Azure AD B2C Single Sign Out and Change Password Issue (Azure AD (Multi-Tenant) Identity Provider and TOTP MFA enabled)

Atkinson, Oliver 0

I have two Azure AD B2C instances, both which support local accounts and Azure AD Authenticated accounts through custom policies. One of these instances has MFA enabled, the other does not.

Both instances are being used to authenticate with .NET core applications, hosted on Azure Web Apps.

On the instance without MFA enabled, Single Sign On between applications and for the Change Password Policy works as intended for local users only. Users which login using the AAD Social Identity Provider are redirected to the Microsoft account selection page automatically, and prompted to re-select their Microsoft account when switching applications.

On the instance with MFA enabled, the same as above is true, although Change Password is requiring re-authentication, and AD Auth users have to re-verify their MFA.

All policies have been created as per the online Microsoft documentation and based off of the example policies provided by Microsoft on GitHub.

Each Application has its own Application Registration, with the Front-channel logout URL set to: https://<instance>/<domain>/B2C_1A_SIGNUP_SIGNIN_TOTP/oauth2/v2.0/logout

NOTE: Currently on sign-out, it does invalidate the current applications session and current B2C session (preventing any SSO from applications which are still signed in), just not any other application which was signed into.

I'm assuming non of this is intended behaviour so any assistance would be appreciated.

The main outcome I would like out of asking this question is to get the Single Sign Out to work, and change password to not require re-authentication. As for the Microsoft account selection - this is not as big of an issue and I can always bypass the verification check for subsequent logins using this policy https://github.com/azure-ad-b2c/samples/tree/master/policies/mfa-absolute-timeout-and-ip-change-trigger

Details of some of the policies have been provided below:

SignUpOrSignInTOTP Relaying Party

  <RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignInTOTP" />	
	<UserJourneyBehaviors>
		<SingleSignOn Scope="Tenant" KeepAliveInDays="30"/>
		<SessionExpiryType>Rolling</SessionExpiryType>
		<SessionExpiryInSeconds>1200</SessionExpiryInSeconds>
	</UserJourneyBehaviors>
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="givenName" />
        <OutputClaim ClaimTypeReferenceId="surname" />
        <OutputClaim ClaimTypeReferenceId="email" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
        <OutputClaim ClaimTypeReferenceId="identityProvider" />
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
        <OutputClaim ClaimTypeReferenceId="extension_OrganisationName" />
        <OutputClaim ClaimTypeReferenceId="groups" />
        <OutputClaim ClaimTypeReferenceId="loginHint" />
		<OutputClaim ClaimTypeReferenceId="isForgotPassword" DefaultValue="false" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>

Change Password RelayingParty:


  <RelyingParty>
    <DefaultUserJourney ReferenceId="PasswordChangeTOTP" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>

TrustFrameworkExtensions_TOTP User Journeys

  <UserJourneys>
    <UserJourney Id="PasswordResetWithTOTP">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey will not ask the user to enroll -->
        <OrchestrationStep Order="2" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Input" />
          </JourneyList>
        </OrchestrationStep>

        <!-- Call the TOTP validation sub journey-->
        <OrchestrationStep Order="3" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Verify" />
          </JourneyList>
        </OrchestrationStep>

        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>

    <UserJourney Id="SignUpOrSignInTOTP">
		  <OrchestrationSteps>

			<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
			  <ClaimsProviderSelections>
				<ClaimsProviderSelection TargetClaimsExchangeId="AzureADCommonExchange" />
				<ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
				<ClaimsProviderSelection TargetClaimsExchangeId="ForgotPasswordExchange" />
			  </ClaimsProviderSelections>
			  <ClaimsExchanges>
				<ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
			  </ClaimsExchanges>
			</OrchestrationStep>

			<!-- Check if the user has selected to sign in using one of the social providers -->
			<OrchestrationStep Order="2" Type="ClaimsExchange">
			  <Preconditions>
				<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
				  <Value>objectId</Value>
				  <Action>SkipThisOrchestrationStep</Action>
				</Precondition>
			  </Preconditions>
			  <ClaimsExchanges>
				<ClaimsExchange Id="AzureADCommonExchange" TechnicalProfileReferenceId="AADCommon-OpenIdConnect" />
				<ClaimsExchange Id="ForgotPasswordExchange" TechnicalProfileReferenceId="ForgotPassword" />
			  </ClaimsExchanges>
			</OrchestrationStep>
			
			<OrchestrationStep Order="3" Type="InvokeSubJourney">
			  <Preconditions>
				<Precondition Type="ClaimsExist" ExecuteActionsIf="false">
				  <Value>isForgotPassword</Value>
				  <Action>SkipThisOrchestrationStep</Action>
				</Precondition>
			  </Preconditions>
			  <JourneyList>
				<Candidate SubJourneyReferenceId="PasswordReset" />
			  </JourneyList>
			</OrchestrationStep>

