Looking to have Azure B2C custom policy use a custom error page (and pass a value)

Question

UPDATE: I am able to finally get my custom error page to render. I had to use <div id="api"></div> in my view.

My last concern here, which seems impossible, is adding the value of one of my claims (from the idToken passed to my B2C policy when I call it) into the LoadUri of my ContentDefintion.

Here are my TechnicalProfiles:

<TechnicalProfile Id="SelfAsserted-SigningNotReadyError">
  <InputClaimsTransformations>
    <InputClaimsTransformation ReferenceId="GetUser" />
  </InputClaimsTransformations>
  <IncludeTechnicalProfile ReferenceId="SelfAsserted-UserError" />
</TechnicalProfile>

<TechnicalProfile Id="SelfAsserted-UserError">
  <DisplayName>Unsolicited error message</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ContentDefinitionReferenceId">api.signingerrorlink</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="errorMessage" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="errorMessage" />
  </OutputClaims>
</TechnicalProfile>

and my ContentDefinition Note: see how I have to hardcode a GUID. :( signingerror?user=7ec00437-1ad9-4acc-a285-a729003ca99d

<ContentDefinition Id="api.signingerrorlink">
  <LoadUri>https://something.azurewebsites.net/signingerror?user=7ec00437-1ad9-4acc-a285-a729003ca99d</LoadUri>
  <RecoveryUri>https://something.azurewebsites.net/error</RecoveryUri>
  <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:1.2.0</DataUri>
  <Metadata>
    <Item Key="DisplayName">Signing Not Ready</Item>
  </Metadata>
</ContentDefinition>

ORIGINAL:

I'm in a pickle here. I have been looking through many posts in stackoverflow and over the internet in general. I hope you can help me.

I have a custom B2C policy, which basically accepts a token, performs some functions then returns an access token in the end. That works fine. My issue is that I need to define a step which will trigger a techical profile based on a precondition. The precondition actually works well to.

What I am missing is a way to construct a technicalprofile/contentdefinition to load my own error page (.Net Core 3 controller) in another project but totally accessible (Controllers/SigningErrorController).

My step:

        <OrchestrationStep Order="7" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>isReadyForSigning</Value>
              <Value>True</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAsserted-SigningNotReady" TechnicalProfileReferenceId="SelfAsserted-SigningNotReadyError" />
          </ClaimsExchanges>
        </OrchestrationStep>

Part 2! I need to pass a value to this custom error page. A guid in this case.

If I use the TP for invalidlink then this works. I have tried various custom contentdefinitions similar to:

      <ContentDefinition Id="api.signingerrorlink">
        <LoadUri>https://something.azurewebsites.net/error</LoadUri>
        <RecoveryUri>https://something.azurewebsites.net/signingerror</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:globalexception:1.1.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Error page</Item>
        </Metadata>
      </ContentDefinition>

...with the signingerror being the custom error page I want to go to. If I run this, the policy just skips over the step completely. If I use the invalid link TP, then it works. I've tried to figure out also how to pass a value to the error page. I'm at a loss folks.

Any help you can give would be much appreciated.

I have tried something like this, which I was hoping would pull in the claim value 'packageUserId' and pass it for 'user' it just ends up as '?user=packageUserId' and it affects every ContentDefinition. I also tried {packageUserId} and variations. ``` ... {OAUTH-KV:packageUserId} ``` — golinguist, Nov 26 '20 at 20:33

score 0 · Accepted Answer · answered Dec 02 '20 at 01:37

You can use a claim resolver in the LoadUri element. E.g.:

<ContentDefinition Id="api.signingerrorlink">
  <LoadUri>https://something.azurewebsites.net/signingerror?user={Claim:packageUserId}</LoadUri>
  <RecoveryUri>https://something.azurewebsites.net/error</RecoveryUri>
  <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:1.2.0</DataUri>
  <Metadata>
    <Item Key="DisplayName">Signing Not Ready</Item>
  </Metadata>
</ContentDefinition>

https://learn.microsoft.com/en-us/azure/active-directory-b2c/claim-resolver-overview#content-definition

Looking to have Azure B2C custom policy use a custom error page (and pass a value)

1 Answers1