Password Reset Redirects to "Sign In Failed" page

[FlowHawk]

Hey all,

I've configured my Power Apps portal to use Azure B2C for external authentication. Everything works great except for this one piece. When a user resets their password they are redirected to .../Account/Login/ExternalAuthenticationFailed with this error:

If they click "Sign in" and use their newly reset password, they authenticate correctly. What that means is that the password reset flow is resetting their password correctly, but just redirecting the user to an error page. How can I change this user experience?

Note: I set up the Azure AD B2C using the wizard at make.preview.powerapps.com so I haven't manually configured any settings.

[chleverenz]

Hi FlowHawk,

not sure, but could it be that changing the password does not delete the authentcationcookie for the B2C Site and an outdated token is used for logging in? I think, an id token is passed to the portal and if the portal checks that one for validity and it fails, because its old/invalid.

Have you tried to clear all cookies for the b2c provider after a password change? This would force the user to log in again, which makes a kind of sense to me.

If this works, may be AzureB2C password change flow is to be configured either to clear the session or to update all issued id tokes (what would mean that there is an error, if it doesn't 🙂 )

So, just ideas and no clear hint.

Hope it helps a little bit,

  Christian

[FlowHawk]

That's an interesting thought. I appreciate the point. I'm just not savvy enough to know what to do with the information haha. I did go into the B2C settings and tinker with the tokens, claims, logout urls, etc... and no dice. But I suspect what is conceptually occurring is exactly as you have said.

[OliverRodrigues]

Hi, this is an old and a bit more manual article, but still super valid for you to understand the site settings involved: https://readyxrm.blog/2019/07/24/configure-azure-ad-b2c-for-powerapps-portals/

can you please take a look to see if your site settings are correct?

also, are you using custom policies on Azure AD B2C? or standard user flows?

[FlowHawk]

Thanks @OliverRodrigues. I reviewed the article and checked each property in the B2C user flows and in the portal -- they all matched. I couldn't see anything different. I'm curious, do this issue sound like a B2C problem? Or a portal problem?

I'm using standard user flows from Azure B2C. They were set up using the make.preview.powerapps.com B2C wizard.

[FlowHawk]

For further information, I created a developer tenant, created a new azure subscription, created a new resource, created a new Power Apps portal, went to make.preview.powerapps.com, configured Azure B2C as an authentication provider (creating new signupsignin and password reset user flows during the wizard), set Azure B2C as the default identity provider, sync the changes, opened my portal and created an account, then signed out and attempted to reset my password. I was forwarded to the same error page.

At this point I'm not convinced that this works for anyone else out of the box. Can someone confirm?

[OliverRodrigues]

Sorry about the delay, I performed the same task as you are doing a few months ago and worked fine.

Unless something has changed, this should work.

Can you share a few snapshots of your Azure user flow (properties / application claims)?

[FlowHawk]

Here are some screenshots. This is all in the developer tenant where I didn't make any customizations:

[OliverRodrigues · Accepted solution]

Thanks for the snapshots.. try the follwoing changes:

App Registration > Authentication

• add another Redirect URI, with just the Portal URL
• enable ID Tokens for implicit grant

SignUpSignIn > Properties

• those look fine to me

SignUpSignIn > User Attributes / Application Claims

• I normally also enable Surname/Given Name, but that's optional

Reset Password > Properties

• Issuer claim doesn't seem right to me, can you select the other (non-TFP) option from the drop-down (but keep TFP selected in the toggles there):

Reset Password > Application Claims

• In my environment I only have selected Given Name/Surname, but I don't think this would make any difference

Portal Configuration > Valid Issuers

• Here you need both Issuer URL for your Sign Up Sign In + Reset Pwd flows, the article above I shared explains how to retrieve those URLs

hope this helps

[FlowHawk]

Thank you Oliver!! I applied all the changes except the claims ones and it worked!!

I don't know if anyone from the product team is here in the forum, but it would be helpful feedback I think that the wizard in the make.preview.powerapps.com sets up the issuer incorrectly for password reset flows.

Thanks again Oliver, you rock!