CODEWITHSUNDEEP
azure-active-directoryazure-ad-b2c
Raj
Raj

Reputation: 907

Using ADB2C phone factor technical profile to validate a phone number before creating an account

I'm trying to create a custom ADB2C policy which should follow a journey such as...

  1. User enters a phone number to verify
  2. User receives a code to verify the number and enters this on the view
  3. A claim is set which is used in the next step to save to AD.

I can see I need to use the phone factor technical profile as per the Microsoft docs, but I couldn't see whether this could be done before a user has signed up as it seems to want a UserID as an input claim (see Input claims required). All the samples seem to point to MFA and editing phones already associated to a user.

Is it possible to do this?

Secondly, is there any value in mixing the one-time password technical profile in this flow or is that more for just OTP code generation (not sending and accepting the inputs from the user)?

Update

So Ive managed to create the user journey which shows the UI correctly so it seems I can enter a phone number but now when I submit it I get an error "AADB2C90154: A multi-factor verification request failed to get a session id from the service."

As far as I can tell, the session technical profile is fine so not sure what the problem could be?

I also tried disabling the session but its seems like the phone tech profile needs it?

Sample technical profile

<TechnicalProfile Id="PhoneFactor-InputOrVerify">
                <DisplayName>PhoneFactor</DisplayName>
                <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.PhoneFactorProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
                <Metadata>
                    <Item Key="ContentDefinitionReferenceId">api.phonefactor</Item>
                    <Item Key="ManualPhoneNumberEntryAllowed">true</Item>
                    <Item Key="setting.authenticationMode">sms</Item>
                    <Item Key="setting.autodial">true</Item>
                </Metadata>
                <CryptographicKeys>
                    <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
                </CryptographicKeys>
                <InputClaims>
                    <InputClaim ClaimTypeReferenceId="userIdForMFA" PartnerClaimType="UserId" DefaultValue="TEST" />
                    <InputClaim ClaimTypeReferenceId="phoneNumber" />
                </InputClaims>
                <OutputClaims>
                    <OutputClaim ClaimTypeReferenceId="verifiedPhone" PartnerClaimType="Verified.OfficePhone" />
                    <OutputClaim ClaimTypeReferenceId="newVerifiedPhone" PartnerClaimType="newPhoneNumberEntered" />
                </OutputClaims>
            </TechnicalProfile>

Upvotes: 0

Views: 948

Answers (1)

Christopher Norris
Christopher Norris

Reputation: 563

@Raj,

I don't see how you are setting the userIdForMFA other than the default value? However, the Azure documentation isn't very clear here. Try using an inputClaimsTransformation that sets the userId Value.

For example: Add this to the MFA technical profile:

      <InputClaimsTransformations>
        <InputClaimsTransformation ReferenceId="CreateUserIdForMFA2" />
      </InputClaimsTransformations>

Add this to your claims transformation: 

  <ClaimsTransformation Id="CreateUserIdForMFA2" TransformationMethod="CreateStringClaim">
    <InputParameters>
      <InputParameter Id="value" DataType="string" Value="test12345@{YourTenant}.onmicrosoft.com"/>
    </InputParameters>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="userIdForMFA" TransformationClaimType="createdClaim" />
    </OutputClaims>
  </ClaimsTransformation>

Upvotes: 1

Related Questions