Skip to content

Commit 1006a28

Browse files
kengaderduskengaderdus
committed
write user account review- add email verification by using display controls
1 parent 7158f9d commit 1006a28

File tree

3 files changed

+137
-11
lines changed

3 files changed

+137
-11
lines changed

‎articles/active-directory-b2c/TOC.yml

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -488,15 +488,12 @@
488488
- name: 7 - Make HTTP call from custom policy
489489
href: custom-policies-series-call-rest-api.md
490490
displayName: call rest api, http call, http request
491-
- name: 8 - Create user record custom policy
491+
- name: 8 - Create and read user record custom policy
492492
href: custom-policies-series-store-user.md
493-
displayName: CRUD, store user, create user account
494-
- name: 9 - Read or update user record custom policy
495-
href: custom-policies-series-read-update-user.md
496-
displayName: CRUD, read user, update user
497-
- name: 10 - Sign up and sign in (local account)
493+
displayName: CRUD, store user, create user account, read user, update user
494+
- name: 9 - Sign up and sign in (local account)
498495
href: custom-policies-series-sign-up-or-sign-in.md
499-
- name: 11 - Sign up and sign in (social account)
496+
- name: 10 - Sign up and sign in (social account)
500497
href: custom-policies-series-sign-up-or-sign-in-federation.md
501498
# Secure
502499
- name: Secure

‎articles/active-directory-b2c/custom-policies-series-overview.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ This how-to guide series consists of multiple articles. We recommend that you st
4141
|[Validate custom policy files by using TrustFrameworkPolicy schema](custom-policies-series-install-xml-extensions.md)| Learn how to validate your custom files against a custom policy schema. You also learn how to easily navigate your policy files by using Azure AD B2C Visual Studio Code (VS Code) extension.|
4242
|[Call a REST API by using Azure Active Directory B2C custom policy](custom-policies-series-call-rest-api.md)| Learn how to write a custom policy that integrates with your own RESTful service.|
4343
|[Create and read a user account by using Azure Active Directory B2C custom policy](custom-policies-series-store-user.md)| Learn how to store into and read user details from Azure AD storage by using Azure AD B2C custom policy. You use the Azure Active Directory technical profile.|
44-
|[Read or update a user account by using Azure Active Directory B2C custom policy](custom-policies-series-read-update-user.md)| Learn how to read or update user details in Azure AD storage by using Azure AD B2C custom policy. You use the Azure Active Directory technical profile.|
4544
|[Set up a sign-up and sign-in flow by using Azure Active Directory B2C custom policy](custom-policies-series-sign-up-or-sign-in.md). | Learn how to configure a sign-up and sign-in flow for a local account(using email and password) by using Azure Active Directory B2C custom policy. You show a user a sign-in interface for them to sign in by using their existing account, but they can create a new account if they don't already have one.|
4645
| [Set up a sign-up and sign-in flow with a social account by using Azure Active Directory B2C custom policy](custom-policies-series-sign-up-or-sign-in-federation.md) | Learn how to configure a sign-up and sign-in flow for a social account, Facebook.|
4746

‎articles/active-directory-b2c/custom-policies-series-store-user.md

Lines changed: 133 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@ You need to configure two [Azure AD Technical Profile](active-directory-technica
114114
- *Persisted claims*: The *PersistedClaims* element contains all of the values that should be stored into Azure AD storage.
115115

116116
- *InputClaims*: The *InputClaims* element contains a claim, which is used to look up an account in the directory, or create a new one. There must be exactly one input claim element in the input claims collection for all Azure AD technical profiles. This technical profile uses the *email* claim, as the key identifier for the user account. Learn more about [other key identifiers you can use uniquely identify a user account](active-directory-technical-profile.md#inputclaims).
117+
117118

118119
1. In the `ContosoCustomPolicy.XML` file, locate the `AAD-UserWrite` technical profile, and then add a new technical profile after it by using the following code:
119120

@@ -248,7 +249,7 @@ Since we don't store the `message` claim, in orchestration step `5`, we execute
248249

