/>
						<InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="2ef...86dc"/>
					</InputClaims>
				</TechnicalProfile>
			</TechnicalProfiles>
		</ClaimsProvider>

		<ClaimsProvider>
			<Domain>Your tenant</Domain>
			<DisplayName>Login using your AAD tenant/DisplayName>
			<TechnicalProfiles>
				<TechnicalProfile Id="AADYT-OpenIdConnect">
					<DisplayName>Your AAD tenant Employee</DisplayName>
					<Description>Login with your your AAD tenant account</Description>
					<Protocol Name="OpenIdConnect"/>
					<Metadata>
						<Item Key="METADATA">https://login.microsoftonline.com/yourAADtenant.onmicrosoft.com/v2.0/.well-known/openid-configuration</Item>
						<Item Key="client_id">ad3...1c1</Item>
						<Item Key="response_types">code</Item>
						<Item Key="scope">openid profile</Item>
						<Item Key="response_mode">form_post</Item>
						<Item Key="HttpBinding">POST</Item>
						<Item Key="UsePolicyInRedirectUri">false</Item>
					</Metadata>
					<CryptographicKeys>
						<Key Id="client_secret" StorageReferenceId="B2C_1A_yourAADtenantFedSecret"/>
					</CryptographicKeys>
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid"/>
						<OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
						<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name"/>
						<OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name"/>
						<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>
						<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email"/>
						<OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn"/>
						<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true"/>
						<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss"/>
					</OutputClaims>
					<OutputClaimsTransformations>
						<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
						<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
						<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
						<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
					</OutputClaimsTransformations>
					<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin"/>
				</TechnicalProfile>

				<!-- <TechnicalProfile Id="AAD-DisabledUserPage"> -->
					<!-- <DisplayName>Page for disabled AAD User</DisplayName> -->
					<!-- <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/> -->
					<!-- <Metadata> -->
						<!-- <Item Key="ContentDefinitionReferenceId">api.disableduser</Item> -->
						<!-- <Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">Your account has been locked. Contact your support person to unlock it, then try again.</Item> -->
					<!-- </Metadata> -->
					<!-- <CryptographicKeys> -->
						<!-- <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer"/> -->
					<!-- </CryptographicKeys> -->
					<!-- <InputClaims> -->
						<!-- <InputClaim ClaimTypeReferenceId="extension_accountEnabled"/> -->
					<!-- </InputClaims> -->
					<!-- <OutputClaims> -->
						<!-- <OutputClaim ClaimTypeReferenceId="extension_accountEnabled"/> -->
						<!-- <OutputClaim ClaimTypeReferenceId="dummy"/> -->
					<!-- </OutputClaims> -->
					<!-- <ValidationTechnicalProfiles> -->
						<!-- <ValidationTechnicalProfile ReferenceId="AAD-AssertAccountEnabled"/> -->
					<!-- </ValidationTechnicalProfiles> -->
					<!-- <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/> -->
				<!-- </TechnicalProfile> -->

				<!-- <TechnicalProfile Id="AAD-AssertAccountEnabled"> -->
					<!-- <Metadata> -->
						<!-- <Item Key="Operation">Read</Item> -->
						<!-- <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item> -->
						<!-- <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">User does not exist. Please sign up before you can sign in.</Item> -->
						<!-- <Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">Your account has been locked. Contact your support person to unlock it, then try again.</Item> -->
					<!-- </Metadata> -->
					<!-- <InputClaims> -->
						<!-- <InputClaim ClaimTypeReferenceId="AlternativeSecurityId" PartnerClaimType="alternativeSecurityId" Required="true"/> -->
					<!-- </InputClaims> -->
					<!-- <OutputClaims> -->
						<!-- <OutputClaim ClaimTypeReferenceId="extension_accountEnabled"/> -->
					<!-- </OutputClaims> -->
					<!-- <OutputClaimsTransformations> -->
						<!-- <OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue"/> -->
					<!-- </OutputClaimsTransformations> -->
					<!-- <IncludeTechnicalProfile ReferenceId="AAD-Common"/> -->
				<!-- </TechnicalProfile> -->