			<!-- For social IDP authentication, attempt to find the user account in the directory. -->
			<OrchestrationStep Order="4" Type="ClaimsExchange">
			  <Preconditions>
				<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
				  <Value>authenticationSource</Value>
				  <Value>localAccountAuthentication</Value>
				  <Action>SkipThisOrchestrationStep</Action>
				</Precondition>
			  </Preconditions>
			  <ClaimsExchanges>
				<ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId" />
			  </ClaimsExchanges>
			</OrchestrationStep>

			<!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent 
			  in the token. -->
			<OrchestrationStep Order="5" Type="ClaimsExchange">
			  <Preconditions>
				<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
				  <Value>authenticationSource</Value>
				  <Value>socialIdpAuthentication</Value>
				  <Action>SkipThisOrchestrationStep</Action>
				</Precondition>
			  </Preconditions>
			  <ClaimsExchanges>
				<ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
			  </ClaimsExchanges>
			</OrchestrationStep>
			
			<OrchestrationStep Order="6" Type="ClaimsExchange">
				<ClaimsExchanges>
					<ClaimsExchange Id="REST-AcquireAccessTokenForGraph" TechnicalProfileReferenceId="REST-AcquireAccessTokenForGraph" />
				</ClaimsExchanges>
			</OrchestrationStep>
			
			<OrchestrationStep Order="7" Type="ClaimsExchange">
			  <ClaimsExchanges>
				<ClaimsExchange Id="REST-GetGroupMembership" TechnicalProfileReferenceId="REST-GetGroupMembership" />
			  </ClaimsExchanges>
			</OrchestrationStep>

			<!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey will not ask the user to enroll -->
			<OrchestrationStep Order="8" Type="InvokeSubJourney">
			  <JourneyList>
				<Candidate SubJourneyReferenceId="TotpFactor-Input" />
			  </JourneyList>
			</OrchestrationStep>

			<!-- Call the TOTP validation sub journey-->
			<OrchestrationStep Order="9" Type="InvokeSubJourney">
			  <JourneyList>
				<Candidate SubJourneyReferenceId="TotpFactor-Verify" />
			  </JourneyList>
			</OrchestrationStep>

			<OrchestrationStep Order="10" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />

		  </OrchestrationSteps>
    </UserJourney>
	
	<UserJourney Id="PasswordChangeTOTP">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
        </OrchestrationStep>		
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
		<!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey will not ask the user to enroll -->
        <OrchestrationStep Order="3" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Input" />
          </JourneyList>
        </OrchestrationStep>

        <!-- Call the TOTP validation sub journey-->
        <OrchestrationStep Order="4" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Verify" />
          </JourneyList>
        </OrchestrationStep>
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordChangeUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="6" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
  </UserJourneys>
  <SubJourneys>

    <!--TOTP subjourneys-->
    <!-- Set the required claims numberOfAvailableDevices and totpIdentifier-->
    <SubJourney Id="SetTotpInitialValue" Type="Call">
      <OrchestrationSteps>

        <!-- If number of available device claim not exists, set the value to 0-->
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>numberOfAvailableDevices</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpDefaultValue" TechnicalProfileReferenceId="SetTotpDefaultValue" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- The following orchestration steps try to get the user identifier for different 
             type of authentication, such as local and social account.-->
        
             <!-- Try to get the identifier from UserId-->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>UserId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsUserId" TechnicalProfileReferenceId="CreateTotpIdentifier-UserId" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- Get the identifier from email-->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsEmail" TechnicalProfileReferenceId="CreateTotpIdentifier-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- Get the identifier from the user's emails -->
        <OrchestrationStep Order="4" Type="InvokeSubJourney">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>emails</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <JourneyList>
            <Candidate SubJourneyReferenceId="ExtractEmailFromEmailsForTotpIdentifier" />
          </JourneyList>
        </OrchestrationStep>
        
        <!-- Get the identifier from local account sign-in name-->
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>signInName</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsSignInName" TechnicalProfileReferenceId="CreateTotpIdentifier-SignInName" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>

    <!-- Get the identifier from the user's emails -->
    <SubJourney Id="ExtractEmailFromEmailsForTotpIdentifier" Type="Call">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>emails</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="GetEmailAddress" TechnicalProfileReferenceId="GetEmailAddress" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>ReadOnlyEmail</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="GetEmailFromReadOnlyEmail" TechnicalProfileReferenceId="GetEmailFromReadOnlyEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsEmail" TechnicalProfileReferenceId="CreateTotpIdentifier-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>signInName</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsSignInName" TechnicalProfileReferenceId="CreateTotpIdentifier-SignInName" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>

    <!-- TOTP verification sub journey-->
    <SubJourney Id="TotpFactor-Verify" Type="Call">
      <OrchestrationSteps>
        
        <!-- Set the required claims numberOfAvailableDevices and totpIdentifier-->
        <OrchestrationStep Order="1" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="SetTotpInitialValue" />
          </JourneyList>
        </OrchestrationStep>

