Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,645 questions
Azure B2C Custom flow using .xml configs is not working
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 84%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Alex
0
Reputation points
Hello Microsoft team our situation today:
We use "User flow" for our SPA, we have 2 instances of B2C test and production on two different tenants in our azure portal
Situation today is that user reset password is not working on production instance of B2C, but works perfectly on test
We don't know exact moment this issue appeared, but when user goes into reset flow after submitting verification code he is redirected back to previous state see image bellow basically user is in infinite loop of sending verification code and never lands on "old new pass reset form
After multiple checks between two tenants we compared every setting in two B2C apps including flows template version, we tried custom template default templates but nothing seems to work on production instance user still stuck in reset flow (on test all works fine different tenant and B2C)
So we decide to try the "Custom policy" we followed the official docs to make a reset flow seamless without handling error AADB2C90118 by following this documentation that recommend using Self-service password reset (recommended) but we encountered another issue users can't login with the new flow so now we are stuck in limbo, on one had we have old setup that works fine except reset on the other hand we have new flow that does not even login
Let me know if you need any additional info
When it comes to xml config we used default Local starter pack + some modifications to support self service reset, and yes identity and proxy ids are set properly and proxy uses offline access form identity exposed api
We also tried to create new identity and proxy from scratch following the official guide with all permissions etc. but it resulted in the same login issue shown on screenshot above
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
-
Navya 13,965 Reputation points Microsoft Vendor
2024-12-20T22:13:27.0333333+00:00 Hi @Alex
Thank you for your patience while I looked into this.
Based on the information you've provided; I understand that you are facing an issue with password reset.
This self-service password reset flow applies to local accounts in Azure Active Directory B2C (Azure AD B2C) that use an email address or a username with a password for sign-in.
To fix this issue, can you please check the following:
1.Can you please verify whether users need to have an authentication method specified for self-service password reset? Select the B2C User, in the left menu under Manage, select Authentication methods, and ensure Authentication contact info is set. B2C users created via a SignUp flow will have this set by default. For users created via Azure Portal or by Graph API, they need to have this set for SSPR to work.
2.As you are using an SPA application, can you please check whether your app uses MSAL.js 2.0 or later? Don't enable implicit grant flow as MSAL.js 2.0+ supports the OAuth 2.0 Authorization code flow (with PKCE). If you enable implicit grant to test a user flow, make sure you disable the implicit grant flow settings before you deploy your app to production.It seems that you tried to implement Self-service password reset (recommended) using custom policy, but it throws an error "Invalid username or password". This error occurs when the self-service password reset experience isn't enabled in a user flow. Thus, selecting the Forgot your password? link doesn't trigger a password reset user flow. Instead, the error code AADB2C90118 is returned to your application.
To know the exact behavior of the custom policy, can you collect Azure Active Directory B2C logs with Application Insights https://learn.microsoft.com/en-us/azure/active-directory-b2c/troubleshoot-with-application-insights?pivots=b2c-custom-policy
Hope this helps. Do let us know if you any further queries.
Thanks,
Navya.
-
-
Sign in to comment
Sign in to answer