Skip to content

Commit 6450644

Browse files
davortsandavortsan
authored
Add files via upload
v1.0
1 parent ff5309b commit 6450644

File tree

3 files changed

+263
-0
lines changed

3 files changed

+263
-0
lines changed

‎policies/pwd-reset-excluding-domains/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Password reset excluding specific domains
2+
<b>Disable password reset policy to specific domain</b>
3+
<p>Perhaps you need to exclude uses with and specific domain to reset their passwords. In this example, users with <b>domainnametoexclude.com</b> in their mails will not be able to reset the password.</p>

‎policies/pwd-reset-excluding-domains/policies/PasswordReset.xml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<TrustFrameworkPolicy
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
5+
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
6+
PolicySchemaVersion="0.3.0.0"
7+
TenantId="your_tenant.onmicrosoft.com"
8+
PolicyId="B2C_1A_PasswordReset"
9+
PublicPolicyUri="http://your_tenant.onmicrosoft.com/B2C_1A_PasswordReset">
10+
11+
<BasePolicy>
12+
<TenantId>your_tenant.onmicrosoft.com</TenantId>
13+
<PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
14+
</BasePolicy>
15+
16+
<RelyingParty>
17+
<DefaultUserJourney ReferenceId="PasswordResetWithDomain" />
18+
<TechnicalProfile Id="PolicyProfile">
19+
<DisplayName>PolicyProfile</DisplayName>
20+
<Protocol Name="OpenIdConnect" />
21+
<OutputClaims>
22+
<OutputClaim ClaimTypeReferenceId="email" />
23+
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
24+
<OutputClaim ClaimTypeReferenceId="theDomain" />
25+
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
26+
</OutputClaims>
27+
<SubjectNamingInfo ClaimType="sub" />
28+
</TechnicalProfile>
29+
</RelyingParty>
30+
</TrustFrameworkPolicy>
31+
32+