        <!-- If current user is not a new one (this is a sign-in flow, and not sign-up), 
             check the number of available devices. -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>newUser</Value>
              <Value>True</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="CheckAvailableDevices" TechnicalProfileReferenceId="AzureMfa-GetAvailableDevices" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- If the number of available devices isn't zero (user has enrolled before), 
             render the TOTP verification page -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>numberOfAvailableDevices</Value>
              <Value>0</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AuthenticatorForSignIn" TechnicalProfileReferenceId="OTPVerification" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>

    <!-- TOTP enrollment sub journey-->
    <SubJourney Id="TotpFactor-Input" Type="Call">
      <OrchestrationSteps>

        <!-- Set the required claims numberOfAvailableDevices and totpIdentifier-->
        <OrchestrationStep Order="1" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="SetTotpInitialValue" />
          </JourneyList>
        </OrchestrationStep>

        <!-- If current user is not a new one (this is a sign-in flow, and not sign-up), 
             check the number of available devices. -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>newUser</Value>
              <Value>True</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="CheckAvailableDevices" TechnicalProfileReferenceId="AzureMfa-GetAvailableDevices" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- If the number of available devices is zero (user hasn't enrolled before), 
            render the TOTP enrollment page to scan the QR code that starts the enrollment process -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
              <Value>numberOfAvailableDevices</Value>
              <Value>0</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AuthenticatorForSignUp" TechnicalProfileReferenceId="EnableOTPAuthentication" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- If the number of available devices is zero (user hasn't enrolled before), 
             render the TOTP verification page.  -->
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
              <Value>numberOfAvailableDevices</Value>
              <Value>0</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AuthenticatorForSignIn" TechnicalProfileReferenceId="OTPVerification" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>
  </SubJourneys>

Specific Docs/Guides used:

Initial Config: https://learn.microsoft.com/en-gb/azure/active-directory-b2c/tutorial-create-tenant

Azure AD Auth: https://learn.microsoft.com/en-gb/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant?pivots=b2c-custom-policy

SSO Behaviour: https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy

TOTP MFA: https://learn.microsoft.com/en-us/azure/active-directory-b2c/multi-factor-authentication?pivots=b2c-custom-policy

James Hamil 26,116 Reputation points Microsoft Employee

2023-05-03T22:09:55.5966667+00:00

Hi @Anonymous , thanks for the post. From my perspective this seems like the expected behavior, but other users have experienced similar issues. I'll reach out to the product group to confirm and let you know when I have an answer!

Best,

James
Atkinson, Oliver 0 Reputation points

2023-05-04T08:31:40.5566667+00:00
Hi James, thanks for your response!

By Password Reset I'm assuming you are referring to the Change Password issue I refer to above? As My Password Reset (Forgot Password) process is working as intended as part of my CustomSignUpOrSignIn process.

The Change Password Policy is working in the environment without MFA but not the one with. Both use the SM-AAD session manager with SSO enabled. The only difference between the two is that the MFA enabled one includes the 'TotpFactor-Input' and 'TotpFactor-Verify' Sub Journeys (referenced here https://github.com/azure-ad-b2c/samples/blob/master/policies/totp/policy/TrustFrameworkExtensions_TOTP.xml) after the initial login.

Should the Change Password policy include the SSO User Journey Behaviours similar to the SignInOrSignUp User Journey (see below)?

<UserJourneyBehaviors> <SingleSignOn Scope="Tenant" KeepAliveInDays="30"/> <SessionExpiryType>Rolling</SessionExpiryType> <SessionExpiryInSeconds>1200</SessionExpiryInSeconds> </UserJourneyBehaviors>

Are you able to provide any insight on the Single Sign Out issue I am having also? (out of applications, not social identity providers). It seems to be supported as per the documentation here (https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy#single-sign-out) but I cannot get it working.

I have tried setting the Front Channel Logout URI of the App Registrations to the Terminate Session Endpoint, as well as <site-url>/signout-oidc and <site-url>/signout-callback-oidc - which are all also configured in .NET. I have seen some reference to allowing microsoft.login to frame your site to enable this functionality to work, but there is no documentation on doing this.
Atkinson, Oliver 0 Reputation points

2023-05-04T08:32:37.1733333+00:00

Ignore - accidental comment
Atkinson, Oliver 0 Reputation points

2023-05-04T16:14:24.1833333+00:00

I have resolved the single sign out issue (fix was setting the authentication cookie to explicitly use SameSiteMode = none and Secure = Always) - the only outstanding issue I am still having which I have no work around for is the Change Password policy requiring re-authentication when MFA is enabled.

1 answer

Atkinson, Oliver 0 Reputation points

2023-05-09T07:48:30.5866667+00:00

Change password now seems to have started working after tweaking a few settings surrounding MFA. All my policies are now as I intend them to work.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure AD B2C Single Sign Out and Change Password Issue (Azure AD (Multi-Tenant) Identity Provider and TOTP MFA enabled)

1 answer

Your answer