249250
Follow the steps in [Upload custom policy file](custom-policies-series-hello-world.md#step-3---upload-custom-policy-file) to upload your policy file. If you're uploading a file with same name as the one already in the portal, make sure you select **Overwrite the custom policy if it already exists**.
250251

251-
## Step 6 - Test policy
252+
## Step 7 - Test policy
252253

253254
Follow the steps in [Test the custom policy](custom-policies-series-validate-user-input.md#step-6---test-the-custom-policy) to test your custom policy.
254255

@@ -280,9 +281,138 @@ Test your custom policy again by using the same **Email Address**. Instead of th
280281
> [!NOTE]
281282
> The *password* claim value is a very important piece of information, so be very careful how you handle it in your custom policy. For a similar reason, Azure AD B2C treats the password claim value as a special value. When you collect the password claim value in the self-asserted technical profile, that value is only available within the same technical profile or within a validation technical profiles that are referenced by that same self-asserted technical profile. Once execution of that self-asserted technical profile completes, and moves to another technical profile, the value is lost.
282283
283-
## Validate user email
284+
## Verify user email
285+
286+
We recommend that you verify a user's email before you use it to create a user account. When you verify email addresses, you make sure the accounts are created by real users. You also help users to be sure that they're using their correct email addresses to create an account.
287+
288+
Azure AD B2C's custom policy provides a way to verify email address using [verification display control](display-control-verification.md). You send a verification code to the email. After the code has been sent, the user reads the message, enters the verification code into the control provided by the display control, and selects **Verify Code** button.
289+
290+
A display control is a user interface element that has special functionality and interacts with the Azure Active Directory B2C (Azure AD B2C) back-end service. It allows the user to perform actions on the page that invoke a validation technical profile at the back end. Display controls are displayed on the page and are referenced by a self-asserted technical profile.
291+
292+
To add email verification by using a display control, use the following steps:
293+
294+
### Declare claim
295+
296+
You need to declare a claim to be used to hold the verifications code.
297+
298+
To declare the claim, in the `ContosoCustomPolicy.XML` file, locate the `ClaimsSchema` element and declare `verificationCode` claim by using the following code:
299+
300+
```xml
301+
<!--<ClaimsSchema>-->
302+
...
303+
<ClaimType Id="verificationCode">
304+
<DisplayName>Verification Code</DisplayName>
305+
<DataType>string</DataType>
306+
<UserHelpText>Enter your verification code</UserHelpText>
307+
<UserInputType>TextBox</UserInputType>
308+
</ClaimType>
309+
<!--</ClaimsSchema>-->
310+
```
311+
312+
### Configure a send and verify code technical profile
313+
314+
Azure AD B2C uses [Azure AD SSPR technical profile](aad-sspr-technical-profile.md) to verify an email address. This technical profile can generate and send a code to an email address or verifies the code depending on how you configure it.
315+
316+
In the `ContosoCustomPolicy.XML` file, locate the `ClaimsProviders` element and add the a claims provider by using the following code:
317+
318+
```xml
319+
<ClaimsProvider>
320+
<DisplayName>Azure AD self-service password reset (SSPR)</DisplayName>
321+
<TechnicalProfiles>
322+
<TechnicalProfile Id="AadSspr-SendCode">
323+
<DisplayName>Send Code</DisplayName>
324+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AadSsprProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
325+
<Metadata>
326+
<Item Key="Operation">SendCode</Item>
327+
</Metadata>
328+
<InputClaims>
329+
<InputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailAddress" />
330+
</InputClaims>
331+
</TechnicalProfile>
332+
<TechnicalProfile Id="AadSspr-VerifyCode">
333+
<DisplayName>Verify Code</DisplayName>
334+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AadSsprProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
335+
<Metadata>
336+
<Item Key="Operation">VerifyCode</Item>
