ADB2C policies fails on ValidationTechnicalProfile

Question

I am facing an issue, in my ValidationTechnicalProfile,

<ValidationTechnicalProfile ReferenceId="REST-acquireaccesstoken"/>

if I remove this from ValidationTechnicalProfiles, login works, but with this ValidationTechnicalProfile it fails with:

"Key": "Exception", "Value": { "Kind": "Handled", "HResult": "80131500", "Message": "Invalid username or password.", "Data": { "IsPolicySpecificError": false } }

This same Technical profile works fine if I call it in OrchestrationStep. The appinsight logs are not help as well, all I see is above error. Here is the TechnicalProfile

<TechnicalProfile Id="REST-AcquireAccessToken">
          <DisplayName></DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">https://login.microsoftonline.com/xxxxxxxxxx/oauth2/v2.0/token</Item>
            <Item Key="AuthenticationType">Basic</Item>
            <Item Key="SendClaimsIn">Form</Item>
            <Item Key="AllowInsecureAuthInProduction">true</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ClientId" />
            <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_Secret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="client_credentials" AlwaysUseDefaultValue="true" />
            <InputClaim ClaimTypeReferenceId="scope" DefaultValue="api://xxxxxxxx/.default" AlwaysUseDefaultValue="true" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="access_token" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>

Please help

score 0 · Accepted Answer · answered Jun 13 '23 at 10:09

The grant_type and scope claims are used in both REST-AcquireAccessToken and login-NonInteractive technical profiles. I believe the values that you used in REST-AcquireAccessToken technical profile is overriding the default values in login-NonInteractive.

Use claims with different names along with proper PartnerClaimType in REST-AcquireAccessToken technical profile.

example:

<!-- ClaimsSchema -->

<ClaimType Id="IntApigrant_type">
    <DisplayName>Grant type</DisplayName>
    <DataType>string</DataType>
</ClaimType>

<ClaimType Id="IntApiscope">
    <DisplayName>scope</DisplayName>
    <DataType>string</DataType>
</ClaimType>

<!-- REST-AcquireAccessToken -->

<InputClaims>
    <InputClaim ClaimTypeReferenceId="IntApigrant_type" PartnerClaimType="grant_type" DefaultValue="client_credentials" AlwaysUseDefaultValue="true" />
    <InputClaim ClaimTypeReferenceId="IntApiscope" PartnerClaimType="scope" DefaultValue="{Settings:IntermediateApiScope}" AlwaysUseDefaultValue="true" />
</InputClaims>

Or you can put AlwaysUseDefaultValue="true" in login-NonInteractive for those two claims.

ADB2C policies fails on ValidationTechnicalProfile

1 Answers1