Share via

Azure B2C SPA app with custom policy gives Sign-In error "Invalid username or password"

Odi Kosmatos 25 Reputation points
2023-02-02T22:47:05.2433333+00:00

Our SPA app and Web API were working well with the standard SignUpSignIn user flow. When we switched to using a custom policy while keeping the same App Registrations, Sign In always displays “Invalid username or password” [1]. (Sign Up and Sign Out work).

To remedy the issue, we created new App Registrations as per https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows?pivots=b2c-custom-policy

  • As stated, we used “Allow public client flows.”
  • Now the signin/signup page displays “The provided application with ID xxx is not valid against this service.” (error AADB2C90068). This happens whenever we use account type “Accounts in this organizational directory only”
  • If we use “Accounts in any identity provider”, we go back to getting “Invalid username or password”
  • Switching the front-end to “SPA” instead of “Public client/native (mobile & desktop)” doesn’t help.

Strangely, there is a configuration that works: Following the tutorial exactly (Allow public client flows + Accounts in this org directory only + Public client/native platform) but leaving the front-end SPA app pointing to the old app registrations. Obviously we can’t leave it like that.

How do we properly solve the “Invalid username or password” issue with an SPA app using a custom policy?

[1] The corresponding sign-in log says error 7000218.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
3,096 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,796 questions
0 comments
Accepted answer
  1. Shweta Mathur 30,261 Reputation points Microsoft Employee
    2023-02-06T09:22:00.44+00:00

    Hi @Odi Kosmatos ,

    Thanks for reaching out and apologies for delay in response.

    The reason for error 'Invalid username or password' will :

    1. If the permissions to ProxyIdentityExperienceFramework is not setup correctly

    User's image

    2.Also, if ProxyIdentityExperienceFrameworkAppId and IdentityExperienceFrameworkAppId are not added to the login-NonInteractive technical profile correctly and their value got interchange by mistake.

    User's image

    Even after trying above, you are facing the issue. You can use setup tool https://aka.ms/iefsetup. to automate the process. You need to delete the proxyief and ief application first you created manually.

    Also, for B2C applications, you need to select 'Accounts in any identity provider or organizational directory (for authenticating users with user flows) only.

    Hope this will help.

    Thanks,

    Shweta

    Please remember to "Accept Answer" if answer helped you.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Odi Kosmatos 25 Reputation points
    2023-02-15T03:20:43.7866667+00:00

    It turns out I did need to have more App Registrations. Two for the IEF and Proxy IEF, and two for our SPA application and it's Web Api back-end. All the issues disappeared with that setup. This configuration was confirmed to be valid by Shweta (offline).

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.