‎policies/pwd-reset-excluding-domains/policies/TrustFrameworkExtensions.xml‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<TrustFrameworkPolicy
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
5+
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
6+
PolicySchemaVersion="0.3.0.0"
7+
TenantId="your_tenant.onmicrosoft.com"
8+
PolicyId="B2C_1A_TrustFrameworkExtensions"
9+
PublicPolicyUri="http://your_tenant.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions">
10+
11+
<BasePolicy>
12+
<TenantId>your_tenant.onmicrosoft.com</TenantId>
13+
<PolicyId>B2C_1A_TrustFrameworkLocalization</PolicyId>
14+
</BasePolicy>
15+
16+
<BuildingBlocks>
17+
18+
<ClaimsSchema>
19+
20+
<ClaimType Id="theDomain">
21+
<DisplayName>Indicates if the email below to the specific partner domain</DisplayName>
22+
<DataType>boolean</DataType>
23+
</ClaimType>
24+
25+
<ClaimType Id="errorMessage">
26+
<DisplayName>Error message</DisplayName>
27+
<DataType>string</DataType>
28+
</ClaimType>
29+
30+
<ClaimType Id="errorCode">
31+
<DisplayName>Error code</DisplayName>
32+
<DataType>string</DataType>
33+
</ClaimType>
34+
35+
</ClaimsSchema>
36+
37+
<ClaimsTransformations>
38+
39+
<ClaimsTransformation Id="CheckDomain" TransformationMethod="StringContains">
40+
<InputClaims>
41+
<InputClaim ClaimTypeReferenceId="signInNames.emailAddress" TransformationClaimType="inputClaim"/>
42+
</InputClaims>
43+
<InputParameters>
44+
<InputParameter Id="contains" DataType="string" Value="DomainNameToExclude"/>
45+
<InputParameter Id="ignoreCase" DataType="string" Value="true"/>
46+
</InputParameters>
47+
<OutputClaims>
48+
<OutputClaim ClaimTypeReferenceId="theDomain" TransformationClaimType="outputClaim"/>
49+
</OutputClaims>
50+
</ClaimsTransformation>
51+
52+
<ClaimsTransformation Id="GenerateErrorCode" TransformationMethod="CreateStringClaim">
53+
<InputParameters>
54+
<InputParameter Id="value" DataType="string" Value="Error_001" />
55+
</InputParameters>
56+
<OutputClaims>
57+
<OutputClaim ClaimTypeReferenceId="errorCode" TransformationClaimType="createdClaim" />
58+
</OutputClaims>
59+
</ClaimsTransformation>
60+
61+
<ClaimsTransformation Id="GenerateErrorMessage" TransformationMethod="CreateStringClaim">
62+
<InputParameters>
63+
<InputParameter Id="value" DataType="string" Value="You cannot reset your password." />
64+
</InputParameters>
65+
<OutputClaims>
66+
<OutputClaim ClaimTypeReferenceId="errorMessage" TransformationClaimType="createdClaim" />
67+
</OutputClaims>
68+
</ClaimsTransformation>
69+
70+
</ClaimsTransformations>
71+
72+
</BuildingBlocks>
73+
74+
<ClaimsProviders>
75+
76+
<ClaimsProvider>
77+
<DisplayName>Facebook</DisplayName>
78+
<TechnicalProfiles>
79+
<TechnicalProfile Id="Facebook-OAUTH">
80+
<Metadata>
81+
<Item Key="client_id">facebook_clientid</Item>
82+
<Item Key="scope">email public_profile</Item>
83+
<Item Key="ClaimsEndpoint">https://graph.facebook.com/me?fields=id,first_name,last_name,name,email</Item>
84+
</Metadata>
85+
</TechnicalProfile>
86+
</TechnicalProfiles>
87+
</ClaimsProvider>
88+
89+
90+
<ClaimsProvider>
91+
<DisplayName>Local Account SignIn</DisplayName>
92+
<TechnicalProfiles>
93+
<TechnicalProfile Id="login-NonInteractive">
94+
<Metadata>
95+
<Item Key="client_id">ProxyIdentityExperienceFrameworkAppId</Item>
96+
<Item Key="IdTokenAudience">IdentityExperienceFrameworkAppId</Item>
97+
</Metadata>
98+
<InputClaims>
99+
<InputClaim ClaimTypeReferenceId="client_id" DefaultValue="ProxyIdentityExperienceFrameworkAppId" />
100+
<InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="IdentityExperienceFrameworkAppId" />
101+
</InputClaims>
102+
</TechnicalProfile>
103+
</TechnicalProfiles>
104+
</ClaimsProvider>
105+
106+
<ClaimsProvider>
107+
<DisplayName>Local Account</DisplayName>
108+
<TechnicalProfiles>
109+
<TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddressCustom">
110+
<DisplayName>Reset password using email address</DisplayName>
111+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
112+
<Metadata>
113+
<Item Key="IpAddressClaimReferenceId">IpAddress</Item>
114+
<Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
115+
</Metadata>
116+
<CryptographicKeys>
117+
<Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
118+
</CryptographicKeys>
119+
<IncludeInSso>false</IncludeInSso>
120+
<OutputClaims>
121+
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
122+
<OutputClaim ClaimTypeReferenceId="objectId" />
123+
<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
124+
<OutputClaim ClaimTypeReferenceId="authenticationSource" />
125+
<OutputClaim ClaimTypeReferenceId="theDomain" />
126+
</OutputClaims>
127+
<ValidationTechnicalProfiles>
128+
<ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddressCustom" />
129+
</ValidationTechnicalProfiles>
130+
</TechnicalProfile>
131+
</TechnicalProfiles>
132+
</ClaimsProvider>
133+
134+
<ClaimsProvider>
135+
<DisplayName>Azure Active Directory</DisplayName>
136+
<TechnicalProfiles>
137+
<TechnicalProfile Id="AAD-UserReadUsingEmailAddressCustom">
138+
<Metadata>
139+
<Item Key="Operation">Read</Item>
140+
<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
141+
</Metadata>
142+
<IncludeInSso>false</IncludeInSso>
143+
<InputClaims>
144+
<InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
145+
</InputClaims>
146+
<OutputClaims>
147+
<!-- Required claims -->
148+
<OutputClaim ClaimTypeReferenceId="objectId" />
149+
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
150+
151+
<!-- Optional claims -->
152+
<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
153+
<OutputClaim ClaimTypeReferenceId="displayName" />
154+
<OutputClaim ClaimTypeReferenceId="accountEnabled" />
155+
<OutputClaim ClaimTypeReferenceId="otherMails" />
156+
<OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
157+
</OutputClaims>
158+
<OutputClaimsTransformations>
159+
<OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
160+
<OutputClaimsTransformation ReferenceId="CheckDomain" />
161+
</OutputClaimsTransformations>
162+
<IncludeTechnicalProfile ReferenceId="AAD-Common" />
163+
</TechnicalProfile>
164+
</TechnicalProfiles>
165+
</ClaimsProvider>
166+
167+
<ClaimsProvider>
168+
<DisplayName>Token Issuer</DisplayName>
169+
<TechnicalProfiles>
170+
<TechnicalProfile Id="ReturnOAuth2Error">
171+
<DisplayName>Return OAuth2 error</DisplayName>
172+
<Protocol Name="OAuth2" />
173+
<OutputTokenFormat>OAuth2Error</OutputTokenFormat>
174+
<CryptographicKeys>
175+
<Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
176+
</CryptographicKeys>
177+
<InputClaims>
178+
<InputClaim ClaimTypeReferenceId="errorCode" />
179+
<InputClaim ClaimTypeReferenceId="errorMessage" />
180+
</InputClaims>
181+
<OutputClaimsTransformations>
182+
<OutputClaimsTransformation ReferenceId="GenerateErrorCode" />
183+
<OutputClaimsTransformation ReferenceId="GenerateErrorMessage" />
184+
</OutputClaimsTransformations>
185+
</TechnicalProfile>
186+
</TechnicalProfiles>
187+
</ClaimsProvider>
188+
189+
</ClaimsProviders>
190+
191+
<UserJourneys>
192+
193+
<UserJourney Id="PasswordResetWithDomain" DefaultCpimIssuerTechnicalProfileReferenceId="JwtIssuer">
194+
<OrchestrationSteps>
195+
<OrchestrationStep Order="1" Type="ClaimsExchange">
196+
<ClaimsExchanges>
197+
<ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddressCustom" />
198+
</ClaimsExchanges>
199+
</OrchestrationStep>
200+
<OrchestrationStep Order="2" Type="ClaimsExchange">
201+
<Preconditions>
202+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
203+
<Value>theDomain</Value>
204+
<Value>true</Value>
205+
<Action>SkipThisOrchestrationStep</Action>
206+
</Precondition>
207+
</Preconditions>
208+
<ClaimsExchanges>
209+
<ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
210+
</ClaimsExchanges>
211+
</OrchestrationStep>
212+
<OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="ReturnOAuth2Error">
213+
<Preconditions>
214+
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
215+
<Value>theDomain</Value>
216+
<Value>false</Value>
217+
<Action>SkipThisOrchestrationStep</Action>
218+
</Precondition>
219+
</Preconditions>
220+
</OrchestrationStep>
221+
<OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
222+
</OrchestrationSteps>
223+
<ClientDefinition ReferenceId="DefaultWeb" />
224+
</UserJourney>
225+
226+
</UserJourneys>
227+
228+
</TrustFrameworkPolicy>

0 commit comments

Comments
 (0)