question

kirillkolesnikov-3022 avatar image
0 Votes"
kirillkolesnikov-3022 asked alfredorevilla-msft commented

ContinueOnError true has no effect

In extesntion I'm overrided SelfAsserted-LocalAccountSignin-Email profile

<TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
<ValidationTechnicalProfiles>
<!-- Initiate a normal logon against Azure AD B2C -->
<ValidationTechnicalProfile ReferenceId="login-NonInteractive" ContinueOnError="true" />
<!-- Check if account is locked out. Note: This validation technical profile also return the bad user name and password -->
<ValidationTechnicalProfile ReferenceId="REST-AccountLockout">
<Preconditions>
<Precondition Type="ClaimEquals" ExecuteActionsIf="false">
<Value>objectId</Value>
<Value>badPassword</Value>
<Action>SkipThisValidationTechnicalProfile</Action>
</Precondition>
</Preconditions>
</ValidationTechnicalProfile>
</ValidationTechnicalProfiles>
</TechnicalProfile>

Blockquote

and added default value for oid in login-NonInteractive
<TechnicalProfile Id="login-NonInteractive">
<InputClaims>
<!--Replace with your Application ID of the ProxyIdentityExperienceFramework-->
<InputClaim ClaimTypeReferenceId="client_id" DefaultValue="{ProxyIdentityExperienceFramework}" />
<InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="{IdentityExperienceFramework}" />
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" DefaultValue="badPassword"/>
</OutputClaims>
</TechnicalProfile>

Blockquote

But if the credentials are not correct, I never get into the next validation profile

azure-ad-b2c
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

alfredorevilla-msft avatar image
1 Vote"
alfredorevilla-msft answered alfredorevilla-msft commented

Hello @kirillkolesnikov-3022, please ensure the metada entry for grant_type is not present (remove or comment it) in the login-NonInteractive Technical Profile (Usually stored in the TrustFrameworkBase policy).



Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it so that others in the community with similar questions can more easily find a solution.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@alfredorevilla-msft Yes if remove or comment grant_type from login-NonInteractive I can use next validation profile, but it always return valid objectId and https://github.com/azure-ad-b2c/samples/blob/1c547e0001bd8b0b426bc4c7daa3299cecd225f5/policies/lockout/ADB2C.Lockout/ADB2C.Lockout/Controllers/IdentityController.cs#L78 based on objectId we deside sucsesfull login

0 Votes 0 ·
alfredorevilla-msft avatar image alfredorevilla-msft kirillkolesnikov-3022 ·

Hello @kirillkolesnikov-3022, that can happen if the objectId claim is being read from the session cookie. In such case the objectIdFromSession claim will be present in the claim bag. Clearing cookies can help unless you're seeing the behavior even after entering wrong credentials.

1 Vote 1 ·
alfredorevilla-msft avatar image
0 Votes"
alfredorevilla-msft answered alfredorevilla-msft commented

Hello @kirillkolesnikov-3022, REST-AccountLockout is being skipped due to its precondition: objectId claim value is never set to badPassword.


Let us know if this answer was helpful to you. If so, please remember to accept it so that others in the community with similar questions can more easily find a solution.

· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@alfredorevilla-msft Yes, but even if I delete the precondition, I still don't get into REST-AccountLockout
It feels like if the login password values are not correct, an error is immediately thrown from login-NonInteractive ignoring ContinueOnError="true"

0 Votes 0 ·
alfredorevilla-msft avatar image alfredorevilla-msft kirillkolesnikov-3022 ·

Hi @kirillkolesnikov-3022, I will try to reproduce the issue on my side and come back to you with my findings.

1 Vote 1 ·
0 Votes 0 ·