You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Troubleshoot custom policies in Azure Active Directory B2C | Microsoft Docs
2
+
title: Troubleshoot custom policies in Azure Active Directory B2C
3
3
description: Learn about approaches to solving errors when working with custom policies in Azure Active Directory B2C.
4
4
services: active-directory-b2c
5
5
author: mmacy
@@ -8,66 +8,74 @@ manager: celestedg
8
8
ms.service: active-directory
9
9
ms.workload: identity
10
10
ms.topic: conceptual
11
-
ms.date: 05/07/2017
11
+
ms.date: 08/13/2019
12
12
ms.author: marsma
13
13
ms.subservice: B2C
14
14
---
15
15
16
16
# Troubleshoot Azure AD B2C custom policies and Identity Experience Framework
17
17
18
-
If you use Azure Active Directory B2C (Azure AD B2C) custom policies, you might experience challenges setting up the Identity Experience Framework in its policy language XML format. Learning to write custom policies can be like learning a new language. In this article, we describe tools and tips that can help you quickly discover and resolve issues.
18
+
If you use Azure Active Directory B2C (Azure AD B2C) custom policies, you might experience challenges setting up the Identity Experience Framework in its policy language XML format. Learning to write custom policies can be like learning a new language. In this article, we describe some tools and tips that can help you discover and resolve issues.
19
19
20
-
> [!NOTE]
21
-
> This article focuses on troubleshooting your Azure AD B2C custom policy configuration. It doesn't address the relying party application or its identity library.
20
+
This article focuses on troubleshooting your Azure AD B2C custom policy configuration. It doesn't address the relying party application or its identity library.
22
21
23
22
## XML editing
24
23
25
-
The most common error in setting up custom policies is improperly formatted XML. A good XML editor is nearly essential. A good XML editor displays XML natively, color-codes content, prefills common terms, keeps XML elements indexed, and can validate with schema. Here are two of our favorite XML editors:
24
+
The most common error in setting up custom policies is improperly formatted XML. A good XML editor is nearly essential. It displays XML natively, color-codes content, pre-fills common terms, keeps XML elements indexed, and can validate against an XML schema.
26
25
27
-
*[Visual Studio Code](https://code.visualstudio.com/)
28
-
*[Notepad++](https://notepad-plus-plus.org/)
26
+
Two of our favorite editors are [Visual Studio Code](https://code.visualstudio.com/) and [Notepad++](https://notepad-plus-plus.org/).
29
27
30
-
XML schema validation identifies errors before you upload your XML file. In the root folder of the starter pack, get the XML schema definition TrustFrameworkPolicy_0.3.0.0.xsd. For more information, in the documentation of your XML editor, look for *XML tools* and *XML validation*.
28
+
XML schema validation identifies errors before you upload your XML file. In the root folder of the [starter pack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack), get the XML schema definition file *TrustFrameworkPolicy_0.3.0.0.xsd*. To find out how to use the XSD schema file for validation in your editor, look for *XML tools* and *XML validation* or similar in the editor's documentation.
31
29
32
30
You might find a review of XML rules helpful. Azure AD B2C rejects any XML formatting errors that it detects. Occasionally, incorrectly formatted XML might cause error messages that are misleading.
33
31
34
32
## Upload policies and policy validation
35
33
36
-
XML file upload validation is automatic. Most errors cause the upload to fail. Validation includes the policy file that you are uploading. It also includes the chain of files the upload file refers to (the relying party policy file, the extensions file, and the base file).
37
-
38
-
Common validation errors include the following.
34
+
Validation of the XML policy file is performed automatically on upload. Most errors cause the upload to fail. Validation includes the policy file that you are uploading. It also includes the chain of files the upload file refers to (the relying party policy file, the extensions file, and the base file).
35
+
36
+
Common validation errors include the following:
37
+
38
+
> Error snippet: `...makes a reference to ClaimType with id "displayName" but neither the policy nor any of its base policies contain such an element`
39
39
40
-
Error snippet: `... makes a reference to ClaimType with id "displaName" but neither the policy nor any of its base policies contain such an element`
41
40
* The ClaimType value might be misspelled, or does not exist in the schema.
42
-
* ClaimType values must be defined in at least one of the files in the policy.
43
-
For example: `<ClaimType Id="socialIdpUserId">`
41
+
* ClaimType values must be defined in at least one of the files in the policy.
42
+
For example: `<ClaimType Id="issuerUserId">`
44
43
* If ClaimType is defined in the extensions file, but it's also used in a TechnicalProfile value in the base file, uploading the base file results in an error.
