Configuring MFA for Azure ADB2C with Authenticator App and invitation based sign in

Question

Hi,
We are developing a portal with ADB2C based authentication.
We are using the invitation based sign in process where admin can enter the details of new users (sign up) and an email is sent to user's email address with an invitation link. Clicking this link takes the user to create password screen and then logs him in.

Now we need to enable MFA (with auth app) for existing users and for new users created from our application.

I have followed the steps mentioned in https://github.com/azure-ad-b2c/samples/tree/master/policies/custom-mfa-totp and and https://medium.com/@snkaushi_9371/enable-totp-based-multi-factor-authentication-in-azure-ad-b2c-84e967d76aa4 articles.

I was able to test the custom policies directly by running them from "Identity Experience Framework" to sign up and sign in with Auth app.

Now the problem is that when I try to Sing in (login) using exiting users. It gives error "Invalid username or password". Moreover, when I try to login using an account created by running the custom policy directly, that account is successfully logged in.

I need help in following aspects

1- How can we customize our existing login policy (build in user flow) for sign in to identify old users and redirect them to Auth app signup screen.
2- How can we implement a custom policy for invitation based sign up that will take the user to Auth app registration screen after creating a password.

Thanks

Answer 1

Hi, i've used https://github.com/azure-ad-b2c/samples/tree/master/policies/custom-mfa-totp and it's working fine. just one question, after user scanned the QR code and register their phone, if they want to use another phone or reset their MFA, how can they get the QR code?

Answer 2

Hello @Syed Mustafa Shah Please find my comments inline:

1- How can we customize our existing login policy (build in user flow) for sign in to identify old users and redirect them to Auth app signup screen.

In order to identify whether the user is new or old, you can configure the user flow with "User is new" Application Claim, which is returned as "newUser": true claim in the token, if the user has just signed-up for your application. For subsequent sign-ins by that user, this claim will not be returned. As of now built-in user flows support Azure MFA with text message based 2nd factor only. Here is an active feedback link for adding Authenticator support with B2C user flows.

2- How can we implement a custom policy for invitation based sign up that will take the user to Auth app registration screen after creating a password.

Here is a sample for SignUp with email invitation, that you can configure to redirect the users to the policy configured with MFA totp.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 3

Hi @AmanpreetSingh-MSFT ,

I need a different solution for point 1 i.e.

*> 1- How can we customize our existing login policy (build in user flow) for sign in to identify old users and redirect them to Auth app signup screen.

In order to identify whether the user is new or old, you can configure the user flow with "User is new" Application Claim, which is returned as "newUser": true claim in the token, if the user has just signed-up for your application. For subsequent sign-ins by that user, this claim will not be returned. As of now built-in user flows support Azure MFA with text message based 2nd factor only. Here is an active feedback link for adding Authenticator support with B2C user flows.*

In my case, there are alot of users that are already present in AD B2C user store and are currently logging in to system. Now that we are trying to setup MFA, we want to identify any user that was created already without MFA setup (might have logged in several times already) during login and then take that user to register Authenticator APP screen so that this existing user can also user MFA from next session. Currently what happens is that, when we try to login with existing users. The login screen gives error "Invalid username or password" and doesnot proceed from there.
I am assuming that the custom claim "strongAuthenticationAppCode" is not present for such existing users and that might be causing this invalid username and password issue (not sure, so please share your thoughts on this too).

Therefore, what I would need is to identify and extract the special claim that will tell me if the currently logging in user is MFA enable already or not. Please help me in implementing this in custom policy.

Answer 4

@Syed Mustafa Shah · For this purpose, you would need to use custom policy as this can't be achieved by using built-in user flows. In case of custom policy, you can create a REST API technical profile which can query Azure AD for the attribute which is getting updated for the users who have registered for MFA in your case. Based on the value of the attribute, you can return an output claim. You can then add an orchestration step to invoke the REST Technical profile in signup/sign-in user journey so that the value of the attribute gets populated during signup/signin.

For Example:

In case of Azure MFA, we can configure the REST Technical Profile to make below call:

https://graph.microsoft.com/beta/me/authentication/methods/3179e48a-750b-4051-897c-87b9720928f7

If the response status is 200 OK, then set a custom claim for instance MFAUser claim as true and if the response is 404 Not Found, send MFAUser claim as false.