How to add a federated user that can be authenticated to Azure AD B2C using Graph API

Question

Hi There,

I am currently trying to add an existing user that can be federated from AAD to AAD B2C using Graph API within a ASP.Net Application, so far I am able to add the user however when trying to authenticate the user I am getting the below error message.

"OpenIdConnectMessage.Error was not null, indicating an error. Error: 'server_error'. Error_Description (may be empty): 'AADB2C99002: User does not exist. Please sign up before you can sign in.

I am using User Flows, specifically the b2c_1_signin and I have configured the OpenID Connect for Identity Providers to link to the Azure Active Directory tenant.

Code snippet below

I was just wondering if there is something missing? or something extra I need to configure?

Please Let me know

Cheers

Kyle

Answer 1

@Anonymous

From above description I could understand that you are creating a user account in Azure B2C with Graph API however the signin fails with error User does not exist. Please sign up before you can sign in.

Please do correct me if this is not the case by responding in the comments section.

When you create a create a user with social and local account identities this creates a new B2C local user which can sign in with email address. In order to get the user sign in with federated account, you need to use A B2C IEF Custom Policy which links a Federated login against a pre-created Local Account

This scenario is helpful when requiring to pre-create accounts for users who will use a federated logon option. This sample allows a user to be created up front, adding any extension attributes to the user, ready for their first logon. This could include any Id's required to login to the Application that already exist from a system that you maybe migrating from. It may also include doing any group assignments up front.

The user would only need to be sent a link to the B2C logon page, where they will be sent to their federated provider by use of the domain_hint parameter to automatically choose the IdP. Once the user authenticates at their federated IdP, B2C will use the claims to lookup the user in the B2C directory. If the user is found, the AlternativeSecuirtyId is written to the account and allows the user to logon with the pre-created account.

Thank,

Akshay Kaushik