Unable to sign on using custom policy

Steve Degenhardt 61 Reputation points
2020-07-21T16:01:48.297+00:00

I have followed all the steps here (https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-get-started) in order to create a custom policy. I am able to create an account, but when I attempt to log in I receive the "Invalid username or password" message. I am able to use that account to log in using the built-in user flows but not the custom policies. Unfortunately, the documentation does not show full examples, but after re-reading this about 1000 times I think I am doing this correctly. If anyone has any suggestions on how to debug the issue or what I might be doing incorrectly, please let me know.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,654 questions
Accepted answer
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points
    2020-08-07T16:53:17.507+00:00

    In your IdentityExperienceFramework app manifest:

    Change:

    "accessTokenAcceptedVersion": 2,

    To (default value):

    "accessTokenAcceptedVersion": null,

    Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.

    3 people found this answer helpful.

8 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Radovan Končarević 16 Reputation points
    2021-09-06T10:10:10.427+00:00

    I had the same issue. The change that resolved it that I deleted IdentityExperienceFramework and ProxyIdentityExperienceFramework applications created under b2c "blade" (weird name), and created them under AAD. That means that before doing this step https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows?pivots=b2c-custom-policy#register-the-identityexperienceframework-application and this one https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows?pivots=b2c-custom-policy#register-the-proxyidentityexperienceframework-application navigate to AAD and then to App registrations

    1 person found this answer helpful.
    0 comments
  2. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points
    2020-07-21T17:17:04.543+00:00

    Please take a look to Get started with custom policies in Azure Active Directory B2C. It covers the basic setup, authenticating with local (Azure AD B2C directory) accounts and facebook accounts.

  3. Almeida, Rodney (Corp) 1 Reputation point
    2021-06-08T05:26:45.3+00:00

    Same issue, testing SignUpOrSignin.xml custom policy and can create local users ok but cannot login

    0 comments
  4. Sam Shinn 1 Reputation point
    2022-09-01T20:38:54.01+00:00

    When initially trying to upload TrustFrameworkBase.xml I received a validation error. I went looking around in that file and in the <TechnicalProfile Id="login-NonInteractive"> section I found these items:

    <Item Key="METADATA">https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration</Item>
    <Item Key="authorization_endpoint">https://login.microsoftonline.com/{tenant}/oauth2/token</Item>

    "Well that looks weird," I thought, "I'll try replacing {tenant} with my tenant name." Boom, no validation error! No mention of it in the tutorial, but oh well—it works, so, moving on...

    Later, I run into the principle problem of this thread where sign up works but not sign in. After trying many things, I wondered about my "fix" for that validation error. So...

    I switched the METADATA and authorization_endpoint URLs back to the default (as above) and uploaded the file with the Overwrite the custom policy if it already exists checkbox selected. No validation issues. Weird. But Ok, great, let's try signing in... Lo and behold, that seemed to do the trick: Sign in works now.

    Hopefully sharing this helps someone else ♥

    0 comments