337+
</Metadata>
338+
<InputClaims>
339+
<InputClaim ClaimTypeReferenceId="verificationCode" />
340+
<InputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailAddress" />
341+
</InputClaims>
342+
</TechnicalProfile>
343+
</TechnicalProfiles>
344+
</ClaimsProvider>
345+
```
346+
347+
We've configured two technical profiles `AadSspr-SendCode` and `AadSspr-VerifyCode`. `AadSspr-SendCode` generates and sends a code to the email address address specified in the `InputClaims` section whereas `AadSspr-VerifyCode` verifies the code. You specify the action you want to perform in th technical profile's metadata.
348+
349+
### Configure a display control
350+
351+
You need to configure an email verification display control to be able to verify users email. The email verification display control you configure will replace the email display claim that you use to collect an email from the user.
352+
353+
To configure a display control, use the following steps:
354+
355+
1. In the `ContosoCustomPolicy.XML` file, locate the `BuildingBlocks` section, and then add a display control as a child element by using the following code:
356+
357+
```xml
358+
<!--<BuildingBlocks>-->
359+
....
360+
<DisplayControls>
361+
<DisplayControl Id="emailVerificationControl" UserInterfaceControlType="VerificationControl">
362+
<DisplayClaims>
363+
<DisplayClaim ClaimTypeReferenceId="email" Required="true" />
364+
<DisplayClaim ClaimTypeReferenceId="verificationCode" ControlClaimType="VerificationCode" Required="true" />
365+
</DisplayClaims>
366+
<OutputClaims></OutputClaims>
367+
<Actions>
368+
<Action Id="SendCode">
369+
<ValidationClaimsExchange>
370+
<ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AadSspr-SendCode" />
371+
</ValidationClaimsExchange>
372+
</Action>
373+
<Action Id="VerifyCode">
374+
<ValidationClaimsExchange>
375+
<ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AadSspr-VerifyCode" />
376+
</ValidationClaimsExchange>
377+
</Action>
378+
</Actions>
379+
</DisplayControl>
380+
</DisplayControls>
381+
<!--</BuildingBlocks>-->
382+
```
383+
384+
We've declared a display control, `emailVerificationControl`. Take note of the following important parts:
385+
386+
- *DisplayClaims* - Just like in a self-asserted technical profile, this section specifies a collection of claims to be collected from the user within the display control.
387+
388+
- *Actions* - Specifies the order of actions to be performed by the display control. Each action references a technical profile that responsible to perform the actions. For example, the *SendCode* references the `AadSspr-SendCode` technical profile, which generates and sends a code to an email address.
389+
390+
1. In the `ContosoCustomPolicy.XML` file, locate the `UserInformationCollector` self-asserted technical profile and replace the *email* display claim to `emailVerificationControl` display control:
391+
392+
From:
393+
394+
```xml
395+
<DisplayClaim ClaimTypeReferenceId="email" Required="true"/>
396+
```
397+
398+
To:
399+
400+
```xml
401+
<DisplayClaim DisplayControlReferenceId="emailVerificationControl" />
402+
```
403+
404+
1. Use the the procedure in [step 6](#step-6---upload-policy) and [step 7](#step-7---test-policy) to upload you policy file, and test it. This time, you must verify your email address before a user account is created.
405+
406+
## Update user account by using Azure AD technical profile
407+
408+
You can configure a Azure AD technical profile to update a user account instead of attempting to create a new one. To do so, set the Azure AD technical profile to throw an error if the specified user account doesn't already exist in the `Metadata` collection by using the following code. The *Operation* needs to be set to *Write*:
409+
410+
```xml
411+
<!--<Item Key="Operation">Write</Item>-->
412+
<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
413+
```
284414

285-
## Handle custom attributes
415+
## Use custom attributes
286416

287417
In this article, you've learnt how to store user details using [built-in User profile attributes](user-profile-attributes.md). However, you often need to create your own custom attributes to manage your specific scenario. To do so, follow the instructions in [Define custom attributes in Azure Active Directory B2C](user-flow-custom-attributes.md) article.
288418

0 commit comments

Comments
 (0)