Password rules based on history or other user attributes - azure-ad-b2c

Question

Are there any facilities in AAD B2C to allow me to prevent users from using pwds which have their name in it or that have been used before by the same user? Could I do the former through an IEF policy and a REST function? (I suspect not assuming that at no stage will my code have access to the pwd value but perhaps I am wrong and a pwd claim is just another claim)

Answer 1

It's possible for a custom policy to validate a new password if you're wanting to implement a REST API for this.
For example, for a password reset, you can add one validation technical profile that calls the REST API to check if the new password is valid for the current user against the password history and another validation technical profile that calls the REST API to then save the new password for the current user in the password history:
<TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
<DisplayName>Change password (username)</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
...
<InputClaims>
<InputClaim ClaimTypeReferenceId="objectId" />
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
<OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
</OutputClaims>
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="API-CheckNewPassword" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" />
<ValidationTechnicalProfile ReferenceId="API-SaveNewPassword" />
</ValidationTechnicalProfiles>
</TechnicalProfile>
It's best that you hash the new password before it's passed to the REST API (although this will limit whether the REST API can determine if the new password contains the user name) for security.
You can hash the new password using the Hash claims transformation:
<ClaimsTransformation Id="HashNewPassword" TransformationMethod="Hash">
<InputClaims>
<InputClaim ClaimTypeReferenceId="newPassword" TransformationClaimType="plaintext" />
<InputClaim ClaimTypeReferenceId="objectId" TransformationClaimType="salt" />
</InputClaims>
<InputParameters>
<InputParameter Id="randomizerSecret" DataType="string" Value="B2C_1A_MyRandomizerSecret" />
</InputParameters>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="newPasswordHash" TransformationClaimType="hash" />
</OutputClaims>
</ClaimsTransformation>
<ClaimsProvider>
<DisplayName>APIs</DisplayName>
<TechnicalProfiles>
<TechnicalProfile Id="API-CheckNewPassword">
<DisplayName>Check New Password API</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
...
<InputClaimTransformations>
<InputClaimTransformation ReferenceId="HashNewPassword" />
</InputClaimTransformations>
<InputClaims>
<InputClaim ClaimTypeReferenceId="objectId" />
<InputClaim ClaimTypeReferenceId="newPasswordHash" />
</InputClaims>
</TechnicalProfile>
</TechnicalProfiles>
</ClaimsProvider>