"Upn from claims with value null is not a valid upn."

Question

Hi

I am trying to use one of your APIs to reset user's passwords from our app using the Graph API under Azure AD B2C

So far, I have a majority of the user flows working:

• Finding users by email address
• Getting user info and extensions by ID
• Create new users with their email address and chosen password

But the one thing I cannot get to work is changing their password. We have our own flows to verify the user, so our API is really just trying to set their password.

We are using this beta API to try and accomplish it because it didn't seem like there was a better API to use: https://learn.microsoft.com/en-us/graph/api/passwordauthenticationmethod-resetpassword?view=graph-rest-beta&tabs=http

For some context, we are using Node.js and the following code is how we're authenticating to the Graph API. Again, this works for everything but password reset.

const getClientCredentials = oauth.client(axios.create(), {  
  url: `https://login.microsoftonline.com/${process.env.AAD_TENANT_ID}/oauth2/v2.0/token`,  
  grant_type: 'client_credentials',  
  client_id: process.env.AADU_CLIENT_ID,  
  client_secret: process.env.AADU_CLIENT_SECRET,  
  scope: TOKEN_SCOPE  
});  
  
const instance = axios.create();  
instance.interceptors.request.use(  
  oauth.interceptor(tokenProvider, getClientCredentials)  
);  

This is what we're doing to reset a user's password (this.id being the User's ID in Azure)

First, we fetch their authentication methods to find their password authentication method.

    const response = await instance.request({  
      baseURL: API_URI,  
      url: `/beta/users/${this.id}/authentication/methods`,  
      method: 'get'  
    });  
  
    return response.data.value; //Returns an array which we get the ID from  
  
    return instance.request({  
      baseURL: API_URI,  
      url: `/beta/users/${this.id}/authentication/passwordMethods/${authID}/resetPassword`,  
      method: 'post',  
      data: {  
        newPassword  
      }  
    });  

But this is the error we get from the API, which comes back as JSON in a string:

{\"error\":{\"code\":\"BadRequest\",\"message\":\"Upn from claims with value null is not a valid upn.\",\"innerError\":{\"request-id\":\"4668534c-c4b0-4c4a-b979-c39662c1f7dd\",\"date\":\"2021-01-25T14:38:40.7851202Z\"}}}  

My head has been spinning on this for days and from my research, nothing is standing out. Any insight anyone might have would be greatly appreciated.

Answer 1

Hi @Liam Barry · Thank you for reaching out.

The problem here is with the authentication flow that you are using. The client_credentials authentication flow is used to acquire Access Token under application context and there is no user context involved. Since the resetPassword operation is needed to be performed under user context, you need to use one of the authentication flows which are used to acquire the Access Token under user context, e.g.

1. Authorization Code
2. Resource Owner Password Credentials (ROPC)
3. Implicit grant

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi @Liam Barry · Thank you for sharing the fiddler capture. Looking at the fiddler trace, I found that you are trying to perform password reset via Graph API in B2C tenant. Unfortunately, B2C tenant doesn't support this method to reset the password as there is no UserAuthenticationMethod.ReadWrite.all permission included in Graph API for B2C tenant. The only delegated permissions available in B2C tenant are offline_access and openID.

The methods available to reset the password in B2C tenant are either admin performing password reset via Azure Portal or by using Password Reset Policy.

Password Reset via Graph API is only supported in Standard Azure AD tenants as of now. You can post an idea at our Feedback Portal regarding this feature in B2C tenant.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.