				<!-- Read the extension_AccountEnabled attribute for Social Accounts on each logon-->
				<TechnicalProfile Id="AAD-UserReadUsingAlternativeSecurityId">
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="extension_accountEnabled"/>
					</OutputClaims>
					<IncludeTechnicalProfile ReferenceId="AAD-Common"/>
				</TechnicalProfile>
		
				<TechnicalProfile Id="AAD-UserReadUsingAlternativeSecurityId-NoError">
					<Metadata>
						<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">false</Item>
					</Metadata>
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="extension_accountEnabled"/>
					</OutputClaims>
					<IncludeTechnicalProfile ReferenceId="AAD-UserReadUsingAlternativeSecurityId"/>
				</TechnicalProfile>
        
				<!-- Modify to write the signInName property for the Social Account and extension_AccountEnabled
          AccountEnabled is usually false for Social IdP accounts since a password is not set in B2C-->
				<TechnicalProfile Id="AAD-UserWriteUsingAlternativeSecurityId">
					<PersistedClaims>
						<PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress"/>
						<PersistedClaim ClaimTypeReferenceId="extension_accountEnabled" AlwaysUseDefaultValue="true" DefaultValue="true"/>
					</PersistedClaims>
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="extension_accountEnabled" AlwaysUseDefaultValue="true" DefaultValue="true"/>
					</OutputClaims>
					<IncludeTechnicalProfile ReferenceId="AAD-Common"/>
					<UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>
				</TechnicalProfile>
			</TechnicalProfiles>
		</ClaimsProvider>
		
		<ClaimsProvider>
			<DisplayName>Self Asserted</DisplayName>
			<TechnicalProfiles>
				<TechnicalProfile Id="SelfAsserted-Error">
					<DisplayName>Error message</DisplayName>
					<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
					<Metadata>
						<Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
						<Item Key="setting.showContinueButton">false</Item>
						<Item Key="setting.showCancelButton">false</Item>
					</Metadata>
					<InputClaims>
						<InputClaim ClaimTypeReferenceId="errorMessage"/>
					</InputClaims>
					<OutputClaims>
						<OutputClaim ClaimTypeReferenceId="errorMessage"/>
					</OutputClaims>
				</TechnicalProfile>

				<TechnicalProfile Id="SelfAsserted-RegError">
					<InputClaimsTransformations>
						<InputClaimsTransformation ReferenceId="CreateRegErrorMessage"/>
					</InputClaimsTransformations>
					<IncludeTechnicalProfile ReferenceId="SelfAsserted-Error"/>
				</TechnicalProfile>

			</TechnicalProfiles>
		</ClaimsProvider>
	</ClaimsProviders>

	<UserJourneys>
		<UserJourney Id="SignUpOrSignInAAD-Disable">
			<OrchestrationSteps>
				<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
					<ClaimsProviderSelections>
						<ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange"/>
						<ClaimsProviderSelection TargetClaimsExchangeId="AADExchange"/>
					</ClaimsProviderSelections>
					<ClaimsExchanges>
						<ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email"/>
					</ClaimsExchanges>
				</OrchestrationStep>
        
				<!-- Check if the user has selected to sign in using one of the social providers -->
				<OrchestrationStep Order="2" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>objectId</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADExchange" TechnicalProfileReferenceId="AADYT-OpenIdConnect"/>
						<ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail"/>
					</ClaimsExchanges>
				</OrchestrationStep>
        
				<!-- For social IDP authentication, attempt to find the user account in the directory. -->
				<OrchestrationStep Order="3" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
							<Value>authenticationSource</Value>
							<Value>localAccountAuthentication</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError"/>
					</ClaimsExchanges>
				</OrchestrationStep>
        
				<!--Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). 
          This can only happen when authentication happened using a social IDP. If local account was created or authentication done
          using ESTS in step 2, then an user account must exist in the directory by this time. -->
				<OrchestrationStep Order="4" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>objectId</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social"/>
					</ClaimsExchanges>
				</OrchestrationStep>

