Azure AD B2C Internal Error uploading Custom Policy

Question

I am experiencing an issue where a set of custom policies that upload without issue to one tenant (development tenant), fail to upload to another (production tenant). The policies function correctly on the (working) development tenant.

I upload the files in the following order:

TrustFrameworkBase.xml uploads OK
TrustFrameworkExtensions.xml uploads OK
SignUpOrSignin.xml fails with above error
ProfileEdit.xml fails with above error
PasswordReset.xml uploads OK

The only clue I have is that if I query the extension claims in the B2C app for the failing tenant, it only shows 2 out of 8. If I run the same query against the working tenant, it shows all 8. I am doing this querying using this example app: https://github.com/AzureADQuickStarts/B2C-GraphAPI-DotNet.

As far as I can tell, the two tenants are configured the same, and I have checked the various IDs etc are configured correctly. But it is always possible I have missed something!

Can anyone help?

The xml files: https://1drv.ms/f/s!ApxUZQaL9hp0h1ACYgWzgzsGwCOc

More info

I can actually run the policies that upload with an error. But when I try to create an user account via running the policy I get a message saying "Unable to validate the information provided." at the top of the page, inside the <div> with the id claimVerificationServerError. This may tie-up with the missing extension claims in the B2C app. So it looks like the problem is with creating the extension claims. But the same policy uploads and works on another tenant. How could the extension claims be valid on one tenant, but not on another?

Can you upload failing policy? remove all sensitive info and upload — Ramakrishna
I'll try, thanks. I just gave it a go and it exceeded the character limit... I'll see if I can link to it somewhere. — Mat

Yin Yin · Accepted Answer · 2018-09-10T19:53:47

In your base policy, there is the following claim of dateOfBirth:

<ClaimType Id="extension_DateOfBirth">
    <DisplayName>Date of Birth</DisplayName>
    <DataType>date</DataType>
    <UserHelpText>Date of birth</UserHelpText>
    <UserInputType>DateTimeDropdown</UserInputType>
    <PredicateValidationReference Id="DateOfBirthDateRange" />
</ClaimType>

Since this claim starts with "extension_" and it is used in a technical profile with "AAD-" as prefix, it will be automatically created as an extension attribute in AAD during the policy uploading. However, the DataType "date" is not supported (only DateTime is supported) in AAD. This is causing policy uploading failure.

Regarding how to map "date" claim in B2C policy to AAD "DateTime" attribute, I will reply back to this thread after more investigation on these policies is done.

Edit: I was trying to find this doc: https://msdn.microsoft.com/Library/Azure/Ad/Graph/api/entity-and-complex-type-reference#extensionproperty-entity when I first replied but could not find it. Thanks Mat for sharing. Hope this link is helpful for solving issues related to datatype of extension attributes in AAD.

Azure AD B2C Internal Error uploading Custom Policy

2 Answers