Azure AD B2C Custom Policy Notes

azureadb2ccustompolicynotes.md

Disclaimer: The content of this Gist is **not** official documentation. It is based purely on my own observations / findings. Use at your own risk! But please correct me if you spot any errors :-)

## Turning off email verification

Add the following `Item` to the `Metadata` element of the `TechnicalProfile` in which an email address is requested:

`<Item Key="EnforceEmailVerification">False</Item>`

e.g. the `TechnicalProfile` containing the following `OutputClaim`:

`<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />`

## DateTime, Date etc.

### DateTime vs Date

You cannot write extension attributes with `dataType` of `date` to AAD. `date` is not supported by AAD.

You cannot use `DateTimePicker` with `dataType` of `DateTime`. You will get a 500 error within the user flow.

But... You can create an extension attribute of `dataType` of `DateTime`, upload the policy to create the extension attribute on the B2C application, then change the `DateTime` attribute to a `date` attribute. This will then successfully write to AAD, and can be edited by `DateTimePicker`.

See: https://stackoverflow.com/questions/52206738/azure-ad-b2c-internal-error-uploading-custom-policy

### Reading DateTime from AAD

You seem to get errors when reading `DateTime` attributes from AAD inside a `ValidationTechnicalProfiles`. Instead, read the attribute in a user journey step technical profile.

## Writing to AAD

### objectId

If the user (`ClaimsPrinciple`) already exists, the `objectId` claim needs to be an input claim, and a persisted claim. I.e.:

`<InputClaim ClaimTypeReferenceId="objectId" Required="true" />`

`<PersistedClaim ClaimTypeReferenceId="objectId" />`

### REST exchanges

If trying to save claims returned from a REST function call to AAD, perform the write in the next step as opposed to in a `ValidationTechnicalProfiles` within the REST `TechnicalProfile`.

## Can you pass password claim between steps?

No

See:

https://stackoverflow.com/questions/51892902/can-you-pass-password-claims-between-steps-in-azure-ad-b2c-custom-policies/51892936

https://stackoverflow.com/questions/49206782/azure-ad-b2c-multi-steps-custom-policy

## Returning tfp claim

How to do it:

https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-manage-sso-and-token-configuration

https://stackoverflow.com/questions/46683705/how-can-i-return-the-policyid-claim-after-executing-my-custom-signupsignin-polic

acr vs tfp:

https://stackoverflow.com/questions/46688455/in-azure-ad-b2c-should-the-acr-or-tfp-claim-have-the-policy-name

## Returning emails claim

How to do it:

https://stackoverflow.com/questions/47145452/return-emails-on-custom-policies

# UI

## Language fields

|Key|Default Value|
|----|----|
|month|Month|
|ver_but_default|Default|
|ver_fail_server|We are having trouble verifying your email address. Please enter a valid email address and try again.|
|ver_intro_msg|Verification is necessary. Please click Send button.|
|ver_fail_throttled|There have been too many requests to verify this email address. Please wait a while, then try again.|
|months|January, February, March, April, May, June, July, August, September, October, November, December|
|ver_input|Verification code|
|ver_fail_retry|That code is incorrect. Please try again.|
|error_requiredFieldMissing|A required field is missing. Please fill out all required fields and try again.|
|error_passwordEntryMismatch|The password entry fields do not match. Please enter the same password in both fields and try again.|
|helplink_text|What is this?|
|alert_yes|Yes|
|ver_sent|Verification code has been sent to:|
|verifying_blurb|Please wait while we process your information.|
|ver_but_edit|Change e-mail|
|ver_but_send|Send verification code|
|ver_success_msg|E-mail address verified. You can now continue.|
|cancel_message|The user has cancelled entering self-asserted information|
|ver_incorrect_format|Incorect format.|
|error_fieldIncorrect|One or more fields are filled out incorrectly. Please check your entries and try again.|
|alert_message|Are you sure that you want to cancel entering your details?|
|button_continue|Create|
|alert_title|Cancel Entering Your Details|
|ver_fail_no_retry|You&#39;ve made too many incorrect attempts. Please try again later.|
|alert_no|No|
|preloader_alt|Please wait|
|ver_fail_code_expired|That code is expired. Please request a new code.|
|button_cancel|Cancel|
|ver_info_msg|Verification code has been sent to your inbox. Please copy it to the input box below.|
|ver_but_verify|Verify code|
|required_field|This information is required.|
|ver_but_resend|Send new code|
|initial_intro|Please provide the following details. You will not be able to continue until you have verified your email address.|
|year|Year|
|day|Day|


# Links

## Repos

### Custom Policy Starter Pack

https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack

### Advanced Policies

https://github.com/Azure-Samples/active-directory-b2c-advanced-policies

## YouTube

### Microsoft Identity Conference, 2017

https://www.youtube.com/channel/UCP2Px7fpUsYBbzROwK7w3tw