				<!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent 
          in the token. -->
				<OrchestrationStep Order="5" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
							<Value>authenticationSource</Value>
							<Value>socialIdpAuthentication</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId"/>
					</ClaimsExchanges>
				</OrchestrationStep>
        
				<!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect 
             from the user. So, in that case, create the user in the directory if one does not already exist 
             (verified using objectId which would be set from the last step if account was created in the directory. -->
				<OrchestrationStep Order="6" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>objectId</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId"/>
					</ClaimsExchanges>
				</OrchestrationStep>
        
				<!-- Only run this step for non local accounts, and also when AccountEnabled = False, and not a new User.
        This step runs after writing of  social account to make sure we already have extension_AccountEnabled
        in the claims pipeline-->
				<OrchestrationStep Order="7" Type="ClaimsExchange">
					<Preconditions>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="false">
							<Value>extension_accountEnabled</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
						<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
							<Value>extension_accountEnabled</Value>
							<Value>True</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
						<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
							<Value>authenticationSource</Value>
							<Value>localAccountAuthentication</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
						<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
							<Value>newUser</Value>
							<Action>SkipThisOrchestrationStep</Action>
						</Precondition>
					</Preconditions>
					<ClaimsExchanges>
						<!-- <ClaimsExchange Id="Self-AssertDisabledUserPage" TechnicalProfileReferenceId="AAD-DisabledUserPage"/> -->
						<ClaimsExchange Id="SelfAssertedRegError" TechnicalProfileReferenceId="SelfAsserted-RegError"/>
					</ClaimsExchanges>
				</OrchestrationStep>

				<OrchestrationStep Order="8" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer"/>
		
			</OrchestrationSteps>
			<ClientDefinition ReferenceId="DefaultWeb"/>
		</UserJourney>
	</UserJourneys>
  
	<RelyingParty>
		<DefaultUserJourney ReferenceId="SignUpOrSignInAAD-Disable"/>
		<TechnicalProfile Id="PolicyProfile">
			<DisplayName>PolicyProfile</DisplayName>
			<Protocol Name="OpenIdConnect"/>
			<OutputClaims>
				<OutputClaim ClaimTypeReferenceId="displayName"/>
				<OutputClaim ClaimTypeReferenceId="givenName"/>
				<OutputClaim ClaimTypeReferenceId="surname"/>
				<OutputClaim ClaimTypeReferenceId="email"/>
				<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
				<OutputClaim ClaimTypeReferenceId="identityProvider"/>
				<OutputClaim ClaimTypeReferenceId="extension_accountEnabled"/>
			</OutputClaims>
			<SubjectNamingInfo ClaimType="sub"/>
		</TechnicalProfile>
	</RelyingParty>
  
</TrustFrameworkPolicy>

https://medium.com/the-new-control-plane/fixing-one-of-the-azure-ad-b2c-samples-that-blocks-a-disabled-federated-user-d42648ccf552

I might be holding this wrong, but it doesn't want to trigger the error page for me 🤔

It took me a while to standardize the mess what I inherited, and make it stop throwing errors, but now it just ignores the extension attribute.

Is there a way to see inside each of the steps of the user journey?

Yes - you can use App Insights - https://learn.microsoft.com/en-us/azure/active-directory-b2c/troubleshoot-with-application-insights?pivots=b2c-custom-policy

Hi, Yes - you can use App Insights - https://learn.microsoft.com/en-us/azure/active-directory-b2c/troubleshoot-with-application-insights?pivots=b2c-custom-policy

…

On Wed, Feb 7, 2024 at 6:01 AM David Sass ***@***.***> wrote: @sassdawe commented on this gist. ________________________________ I might be holding this wrong, but it doesn't want to trigger the error page for me 🤔 It took me a while to standardize the mess what I inherited, and make it stop throwing errors, but now it just ignores the extension attribute. Is there a way to see inside each of the steps of the user journey? — Reply to this email directly, view it on GitHub or unsubscribe. You are receiving this email because you authored the thread. Triage notifications on the go with GitHub Mobile for iOS or Android.