Azure-Samples / active-directory-b2c-advanced-policies

Sample for use with Azure AD B2C with Custom Policies.
http://aka.ms/aadb2ccustom
MIT License
218 stars 143 forks source link

Unable to conditionally execute conditional OrchestrationStep #34

Closed LearnToCodeKM closed 6 years ago

LearnToCodeKM commented 6 years ago

I am trying to introduce new Orchestration Step based on the value of my custom attribute. My requirement is I want to execute the a orchestration step only if the value of myattribute(boolean attribute) is set to true. The value of myattribute is either set to true or false. I am doing something like this. `

    </OrchestrationStep>
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
          <Value>mobile</Value>
          <Value>extension_myattributee</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="NewCredentials1" TechnicalProfileReferenceId="LocalAccountWritePasswordChangeUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>`

But this step is not skipped irrespective of the value of myattribute. I have added the myattribute as part of the OutPutClaims of AAD-UserReadUsingObjectId. I am able see the value of extension_myattribute in the C#.

monty-dev commented 6 years ago

This should execute the last orchestration step if myattributee is 'True' I am unable to test this, i'd experiment with the case for 'true' in the precondition.

<OrchestrationStep Order="3" Type="ClaimsExchange">
    <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
    </ClaimsExchanges>
</OrchestrationStep>
<OrchestrationStep Order="4" Type="ClaimsExchange">
    <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
            <Value>extension_myattributee</Value>
            <Value>true</Value>
            <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
    </Preconditions>
    <ClaimsExchanges>
        <ClaimsExchange Id="NewCredentials1" TechnicalProfileReferenceId="LocalAccountWritePasswordChangeUsingObjectId" />
    </ClaimsExchanges>
</OrchestrationStep>¸
LearnToCodeKM commented 6 years ago

I tried it does not work. The behavior remains the same irrespective of the value of my custom attribute. Below image depicts the value of my custom attribute. I have another user with my custom attribute being set to false. image

monty-dev commented 6 years ago

I just tested this in a B2C tenant and it successfully ran with the above snippet. I'd share your AAD-UserReadUsingObjectId profile with the change you made to retrieve this attribute.

LearnToCodeKM commented 6 years ago

Here is my AAD-UserReadUsingObjectId `

Read true false

`

AAD-Common

`

Azure Active Directory
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureActiveDirectoryProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
    <Item Key="ApplicationObjectId">appid</Item>
    <Item Key="ClientId">objectid</Item>
  </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
      </CryptographicKeys>
      <!-- We need this here to suppress the SelfAsserted provider from invoking SSO on validation profiles. -->
      <IncludeInSso>false</IncludeInSso>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
    </TechnicalProfile>`

I have followed the steps mentioned in the https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-create-custom-attributes-profile-edit-custom to create custom attributes.

monty-dev commented 6 years ago

In your schema, i'm assuming you're setting your claim type data type to boolean? Try changing that to string and running the first snippit I sent. I tested against a string data type and it was working successfully. - Also post this claim type

LearnToCodeKM commented 6 years ago

Changing my custom attribute to string worked. Changing just the claim type did not help(it shows up error) , so added a new string custom attribute to and used it. Thanks for all the help and I really mean it.

monty-dev commented 6 years ago

@parakhj for the sake of the community, can you comment on the ability to run preconditions against boolean data type claims within the User Journey? It appears 'true' and 'false' are not recognized when checking values.

chrispadgettlivecom commented 6 years ago

The possible values for a boolean claim are "True" and "False" (i.e. the string representation of true and false).