Azure AD B2C with custom policies: unable to authenticate user with temporary password

Question

I have configured Azure AD B2C with custom policies, but I cannot authenticate with a new user created on the Azure portal. The user has a temporary password. Azure AD B2C returns error text Invalid username or password, even if the username and password are correct.

I have confirmed that you can log in to Azure AD B2C with a new user and temporary password using custom policies. After logging in, the user will be prompted to change his password.

The problem can be reproduced using the user policies described in this guide: Start with custom policies .

Additional Information:

I configured b2crecorder https://b2crecorder.azurewebsites.net/stream?id=<guid>in UserJourneyRecorderEndpoint. This gives access to additional information throughhttps://b2crecorder.azurewebsites.net/trace_102.html?id=<guid>

The problem leads to the following logging:

SelfAssertedMessageValidationHandler

The message was received from null

Validation via SelfAssertedAttributeProvider

Additional validation is required...

OperativeTechnicalProfile is login-NonInteractive

Mapping 'username' partner claim type to 'signInName' policy claim type

Mapping default value 'undefined' to policy 'grant_type'

Mapping default value 'undefined' to policy 'scope'

Mapping default value 'undefined' to policy 'nca'

Mapping default value 'undefined' to policy 'client_id'

Mapping default value 'undefined' to policy 'resource_id'

Using validation endpoint at: https://login.microsoftonline.com/xxxx.onmicrosoft.com/oauth2/token

Orchestration Step: 1

RA: 0

Protocol selected by the caller: OAUTH2

Communications with the caller handled by: OAuth2ProtocolProvider

IC: True

OAuth2 Message: MSG(d56987e9-be2e-46fc-a7a4-23e317f8f174) Message Detail

ValidationRequest:

ValidationResponse:

Exception:

Exception of type 'Web.TPEngine.Providers.BadArgumentRetryNeededException' was thrown.

Answer 1

The most common reason for this is that grant permissions have not been met.

In the “ProxyIdentityExperienceFramework Application” → after selecting the checkbox for Access IdentityExperienceFramework → by clicking the “Select” button and clicking “Finish”, you must also perform the following step:

Select Grant Permissions , then confirm by choosing Yes .

Edit:

, , " " " " Azure Active Directory forceChangePasswordNextLogin. (forceChangePasswordNextLogin " " ). .