CODEWITHSUNDEEP
azure-ad-b2c
rbrayb
rbrayb

Reputation: 46753

Azure AD B2C - Raising an error on AAD-UserReadUsingEmailAddress using a compare

My use case is that I want to raise an error on the TP AAD-UserReadUsingEmailAddress.

I tried using "UserMessageIfClaimsTransformationBooleanValueIsNotEqual". That didn't work

Reading the documentation this must be derived from a self asserted TP which AAD-UserReadUsingEmailAddress isn't.

The other way would be to use something like "RaiseErrorIfClaimsPrincipalDoesNotExist" or "RaiseErrorIfClaimsPrincipalAlreadyExists" that throws an error if the claim is there or isn't.

But I want to throw an error like "RaiseErrorIfBooleanValueIsNotEqual" if the claim is not equal to a value. The claim will always exist.

Is there a way to do this?

Update

The first element of my user journey is:

<OrchestrationStep Order="1" Type="ClaimsExchange">                 
 <ClaimsExchanges>
    <ClaimsExchange Id="ReadEmailAddress"  TechnicalProfileReferenceId="AAD-UserReadUsingEmailAddress" />
 </ClaimsExchanges>
</OrchestrationStep>

Upvotes: 4

Views: 2429

Answers (1)

Chris Padgett
Chris Padgett

Reputation: 14704

This can be implemented using the AssertBooleanClaimIsEqualToValue claims transformation.

  1. Declare the claims transformation:
<ClaimsTransformation Id="AssertTheClaimIsEqualToTheValue" TransformationMethod="AssertBooleanClaimIsEqualToValue">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="your-claim-id" TransformationClaimType="inputClaim" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="valueToCompareTo" DataType="boolean" Value="[true|false]" />
  </InputParameters>
</ClaimsTransformation>
  1. Invoke this claims transformation from the AAD-UserReadUsingEmailAddress technical profile:
<TechnicalProfile Id="AAD-UserReadUsingEmailAddress">
  <OutputClaimsTransformations>
    <OutputClaimsTransformation ReferenceId="AssertTheClaimIsEqualToTheValue" />
  </OutputClaimsTransformations>
</TechnicalProfile>

If the claim value isn't equal to the expected value, then an exception is thrown.

The self-asserted technical profile that invokes the AAD-UserReadUsingEmailAddress technical profile can display an error message for this exception using UserMessageIfClaimsTransformationBooleanValueIsNotEqual.

Upvotes: 5

Related Questions