Reputation: 23
im stuck for days in an AzureAD custom policy for 2-Factor Authentication login. I design a log in user journey where after "e-mail address and password" in the next orchestration step the users (stored) phone number shall be displayed such that an SMS via a 3rd party provider I want to integrate is sent. After username and password are correctly evaluated I also get forwarded to my 2-factor-authentication page. But there I don't get my mobile phone number displayed. I know it is there, when I have AppInsights running I see it in the logs, but don't know how to grab it:
I use the technical profile "AAD-UserReadUsingObjectId" to get the mobile or strongAuthenticationPhoneNumber variable.
<TechnicalProfile Id="AAD-UserReadUsingObjectId">
<Metadata>
<Item Key="Operation">Read</Item>
<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
</Metadata>
<IncludeInSso>false</IncludeInSso>
<InputClaims>
<InputClaim ClaimTypeReferenceId="objectId" Required="true" />
</InputClaims>
<OutputClaims>
<!-- Optional claims -->
<OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
<OutputClaim ClaimTypeReferenceId="displayName" />
<OutputClaim ClaimTypeReferenceId="otherMails" />
<OutputClaim ClaimTypeReferenceId="givenName" />
<OutputClaim ClaimTypeReferenceId="surname" />
<!-- <OutputClaim ClaimTypeReferenceId="mobile" /> -->
<OutputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" />
</OutputClaims>
<IncludeTechnicalProfile ReferenceId="AAD-Common" />
</TechnicalProfile>`
and in the next orchestration step i want to display it by using a technical profile Custom-SMS`
<TechnicalProfile Id="Custom-SMS-Verify">
<DisplayName>Custom-SMS-Verify</DisplayName>
<Protocol Name="Proprietary"
Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine,
Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<Item Key="IpAddressClaimReferenceId">IpAddress</Item>
<Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
<Item Key="language.button_continue">Continue</Item>
<Item Key="UserMessageIfClaimsTransformationStringsAreNotEqual">Incorrect
verification code. Try again.</Item>
</Metadata>
<CryptographicKeys>
<Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
</CryptographicKeys>
<InputClaims>
<InputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber"
AlwaysUseDefaultValue="true" /> <!--AlwaysUseDefaultValue="true" -->
</InputClaims>
<DisplayClaims>
<DisplayClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" Required="true"
/>
<DisplayClaim DisplayControlReferenceId="phoneVerificationControl-readOnly" />
<DisplayClaim DisplayControlReferenceId="phoneVerificationControl" />
</DisplayClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="phoneNumberString" Required="true" />
<OutputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" Required="true"
/>
<OutputClaim ClaimTypeReferenceId="newPhoneNumberEntered" DefaultValue="true" />
</OutputClaims>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-MFA" />
</TechnicalProfile>
</TechnicalProfiles>
The username+pw login works, it also directs me to the next page for the two-factor-Authentication but I always just get and empty field type in a telephone number or get some default-value I set displayed but I can't get the variable "mobile" or "strongAuthenticationPhoneNumber" shown. Anyone who solved this, it sounds like a pretty standard. This is where I got the the custom-sms-verify technical profile from: https://github.com/azure-ad-b2c/samples/blob/master/policies/twilio-mfa-psd2/policy/StepUpPSD2/TrustFrameworkExtensionsPSD2StepUp.xml
And this is how currently the three Display Claims in "Custom-sms-verify" look like...no filled in mobile phone number anywhere, just textboxes.
(I use a custom div='api' but this of course just changes how it looks like compared to e.g. AzureBlue design)
Best regards, Lukas
Upvotes: 0
Views: 23