OpenIdConnect Sign-in orchestration step - AAD-UserReadUsingObjectId throwing exception

Shiraj Shaikh 1

This orchestration step works fine with Local Account Signin, but throws exception with OpenIdConnect Signin i.e. Signing in with Organization account.

Error

AADB2C99002: This user does not exist and profile 'AAD-UserReadUsingObjectId' requires the user to have already been created.

Navya 10,540 Reputation points Microsoft Vendor

2024-09-19T06:21:29.7766667+00:00

Hi @Shiraj Shaikh

Thank you for posting this in Microsoft Q&A.Can you please confirm below points in your tenant.

1.Ensure you register the Azure AD B2C App within the Azure AD tenant and enable the app for external access (Multitenant).

2.A federated user must be invited to the Azure AD tenant initially. Should an uninvited user try to access the Azure AD B2C App, they will encounter the AADSTS50020 error, indicating that the account must first be added as an external user in the tenant. Alternatively, configuring Azure AD user flows can allow for automatic user signup via self-service.

3.Verify if the Organization account is included in the Azure AD B2C tenant.

Thanks,

Navya.
Navya 10,540 Reputation points Microsoft Vendor

2024-09-23T07:08:04.9+00:00

Hi @Shiraj Shaikh

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Shiraj Shaikh 1 Reputation point

2024-09-27T14:25:55.64+00:00
I'm sorry for not getting back to you on time. Here is what I tried so far.

Added the App and enabled the external AD tenant

User already exists in external Azure AD

Found the user in the B2C tenants users list

The orchestration step below causes the exception when I log in with an Orgs ID. Local account sign-in works fine.

<OrchestrationStep Order="3" Type="ClaimsExchange">

<Preconditions> <Precondition Type="ClaimsExist" ExecuteActionsIf="false"> <Value>objectId</Value> <Action>SkipThisOrchestrationStep</Action> </Precondition> </Preconditions> <ClaimsExchanges> <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId"/> </ClaimsExchanges> </OrchestrationStep>

Am I missing any step or precondition here?
Shiraj Shaikh 1 Reputation point

2024-09-27T14:31:16.2166667+00:00

I need to use a custom policy to save custom user attributes for the local users. The application will authorize the user based on these attributes

Share via

OpenIdConnect Sign-in orchestration step - AAD-UserReadUsingObjectId throwing exception

Your answer