1

I am trying to set up a custom B2C policy according to sample available at: https://github.com/azure-ad-b2c/samples/blob/master/policies/force-password-reset-after-90-days/policy/TrustFrameworkExtensions.xml

The problem I face is that on every sign in pass change is prompted. I narrowed down the issue to InputClaim isPasswordResetOnPresent always returned as false from where output claim "skipPasswordReset" is also FALSE every time

and i believe this is my failing piece

<!--Sample: Check if extension_passwordResetOn is existed in user account. -->
<ClaimsTransformation Id="CheckIfPasswordResetOnPresent" TransformationMethod="DoesClaimExist">
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="extension_passwordResetOn" TransformationClaimType="inputClaim" />
    </InputClaims>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="isPasswordResetOnPresent" TransformationClaimType="outputClaim" />
    </OutputClaims>
</ClaimsTransformation>

This is evaluated in my Azure AD B2C trace as:

InputClaim  extension_passwordResetOn   undefined

I also followed all recommendations as per this similar question

Azure B2C: Where to Create DateTime Extension Attribute to be used in Custom Policy- Portal or Custom Policy or Both?

But that extension_passwordResetOn is always determined as undefined in claims transformation In the same time I can see this extension get current date/time correctly assigned in this technical profile

<TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
    <InputClaimsTransformations>
    <!--Sample: Get current date and time -->
        <InputClaimsTransformation ReferenceId="SetPasswordResetOn" />
    </InputClaimsTransformations>
    <PersistedClaims>
        <!--Sample: On sign-up, set the 'password reset on' extension attribute with the current date and time -->
    <PersistedClaim ClaimTypeReferenceId="extension_passwordResetOn" />
    </PersistedClaims>
</TechnicalProfile>
basquiatraphaeu
  • 525
  • 7
  • 19
veselinks
  • 11
  • 1
  • If not added, can you add the following line in "AAD-UserWriteUsingLogonEmail" technical profile: – mohit agrawal Dec 13 '21 at 11:56
  • Have you created the custom claim inside the b2c-extensions-app? Please referer to: https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-flow-custom-attributes?pivots=b2c-custom-policy#use-a-custom-attribute-in-your-user-flow – basquiatraphaeu Jan 19 '22 at 14:36

0 Answers0