You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Complete the steps in [Get started with custom policies](custom-policy-get-started.md). You should have a working custom policy for sign-up and sign-in with social and local accounts.
24
+
25
+
## Add the metadata to the self-asserted technical profile
26
+
27
+
The **LocalAccountSignUpWithLogonEmail** technical profile is a [self-asserted](self-asserted-technical-profile.md), which is invoked during the sign-up flow. To disable the email verification, set the `EnforceEmailVerification` metadata to false. Override the LocalAccountSignUpWithLogonEmail technical profiles in the extension file. Find the `ClaimsProviders` element. Add the following claims provider to the `ClaimsProviders` element:
1. Sign in to the [Azure portal](https://portal.azure.com).
46
+
2. Make sure you're using the directory that contains your Azure AD tenant by selecting the **Directory + subscription** filter in the top menu and choosing the directory that contains your Azure AD tenant.
47
+
3. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **App registrations**.
48
+
4. Select **Identity Experience Framework**.
49
+
5. Select **Upload Custom Policy**, and then upload the two policy files that you changed.
50
+
2. Select the sign-up or sign-in policy that you uploaded, and click the **Run now** button.
51
+
3. You should be able to sign up using an email address without the validation.
52
+
53
+
54
+
## Next steps
55
+
56
+
- Learn more about the [self-asserted technical profile](self-asserted-technical-profile.md) in the IEF reference.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/custom-policy-password-complexity.md
+81-59Lines changed: 81 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ manager: celestedg
9
9
ms.service: active-directory
10
10
ms.workload: identity
11
11
ms.topic: conceptual
12
-
ms.date: 12/13/2018
12
+
ms.date: 03/10/2020
13
13
ms.author: mimart
14
14
ms.subservice: B2C
15
15
---
@@ -22,109 +22,131 @@ In Azure Active Directory B2C (Azure AD B2C), you can configure the complexity r
22
22
23
23
## Prerequisites
24
24
25
-
Complete the steps in [Get started with custom policies in Active Directory B2C](custom-policy-get-started.md).
25
+
Complete the steps in [Get started with custom policies](custom-policy-get-started.md). You should have a working custom policy for sign-up and sign-in with local accounts.
26
+
26
27
27
28
## Add the elements
28
29
29
-
1. Copy the *SignUpOrSignIn.xml* file that you downloaded with the starter pack and name it *SingUpOrSignInPasswordComplexity.xml*.
30
-
2. Open the *SingUpOrSignInPasswordComplexity.xml* file and change the **PolicyId** and the **PublicPolicyUri** to a new policy name. For example, *B2C_1A_signup_signin_password_complexity*.
31
-
3. Add the following **ClaimType** elements with identifiers of `newPassword` and `reenterPassword`:
30
+
To configure the password complexity, override the `newPassword` and `reenterPassword`[claim types](claimsschema.md) with a reference to [predicate validations](predicates.md#predicatevalidations). The PredicateValidations element groups a set of predicates to form a user input validation that can be applied to a claim type. Open the extensions file of your policy. For example, <em>`SocialAndLocalAccounts/`**`TrustFrameworkExtensions.xml`**</em>.
