How to fix error "AADB2C90046" returned back by ACS endpoint of Azure AD B2C?

Question

How to fix error "AADB2C90046" returned back by ACS endpoint of Azure AD B2C?

Sarvesh Katariya 0

Users are encountering an error after successful authentication through SiteMinder (external IdP). Following authentication, SiteMinder sends a SAML Response to Azure AD B2C's ACS endpoint, but B2C returns the below error:

{"status":"400","errorCode":"AADB2C90046","message":"We are having trouble signing you in. You might want to try starting your session over from the beginning."}

Application Insights didn't reveal the specific reason for the "AADB2C90046" error.

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2024-05-06T04:46:46.4533333+00:00

@Sarvesh Katariya

Thanks for reaching out.

Did you take the fiddler trace of your request?

Most common scenario of this error is when the expected session state cannot be found for the existing journey.

Could you please confirm how much time it will take your journey to complete?

Thanks,

Shweta
Sarvesh Katariya 0 Reputation points

2024-05-06T21:50:08.0166667+00:00
Thank you, @Shweta Mathur for looking into this issue.

Yes, we did take the fiddler trace for the request.

From the network trace, I can see a valid SAML response was posted by the IdP to ACS endpoint of Azure AD B2C which responds back with "AADB2C90046". This issue is not intermittent, it happens all the time for all the users.

Application Insights is configured and custom policy is configured with DeploymentMode="Development", we couldn't get much information from the traces to determine the root cause of the issue.

"Message": "We are having trouble signing you in. You might want to try starting your session over from the beginning.",

CorrelationId for reference if it helps to get more insight: 67b75bec-2bce-4e12-9ef1-7092c54a89c9, 707a916e-bb9e-479b-b676-1c1e555d732b

Approx. 5 - 10 sec to complete the journey, though at times it can take longer due to MFA.

We have successfully tested the user journey with Test IdP (mock SAML, Google) and PingIdentity. The same User Journey is failing after integrating with SiteMinder.

"expected session state cannot be found for the existing journey."

Is the session state purged after sometime? If yes, what configuration/element of custom policy causes this behavior?

Does any of the request parameters, headers, cookies etc., causes this issue?

Any guidelines how to fix this issue?

Thanks!
Sarvesh Katariya 0 Reputation points

2024-05-09T11:40:00.2333333+00:00

@AmanpreetSingh-MSFT Can you please help here? Thanks!