45
44
46
-
Error snippet: `...makes a reference to a ClaimsTransformation with id...`
47
-
* The causes for the error might be the same as for the ClaimType error.
45
+
> Error snippet: `...makes a reference to a ClaimsTransformation with id...`
46
+
47
+
* The causes for this error can be the same as for the ClaimType error.
48
+
49
+
> Error snippet: `Reason: User is currently logged as a user of 'yourtenant.onmicrosoft.com' tenant. In order to manage 'yourtenant.onmicrosoft.com', please login as a user of 'yourtenant.onmicrosoft.com' tenant`
48
50
49
-
Error snippet: `Reason: User is currently logged as a user of 'yourtenant.onmicrosoft.com' tenant. In order to manage 'yourtenant.onmicrosoft.com', please login as a user of 'yourtenant.onmicrosoft.com' tenant`
50
-
* Check that the TenantId value in the **\<TrustFrameworkPolicy\>** and **\<BasePolicy\>** elements match your target Azure AD B2C tenant.
51
+
* Check that the TenantId value in the `<TrustFrameworkPolicy\>` and `<BasePolicy\>` elements match your target Azure AD B2C tenant.
51
52
52
53
## Troubleshoot the runtime
53
54
54
-
* Use `Run Now` and `https://jwt.io` to test your policies independently of your web or mobile application. This website acts like a relying party application. It displays the contents of the JSON Web Token (JWT) that is generated by your Azure AD B2C policy. To create a test application in Identity Experience Framework, use the following values:
55
-
* Name: TestApp
56
-
* Web App/Web API: No
57
-
* Native client: No
55
+
* Use **Run now** and `https://jwt.ms` to test your policies independently of your web or mobile application. This website acts like a relying party application. It displays the contents of the JSON Web Token (JWT) that is generated by your Azure AD B2C policy. To create a test application, navigate to **Azure AD B2C**\>**Applications** in the Azure portal and add an application with the following values:
56
+
57
+
***Name**: TestApp
58
+
***Web App/Web API**: No
59
+
***Native client**: No
60
+
61
+
Then, add `https://jwt.ms` as a **Reply URL**.
58
62
59
63
* To trace the exchange of messages between your client browser and Azure AD B2C, use [Fiddler](https://www.telerik.com/fiddler). It can help you get an indication of where your user journey is failing in your orchestration steps.
60
64
61
-
* In **Development mode**, use **Application Insights** to trace the activity of your Identity Experience Framework user journey. In **Development mode**, you can observe the exchange of claims between the Identity Experience Framework and the various claims providers that are defined by technical profiles, such as identity providers, API-based services, the Azure AD B2C user directory, and other services, like Azure Multi-Factor-Authentication.
65
+
* In **Development mode**, use [Application Insights](active-directory-b2c-troubleshoot-custom.md) to trace the activity of your Identity Experience Framework user journey. In **Development mode**, you can observe the exchange of claims between the Identity Experience Framework and the various claims providers that are defined by technical profiles, such as identity providers, API-based services, the Azure AD B2C user directory, and other services, like Azure Multi-FactorAuthentication.
62
66
63
67
## Recommended practices
64
68
65
-
**Keep multiple versions of your scenarios. Group them in a project with your application.** The base, extensions, and relying party files are directly dependent on each other. Save them as a group. As new features are added to your policies, keep separate working versions. Stage working versions in your own file system with the application code they interact with. Your applications might invoke many different relying party policies in a tenant. They might become dependent on the claims that they expect from your Azure AD B2C policies.
69
+
**Keep multiple versions of your scenarios. Group them in a project with your application.** The base, extensions, and relying party files are directly dependent on each other. Save them as a group. As new features are added to your policies, keep separate working versions. Stage working versions in your own file system with the application code they interact with. Your applications might invoke many different relying party policies in a tenant. They might become dependent on the claims that they expect from your Azure AD B2C policies.
66
70
67
71
**Develop and test technical profiles with known user journeys.** Use tested starter pack policies to set up your technical profiles. Test them separately before you incorporate them into your own user journeys.
68
72
69
73
**Develop and test user journeys with tested technical profiles.** Change the orchestration steps of a user journey incrementally. Progressively build your intended scenarios.
70
74
71
75
## Next steps
72
76
73
-
* In GitHub, download the [active-directory-b2c-custom-policy-starterpack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/archive/master.zip) .zip file.
77
+
Available on GitHub, download the [active-directory-b2c-custom-policy-starterpack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/archive/master.zip) .zip archive. You can also clone the repository:
0 commit comments