31
+
32
+
1. Search for the [BuildingBlocks](buildingblocks.md) element. If the element doesn't exist, add it.
33
+
1. Locate the [ClaimsSchema](claimsschema.md) element. If the element doesn't exist, add it.
34
+
1. Add the `newPassword` and `reenterPassword` claims to the **ClaimsSchema** element.
4. [Predicates](predicates.md) have method types of `IsLengthRange` or `MatchesRegex`. The `MatchesRegex` type is used to match a regular expression. The `IsLengthRange` type takes a minimum and maximum string length. Add a **Predicates** element to the **BuildingBlocks** element if it doesn't exist with the following **Predicate** elements:
45
+
1. [Predicates](predicates.md) defines a basic validation to check the value of a claim type and returns true or false. The validation is done by using a specified method element, and a set of parameters relevant to the method. Add the following predicates to the **BuildingBlocks** element, immediately after the closing of the `</ClaimsSchema>` element:
45
46
46
47
```XML
47
48
<Predicates>
48
-
<PredicateId="PIN"Method="MatchesRegex"HelpText="The password must be a pin.">
49
+
<PredicateId="LengthRange"Method="IsLengthRange">
50
+
<UserHelpText>The password must be between 6 and 64 characters.</UserHelpText>
5. Each **InputValidation** element is constructed by using the defined **Predicate** elements. This element allows you to perform boolean aggregations that are similar to `and` and `or`. Add an **InputValidations** element to the **BuildingBlocks** element if it doesn't exist with the following **InputValidation** element:
83
+
1. Add the following predicate validations to the **BuildingBlocks** element, immediately after the closing of the `</Predicates>` element:
<PredicateReferencesId="3of4"MatchAtLeast="3"HelpText="You must have at least 3 of the following character classes:">
71
-
<PredicateReferenceId="Lowercase" />
72
-
<PredicateReferenceId="Uppercase" />
73
-
<PredicateReferenceId="Number" />
74
-
<PredicateReferenceId="Symbol" />
75
-
</PredicateReferences>
76
-
</InputValidation>
77
-
</InputValidations>
86
+
<PredicateValidations>
87
+
<PredicateValidationId="CustomPassword">
88
+
<PredicateGroups>
89
+
<PredicateGroupId="LengthGroup">
90
+
<PredicateReferencesMatchAtLeast="1">
91
+
<PredicateReferenceId="LengthRange" />
92
+
</PredicateReferences>
93
+
</PredicateGroup>
94
+
<PredicateGroupId="CharacterClasses">
95
+
<UserHelpText>The password must have at least 3 of the following:</UserHelpText>
96
+
<PredicateReferencesMatchAtLeast="3">
97
+
<PredicateReferenceId="Lowercase" />
98
+
<PredicateReferenceId="Uppercase" />
99
+
<PredicateReferenceId="Number" />
100
+
<PredicateReferenceId="Symbol" />
101
+
</PredicateReferences>
102
+
</PredicateGroup>
103
+
</PredicateGroups>
104
+
</PredicateValidation>
105
+
</PredicateValidations>
78
106
```
79
107
80
-
6. Make sure that the **PolicyProfile** technical profile contains the following elements:
108
+
1. The following technical profiles are [Active Directory technical profiles](active-directory-technical-profile.md), which read and write data to Azure Active Directory. Override these technical profiles in the extension file. Use `PersistedClaims` to disable the strong password policy. Find the **ClaimsProviders** element. Add the following claim providers as follows:
When testing your applications in Azure AD B2C, it can be useful to have the Azure AD B2C token returned to `https://jwt.ms` to be able to review the claims in it.
108
-
109
132
### Upload the files
110
133
111
134
1. Sign in to the [Azure portal](https://portal.azure.com/).
112
135
2. Make sure you're using the directory that contains your Azure AD B2C tenant by selecting the **Directory + subscription** filter in the top menu and choosing the directory that contains your tenant.
113
136
3. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
114
137
4. Select **Identity Experience Framework**.
115
138
5. On the Custom Policies page, click **Upload Policy**.
116
-
6. Select **Overwrite the policy if it exists**, and then search for and select the *SingUpOrSignInPasswordComplexity.xml* file.
139
+
6. Select **Overwrite the policy if it exists**, and then search for and select the *TrustFrameworkExtensions.xml* file.
117
140
7. Click **Upload**.
118
141
119
142
### Run the policy
120
143
121
-
1. Open the policy that you changed. For example, *B2C_1A_signup_signin_password_complexity*.
144
+
1. Open the sign-up or sign-in policy. For example, *B2C_1A_signup_signin*.
122
145
2. For **Application**, select your application that you previously registered. To see the token, the **Reply URL** should show `https://jwt.ms`.
123
146
3. Click **Run now**.
124
147
4. Select **Sign up now**, enter an email address, and enter a new password. Guidance is presented on password restrictions. Finish entering the user information, and then click **Create**. You should see the contents of the token that was returned.
125
148
126
149
## Next steps
127
150
128
151
- Learn how to [Configure password change using custom policies in Azure Active Directory B2C](custom-policy-password-change.md).
129
-
130
-
152
+
- - Learn more about the [Predicates](predicates.md) and [PredicateValidations](predicates.md#predicatevalidations) elements in the IEF reference.
0 commit comments