CODEWITHSUNDEEP
identity-experience-frameworkazure-ad-b2b
Luven
Luven

Reputation: 11

Azure B2C Custom Policy - Updating a claim to show PhoneFactor has completed

We are using B2C Custom Policies. We have a validate function that is called on signup after the user has gone through the self asserted pages. This returns an extension claim Verified if the email matches an on-premise database of users. It also returns the users mobile number at this time.

If the email does not match, we are then doing a PhoneFactor code verification.

I would like to update the extension_Verified flag at this time but I cannot find a way to do this.

I can create a new claim but then I cannot set preconditions based on both these claims for sign-in (want to verify mobile if Verified is false).

I have tried using a claim transformation but these only seem to work on string claims (extension_Verified is boolean).

I have tried using the PartnerClaimType="extension_MobileVerified" but it does not seem to get updated.

<TechnicalProfiles>
    <TechnicalProfile Id="PhoneFactor-InputOrVerify">
      <DisplayName>PhoneFactor</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.PhoneFactorProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.phonefactor</Item>
        <Item Key="ManualPhoneNumberEntryAllowed">false</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
      </CryptographicKeys>
      <InputClaimsTransformations>
        <InputClaimsTransformation ReferenceId="CreateUserIdForMFA" />
      </InputClaimsTransformations>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="userIdForMFA" PartnerClaimType="UserId" />
        <InputClaim ClaimTypeReferenceId="extension_MemberMobile"/>
        <InputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber"/>
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="Verified.strongAuthenticationPhoneNumber" PartnerClaimType="Verified.OfficePhone"/>
        <!-- OfficePhone -->
        <OutputClaim ClaimTypeReferenceId="newPhoneNumberEntered" PartnerClaimType="newPhoneNumberEntered"/>
        <OutputClaim ClaimTypeReferenceId="extension_MobileVerified" DefaultValue="true" />
      </OutputClaims>

      <UseTechnicalProfileForSessionManagement ReferenceId="SM-MFA" />
    </TechnicalProfile>

This does show the mobile number without allowing it to be entered and returns a new claim.

How do I update an existing claim?

Upvotes: 0

Views: 328

Answers (1)

Jagadish KM
Jagadish KM

Reputation: 175

I had similar problem with custom attributes. I followed the steps to add custom attribute here. Here are some examples to achieve the same.

I had to make sure that the claim is passed correctly from previous step, so added AAD-UserReadUsingObjectId as the previous step. Below is my code 

</OrchestrationStep>
       <OrchestrationStep Order="3" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
          <Value>extension_forceChange</Value>
          <Value>true</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="NewCredentials1" TechnicalProfileReferenceId="LocalAccountWritePasswordChangeUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>

I also referred this to solve my issue.

Upvotes: 1

Related Questions