Issue with Custom Policy for Password Change - Invalid Username or Password Error

Question

I have implemented a custom policy for the "Change Password" flow in Azure AD B2C by following the official documentationhttps://learn.microsoft.com/en-us/azure/active-directory-b2c/add-password-change-policy?pivots=b2c-custom-policy. When I test the user flow directly through the Azure portal, it works as expected. It prompts me to provide my credentials (username and password), and then allows me to change the password successfully.

However, when I trigger the same custom policy from my application, where the user is already logged in:

1. It skips the credential prompt (step 1 and step 2 of the orchestration) as excepted.
2. It redirects directly to the page for changing the password (step 3).

The flow fails with the following error:

• Status: 400
• Error Code: AADB2C90052
• Message: "Invalid username or password."

Answer 1

Hello @Likitha Bommasani

Thank you for posting your query on Microsoft Q&A

From your description, I understand that you’re experiencing issues "Invalid username or password." This is a pretty common problem with a few documents/threads that can help you resolve it. From this SO thread:

"Claim names between user flow and custom policies are different, so here when it’s trying to verify the old password, the user's identifier ends up being null. Use custom policies OR user flows, do not combine." and may be replying party and client id are missing from custom policy.

If you are using both, this may be the case. This Github thread should help with details.

Another thread here describes a more complex problem that could be to blame.

Refer document: https://learn.microsoft.com/en-us/answers/questions/1108322/azure-b2c-issue-trying-to-signin-users-by-using-cu

https://learn.microsoft.com/en-us/answers/questions/641147/azuread-b2c-sign-in-custom-policy-returns-invalid

Kindly check over these documents and let me know if they are useful. If not, I can help you further.

If this answers your query, do click "Accept Answer" and "Yes" for was this answer helpful. And, if you have any further query do let us know.

Best regards,

Sakshi Devkante