Using a validation technical profile to stop a function being run - azure-ad-b2c

Question

I want to allow the user to select their password but only if an extension attribute is not set.
The user journey calls "LocalAccountWritePasswordUsingObjectId".
This looks like:
<TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
<DisplayName>Change password (username)</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
<Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">This user has already been added.</Item>
</Metadata>
<CryptographicKeys>
<Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
</CryptographicKeys>
<InputClaims>
<InputClaim ClaimTypeReferenceId="objectId" />
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
<OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
</OutputClaims>
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" ContinueOnError="false" />
</ValidationTechnicalProfiles>
</TechnicalProfile>
This defines an error message ("This user has already been added") and has a validation TP of "AAD-UserWritePasswordUsingObjectId".
This looks like:
<TechnicalProfile Id="AAD-UserWritePasswordUsingObjectId">
<Metadata>
<Item Key="Operation">Write</Item>
<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
</Metadata>
<IncludeInSso>false</IncludeInSso>
<InputClaims>
<InputClaim ClaimTypeReferenceId="objectId" Required="true" />
</InputClaims>
<PersistedClaims>
<PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration, DisableStrongPassword" />
<PersistedClaim ClaimTypeReferenceId="objectId" />
<PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password"/>
</PersistedClaims>
<OutputClaimsTransformations>
<OutputClaimsTransformation ReferenceId="EnsureFlagIsTrue" />
</OutputClaimsTransformations>
<IncludeTechnicalProfile ReferenceId="AAD-Common" />
</TechnicalProfile>
This has an OutputClaimsTransformation that checks if an extension attribute is true.
The problem is that when the flag is true, the error message is displayed on the password reset screen but the password is still updated.
How can I display the message and stop the password update?
Update
Following the answer, I now have:
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="ClaimsTransformations-EnsureFlagIsTrue" ContinueOnError="false"/>
<ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" ContinueOnError="false" />
</ValidationTechnicalProfiles>
Added the ClaimsTransformation TP.
The error message is still displayed but the password is still bring changed?
The check uses TransformationMethod="AssertBooleanClaimIsEqualToValue" and as above, the error message uses "UserMessageIfClaimsTransformationBooleanValueIsNotEqual".
I assume this qualifies as an error that prevents "AAD-UserWritePasswordUsingObjectId" from being run?

Answer 1

The LocalAccountWritePasswordUsingObjectId technical profile can invoke the EnsureFlagIsTrue claims transformation as a validation technical profile before it does invoke the AAD-UserWritePasswordUsingObjectId technical profile:
<TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="ClaimsTransformations-EnsureFlagIsTrue" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" ContinueOnError="false" />
</ValidationTechnicalProfiles>
</TechnicalProfile>
You must create a claims transformation technical profile so that the self-asserted technical profile can invoke the claims transformation as a validation technical profile.