This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 69%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
As per the current requirement in forgot password custom policy before sending the Email verification code need to run a Rest API validation technical profile, which should allow to continue further on success / error status and should add some precondition based on response status code of this rest validation technical profile in action. Can some please help me on this?
Marilee Turscak-MSFT, @James Hamil , @AmanpreetSingh-MSFT Please have a look on this issue. Waiting for response from support.
Hi @Sajna M Nair , did you need any more help with this? If not could you please mark the answer as "Verified" so other users can reference it?
Thank you,
James
Hi @Sajna M Nair , you can define a RESTful technical profile in your custom policy. To validate claims by using a validation technical profile in a custom policy, you can define a validation technical profile. You can set the ContinueOnError attribute to true to allow the policy to continue even if the REST API returns an error status code. You can add a precondition to check the response status code of the REST API by using the Precondition element with the Type attribute set to ClaimsExist and the Value element set to the name of the claim that contains the response status code. If the response status code is 200, 400, or 409, you can add an Action element with the value SkipThisValidationTechnicalProfile to skip the validation technical profile.
Please let me know if you have any questions and I can help you further.
If this answer helped you please mark it as "Verified" so other users can reference it.
Thank you,
James
Hi @James Hamil , I tried the same solution but its not working. Please find my code below. Kindly advice if I am missing something here or doing wrongly. Response of the Rest API:-
{
"version": "1.0.0",
"userMessage": "User don't have access to the system, please contact administrator.",
"status": 409
}
DisplayControl:-
<DisplayControls>
<DisplayControl Id="emailVerificationControl" UserInterfaceControlType="VerificationControl">
<InputClaims>
<InputClaim ClaimTypeReferenceId="emailAddress" />
</InputClaims>
<DisplayClaims>
<DisplayClaim ClaimTypeReferenceId="emailAddress" ControlClaimType="Email" Required="true" />
<DisplayClaim ClaimTypeReferenceId="verificationCode" ControlClaimType="VerificationCode" Required="true" />
</DisplayClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="azureMfaSessionId" />
</OutputClaims>
<Actions>
<Action Id="SendCode">
<ValidationClaimsExchange>
<ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AAD-UserReadUsingEmailAddress-emailAddress" ContinueOnError="true" />
<ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="REST-ReadUserFromDB" ContinueOnError="true" /> <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="REST-ReadUserFromDB" ContinueOnError="true" />
<ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AadSspr-SendCode">
<Preconditions>
<Precondition Type="ClaimsExist" ExecuteActionsIf="false">
<Value>objectId</Value>
<Action>SkipThisValidationTechnicalProfile</Action>
</Precondition>
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
<Value>status</Value>
<Action>SkipThisValidationTechnicalProfile</Action>
</Precondition>
</Preconditions>
</ValidationClaimsExchangeTechnicalProfile>
</ValidationClaimsExchange>
</Action>
<Action Id="VerifyCode">
<ValidationClaimsExchange>
<ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AadSspr-VerifyCode" />
</ValidationClaimsExchange>
</Action>
</Actions>
</DisplayControl>
Claim Type Definition:-
<ClaimType Id="status">
<DisplayName>User access API status</DisplayName>
<DataType>int</DataType>
</ClaimType>
Technical profile:-
<TechnicalProfile Id="REST-ReadUserFromDB">
<DisplayName>Validate User From DB</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<Item Key="ServiceUrl"></Item>
<Item Key="SendClaimsIn">Header</Item>
<Item Key="AuthenticationType">None</Item>
<Item Key="AllowInsecureAuthInProduction">false</Item>
</Metadata>
<IncludeInSso>false</IncludeInSso>
<InputClaims>
<InputClaim ClaimTypeReferenceId="emailAddress" PartnerClaimType="email" />
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="status"/>
<OutputClaim ClaimTypeReferenceId="userMessage"/>
</OutputClaims>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>
Hi James Hamil, It will be really helpful and great if you can have a look at the above comment.
Hi @Sajna M Nair , sorry for the delay in response. Why is
<Item Key="ServiceUrl"></Item>
empty? It should be
<Item Key="ServiceUrl">https://your-api-endpoint-url.com/validate-user</Item>
Once you fix this, the rest of the code looks good. If it's still broken send me an email at "azcommunity@microsoft.com" with subject "ATTN: James Hamil" and your subscription ID. I can look into your environment. Best, James
@James Hamil , I have given my endpoint in the service URL, but still it doesn't work. I didn't wanted by end point to be in post so I removed it. Please let me see if you see any correction needed