I have configured a Sign in custom policy in Azure B2C. Customer wants lock out the account if they enter wrong password three times during sign in.
I have tried Password Protection in Azure Azure B2C authentication. Follows below document to configure the password protection.
https://learn.microsoft.com/en-us/azure/active-directory-b2c/threat-management
I have entered the password many times and it still showing "The username or password provided in the request are invalid"
Can anyone help me to troubleshoot this issue.
Thanks in advance!
Password Protection Configuration
Related
My scenario is a public website, with authenticated access that is managed by AzureAdB2C, and the authentication is not embedded but on a subdomain style. In the authentication form I see that there's the option for password reset (for someone who forgets it) but my question is when the user is already authenticated and so outside Azure context, how can he ask for a password change?
Is there any endpoint or so (that would receive the email linked to the account)?
Thank you
Still not clear because you mention "fire the change/reset password flow?". Which is it or is it both?
If reset, you can use a custom policy. Just put the link to the policy on your page.
There are a number of password reset flows that may be of interest.
For change password, see here. Again, just put the policy link on the page.
Unsure if you would have to login again.
You can Configure password change using custom policies in Azure Active Directory B2C.
In Azure Active Directory B2C (Azure AD B2C), you can enable users who are signed in with a local account to change their password without having to prove their identity through email verification. The password change flow involves following steps:
The user signs in to their local account. If the session is still active, Azure AD B2C authorizes the user and skips to the next step.
The user verifies the Old password, and then creates and confirms the New password.
If the question is to reset the password because the user forgot it but is still logged in, I can imagine logging out the user and redirecting them to the login page where they can choose the reset password option.
EDIT:
The Azure AD B2C article Set up self-service password reset for your customers states that
This article applies to self-service password reset used in the context of the standard Sign in user flow, which uses Local Account SignIn as the identity provider. If you need fully customizable password reset user flows invoked from your app, see this article.
Somehow resetting your password with a password reset flow / custom policy while you're logged in and don't 'need' your current password feels weird.
I have Angular 9 client calling Azure Functions. I started off with msal-angular package using "implicit grant flow" for authentication, and that worked fine.
My client app registration in Azure has its Authentication set to "Accounts in this organizational directory only (Default Directory only - Single tenant)". I can't change this setting as the app will only be available to company users.
I'm using my personal Microsoft account with Gmail username (e.g.: user#gmail.com). This account is a "Guest" in Azure AD, so far, so good.
I'm moving away from msal-angular and implementing PKCE authentication flow.
I'm using angular-auth-oidc-client package. My stsServer and authWellknownEndpoint are set to https://login.microsoftonline.com/[tenant-id]/v2.0 (turned out to be the problem, see update at the bottom)
Here are the login scenarios I'm having issues with:
When I use my user#gmail.com, I get "unauthotized_client ..." error right after I enter my username
When I use my UPN (e.g.: user#gmail.com#EXT##our_ad_owner.onmicrosoft.com) I get to the password prompt, but my Microsoft password doesn't work. I understand why it doesn't work (that password has nothing to do with AD), but I can't figure out how to set AD password for that account.
When I try to reset my password in AD, it tells me that "user#gmail.com is a Microsoft account that is managed by the user. Only user#gmail.com can reset their password for this account."
Any help with setting AD password for my UPN would be appreciated. I would also like to know if it's possible to login with my actual email address, and not UPN.
UPDATE: The problem was with angular-auth-oidc-client setup, authWellknownEndpoint was set to https://login.microsoftonline.com/common/v2.0, after I changed it to https://login.microsoftonline.com/[tenant-id]/v2.0 it worked!
You get the first error because you are using https://login.microsoftonline.com/common/v2.0 as the authority. It treats your account as personal account rather than the guest account in your tenant. But your Azure AD app is configured as Accounts in this organizational directory only (Default Directory only - Single tenant), which is not supported for consumers (personal account). See the reference here.
So you should use https://login.microsoftonline.com/{your tenant id}/v2.0 as the authority. Then it will allow your user#gmail.com to sign in.
The temporary password from the Azure portal when you manually reset a user password does not seem to work on the "Sign in v2" user flow, it does, however, work on the "Sign in" user flow.
I assume this is a bug since the v2 flow is still in preview.
Both user flows are under the same domain.
Is this a known issue? I was not able to find any information in the fast-developing Azure world.
The password reset through Azure Portal against a B2C Local Account is not supported for any flow, except the old Sign In flow. This is referred to as ForceChangePassword.
It seems that the "Forgot your password?" link on the Azure B2C Sign in page does not invoke the defined Password Reset Policy when using a SignUp/SignIn policy.
Is Microsoft working on resolving this issue? or has anyone found a way to get the password reset policy to run from the link?
I can run the Password Reset endpoint from within the Azure B2C portal, but can not get to this endpoint from my application. I get sent to https:///.auth/login/aad/callback with a "You do not have permission to view this directory or page." message.
It seems like the Azure B2C workflow is wrong for the Forgot password URL. Does anyone have an idea when this might get fixed? I am using a Sign Up/Sign In policy.
I created a password reset policy and I am using username for the identity provider for local account.
The password reset screen asking for username and email address.
What if I know someone's username but to use a different email to receive the verification code then I will be able to access someone else's account.
I saw it used to have a check box for password reset to use "Alternate Email Address" which is much secure to allow the user input a one. But I can't find to use "Alternate Email address" in password reset policy.
Does anyone know where to set it?
What if I know someone's username but to use a different email to
receive the verification code then I will be able to access someone
else's account.
Both the username and the email address must match the entries on the account. If a user uses a different email address, they will be shown an error message indicating that the account could not be found. Email verification is done before the account is looked up to minimize the chance of a malicious user trying out different email addresses for an account.
Alternate email address is not supported in Azure AD B2C because an alternate email address is not collected when the user signs up.
The admin UI that you have pasted in your question is for the enterprise directory and does not apply to Azure AD B2C. Azure AD B2C policies can only be configured using the Azure AD B2C settings blades in the Azure Portal.