Azure B2C Change Password Policy - How to Avoid Logging In

0
votes

We are migrating our user base to authenticating via Azure B2C. I am following the example set out in the starter packs for password changing in Azure B2C (https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/scenarios/password-change).

The process at the moment with our app is like this:

  1. You click "change password" in our app (after you have already logged in via B2C) and you are redirected to our change password policy in B2C
  2. You are presented with a screen to enter you credentials (for us this is username and password)
  3. Upon successfully entering those credentials you are presented with the option to enter your "old password" and the "new password" with an extra text-box to confirm the new password
  4. You are redirected back to the app

My problem is step two - you have to enter your credentials despite a) having already logged in via Azure B2C and b) on step three you have to enter your old password anyway.

How can I get the custom policy to "know" which user the password request is for and simply use the entering of the "old password" claim as verification enough of their identity. In my app I know the "ObjectId" claim, is there a way I can just "pass that in" to the change password page via a querystring parameter and have it skip step two?

1
azure-ad-b2cazure-ad-b2c-custom-policy
If you pass in the user data through query string, I recommend you use a signed JWT to pass claims, like in the invitation sample here: github.com/azure-ad-b2c/samples/blob/master/policies/invite/…. – juunas
Hi @DenverCoder9 How are you testing this? Does the authentication request contain prompt=login? If so, then this invalidates the SSO session, which otherwise suppresses the login prompt at step 2. – Chris Padgett
I certainly was @ChrisPadgett and removing this removed the problem. – DenverCoder9

1 Answers

1
votes

As a comment on my question has led me to find out - it was because I included "prompt=login" in the URL that the user is redirected to.

Without this querystring parameter it works as I expect.