Azure B2C - Custom Policy: Is it possible to grab error on user journey about failed login (locked)?

Carlos Dias 5

I have a requisite to invoke an API when an B2C accounts is locked.

There is a doc about generating error codes and message:

[https://learn.microsoft.com/en-us/azure/active-directory-b2c/oauth2-error-technical-profile

Is there a way to intercept this specific login error in a user journey?

Thanks,

James Hamil 21,696 Reputation points Microsoft Employee

2023-01-12T22:32:16.0566667+00:00

Hi @Carlos Dias , what's your use case? It'll let me provide an appropriate answer. Are you trying to send a message/email to the user, or alert someone on your team for example?
Carlos Dias 5 Reputation points

2023-02-27T10:32:12.7933333+00:00

duplicate message
Carlos Dias 5 Reputation points

2023-02-27T10:50:16.5033333+00:00
Hi James. I didn't get an alert about an answer here, sorry. Thank you for that.

The use case is the user failing 3x the password, I need to count (or already be counted in the policy) to send an email to the user with a password reset link. This is a requirement from the old legacy system and need to be in the new authentiction system.

I could log ship sign in data to Azure Monitor and use triggers to send the email but the thing is that is way too assyncronous. There is at least 5 minutes lag or more. At that point is too late.

Using Javascript inside the B2C custom HTML to process the failed signin error with "wrong password" is risky and security exposure has it would contain the code to process the message.

If I could catch the failed attempt, validate that the user exists on B2C directory and count the number of attempts (internally on the b2c policy or externally on the API) that would work for this solution.

This is also part of another requirement, that when the user has to authenticate to valitade a document (basically force an authentication with login=prompt) on another policy - but in same tenant - if the user fails 3x the password he gets logged of and the tokens revoked. So again the same principle, catch the failed password attempt and send a message to an API.

Thanks
Carlos Dias 5 Reputation points

2023-02-27T10:51:11.9066667+00:00

duplicate message
mamoorkhan 1 Reputation point

2023-04-24T10:36:27.5266667+00:00

Did you find an answer to your problem?