3,267 questions
Ok got it. Well that looks like a implicit flow request which should not contain nor a client secret or assertion. Also client assertion is no longer supported by B2C.
Redirect to custom error page from if b2c invitation link expired
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 78%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVM%3C/text%3E%3C/svg%3E)
Vaibhav More
1
Reputation point
When a user is invited to join the b2c tenant with an invitation link if the user tries to access that link it says that the link is expired as the expiry time is 24 hours.
Upon expiry user sees Microsoft Defined error page where it does not state that the link/ token has expired.
So, wanted to either redirect to custom error page or display a custom error page with proper messages.
How to show the custom error page in this scenario?
The eg. invitation link is here.
Microsoft Security Microsoft Entra Microsoft Entra External ID
Microsoft Security Microsoft Entra Microsoft Entra ID
25,081 questions
{count} votes
-
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator2020-11-05T00:49:40.423+00:00 Hello @Vaibhav More , the included link displays this:
AADB2C90017: The client assertion provided in the request is invalid: 'client_secret' was used as the verification keyCan you explain with more detail how the user is created and the invitation sent?
-
Vaibhav More 1 Reputation point
2020-11-11T11:50:40.33+00:00 anonymous user-msft ,
PFB code used to generate the invite link: JWT token has a validity of 1 day. Other variables are specific to Azure AD Tenant.var url = $"https://{domainName}.b2clogin.com/{issuer}/{invitationPolicy}/oauth2/v2.0/authorize?client_id={clientId}" +
$"&login_hint={inviteRequest.InviteEmail}&response_mode=fragment&nonce=defaultNonce" +
$"&redirect_uri={redirectUrl}&scope=openid&response_type=id_token" +
$"&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion={jwt}"; -
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator
2020-11-11T18:35:27.78+00:00 What is PFB? Also, you're requesting an id token using a client assertion. This is not a requirement and I'm not aware if its supported. I still not clear about how the link is generated. Are you inviting a B2B Azure AD user or a already created B2C user?
-
Vaibhav More 1 Reputation point
2020-11-18T15:13:25.01+00:00 PFB = Please find below.
Any user having Azure/Gmail or any valid email can be invited to join our B2C tenant using a similar kind of link shown above.
Here client_assertion_type is making use JWT Token to validate the email and expiry.Upon expiration (After 24 Hours), it shows the default error page.
-
James Hamil 27,211 Reputation points Microsoft Employee Moderator2020-11-26T00:47:30.197+00:00 Hi, do you still require assistance? If not, please mark the answer as verified.
Thank you,
James -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 11%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDL%3C/text%3E%3C/svg%3E)
Deepnarayan Lohra 1 Reputation point2021-04-12T07:29:49.467+00:00 Hi @James Hamil this issue is still there. Upon expiry user sees Microsoft Defined error page where it does not state that the link/ token has expired.
So, I wanted to either redirect to a custom error page or display a custom error page with proper messages.
Sign in to comment
1 answer
Sort by: Most helpful
-
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator
2020-11-19T17:38:07.417+00:00