CODEWITHSUNDEEP
azure-active-directoryazure-ad-b2c
Mat
Mat

Reputation: 579

Azure AD B2C Internal Error uploading Custom Policy

I am experiencing an issue where a set of custom policies that upload without issue to one tenant (development tenant), fail to upload to another (production tenant). The policies function correctly on the (working) development tenant.

enter image description here

I upload the files in the following order:

  1. TrustFrameworkBase.xml uploads OK
  2. TrustFrameworkExtensions.xml uploads OK
  3. SignUpOrSignin.xml fails with above error
  4. ProfileEdit.xml fails with above error
  5. PasswordReset.xml uploads OK

The only clue I have is that if I query the extension claims in the B2C app for the failing tenant, it only shows 2 out of 8. If I run the same query against the working tenant, it shows all 8. I am doing this querying using this example app: https://github.com/AzureADQuickStarts/B2C-GraphAPI-DotNet.

As far as I can tell, the two tenants are configured the same, and I have checked the various IDs etc are configured correctly. But it is always possible I have missed something!

Can anyone help?

The xml files: https://1drv.ms/f/s!ApxUZQaL9hp0h1ACYgWzgzsGwCOc

More info

I can actually run the policies that upload with an error. But when I try to create an user account via running the policy I get a message saying "Unable to validate the information provided." at the top of the page, inside the <div> with the id claimVerificationServerError. This may tie-up with the missing extension claims in the B2C app. So it looks like the problem is with creating the extension claims. But the same policy uploads and works on another tenant. How could the extension claims be valid on one tenant, but not on another?

Upvotes: 1

Views: 1556

Answers (2)

Yin
Yin

Reputation: 46

In your base policy, there is the following claim of dateOfBirth:

<ClaimType Id="extension_DateOfBirth">
    <DisplayName>Date of Birth</DisplayName>
    <DataType>date</DataType>
    <UserHelpText>Date of birth</UserHelpText>
    <UserInputType>DateTimeDropdown</UserInputType>
    <PredicateValidationReference Id="DateOfBirthDateRange" />
</ClaimType>

Since this claim starts with "extension_" and it is used in a technical profile with "AAD-" as prefix, it will be automatically created as an extension attribute in AAD during the policy uploading. However, the DataType "date" is not supported (only DateTime is supported) in AAD. This is causing policy uploading failure.

Regarding how to map "date" claim in B2C policy to AAD "DateTime" attribute, I will reply back to this thread after more investigation on these policies is done.

Edit: I was trying to find this doc: https://msdn.microsoft.com/Library/Azure/Ad/Graph/api/entity-and-complex-type-reference#extensionproperty-entity when I first replied but could not find it. Thanks Mat for sharing. Hope this link is helpful for solving issues related to datatype of extension attributes in AAD.

Upvotes: 3

Vikram
Vikram

Reputation: 21

Extension attributes need to be created at a per tenant basis. So if your policy requires extension attributes, you need to create them explicitly.

Upvotes: 0

Related Questions