Error Trying to Default Claims in Custom Policy during ROPC Flow.

Question

I was able to get basic Resource Owner Password Credentials flow in my custom policy following along with https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-ropc-policy?tabs=app-reg-ga&pivots=b2c-custom-policy. We're using ROPC for our QA automation.

Right now the UserJourney is the 3 steps

1. OpenIdConnect using {OIDC:defaults}
2. Read User using UserId
3. Send Claims

I was hoping to get a Just-in-time migration flow working with it (I have it working with Local Account sign-ins using a different policy). My understanding is I need to update the user journey orchestration steps to do this. So I plan to update accordingly.

Here's the new proposed flow

1. Read signInName and password from {OIDC:defaults}
2. Read User using signInName
3. If User doesn't exist by signInName, make a RESTFUL just-in-time migration call.
4. OpenIdConnect
5. Read User using UserId
6. Send Claims

Well, unfortunately I can't get past step 1. All I'm trying to do is to default the signInName and password claims to {OIDC:Username} and {OIDC:Password} respectively.

Here is my code:

and then the technical profile:

When I try to run the ROPC flow (which used to work before adding this orchestration step), I get an error, and application insights shows this:

{
"Kind": "FatalException",
"Content": {
"Time": "4:48 PM",
"Exception": {
"Kind": "Handled",
"HResult": "80004001",
"Message": "The method or operation is not implemented.",
"Data": {}
}

This seems like such a simple thing and I have no idea why its not working.

The only thought I had was that the {OIDC:Username} and {OIDC:Password} claims resolvers weren't implemented in Claims Transformation technical profiles? However, according to https://learn.microsoft.com/en-us/azure/active-directory-b2c/claims-transformation-technical-profile , using `` should take care of it.

Any help would be much appreciated.

Thanks!

-Adam

Answer 1

Hi @AdamKozmic-7665 ,

Thanks for reaching out.

Did you try to add technical profile for OIDC claims transformation?

<TechnicalProfile Id="GetOidcClaims">
  <DisplayName>Get OIDC claims</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="id_token" PartnerClaimType="id_token" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="sub" />
    <OutputClaim ClaimTypeReferenceId="password" PartnerClaimType="password" />
  </OutputClaims>
</TechnicalProfile>

and then tried to add that technical profile as first step in your user journey.

In the first step, the claim should come from a self-asserted technical profile or from REST API as the input claim needs to be present in the claims bag.

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.