Password Reset Redirects to "Sign In Failed" page

(0) Share

Report

Posted on by Bryant Boyer

106

Hey all,

I've configured my Power Apps portal to use Azure B2C for external authentication. Everything works great except for this one piece. When a user resets their password they are redirected to .../Account/Login/ExternalAuthenticationFailed with this error:

If they click "Sign in" and use their newly reset password, they authenticate correctly. What that means is that the password reset flow is resetting their password correctly, but just redirecting the user to an error page. How can I change this user experience?

Note: I set up the Azure AD B2C using the wizard at make.preview.powerapps.com so I haven't manually configured any settings.

Categories:

Power Apps portals

I have the same question (0)

All responses (16)

Answers (1)

Christian Leverenz 1,214 on at

Like (1)

Report

Hi FlowHawk,
not sure, but could it be that changing the password does not delete the authentcationcookie for the B2C Site and an outdated token is used for logging in? I think, an id token is passed to the portal and if the portal checks that one for validity and it fails, because its old/invalid.
Have you tried to clear all cookies for the b2c provider after a password change? This would force the user to log in again, which makes a kind of sense to me.
If this works, may be AzureB2C password change flow is to be configured either to clear the session or to update all issued id tokes (what would mean that there is an error, if it doesn't 🙂 )
So, just ideas and no clear hint.
Hope it helps a little bit,
Christian

Was this reply helpful? Yes No
Bryant Boyer 106 on at

Like (0)

Report

That's an interesting thought. I appreciate the point. I'm just not savvy enough to know what to do with the information haha. I did go into the B2C settings and tinker with the tokens, claims, logout urls, etc... and no dice. But I suspect what is conceptually occurring is exactly as you have said.

Was this reply helpful? Yes No
oliver.rodrigues 9,368 Most Valuable Professional on at

Like (0)

Report

Hi, this is an old and a bit more manual article, but still super valid for you to understand the site settings involved: https://readyxrm.blog/2019/07/24/configure-azure-ad-b2c-for-powerapps-portals/

can you please take a look to see if your site settings are correct?

also, are you using custom policies on Azure AD B2C? or standard user flows?

Was this reply helpful? Yes No
Bryant Boyer 106 on at

Like (0)

Report

Thanks @OliverRodrigues. I reviewed the article and checked each property in the B2C user flows and in the portal -- they all matched. I couldn't see anything different. I'm curious, do this issue sound like a B2C problem? Or a portal problem?

I'm using standard user flows from Azure B2C. They were set up using the make.preview.powerapps.com B2C wizard.

Was this reply helpful? Yes No
Bryant Boyer 106 on at

Like (0)

Report

For further information, I created a developer tenant, created a new azure subscription, created a new resource, created a new Power Apps portal, went to make.preview.powerapps.com, configured Azure B2C as an authentication provider (creating new signupsignin and password reset user flows during the wizard), set Azure B2C as the default identity provider, sync the changes, opened my portal and created an account, then signed out and attempted to reset my password. I was forwarded to the same error page.

At this point I'm not convinced that this works for anyone else out of the box. Can someone confirm?

Was this reply helpful? Yes No
oliver.rodrigues 9,368 Most Valuable Professional on at

Like (0)

Report

Sorry about the delay, I performed the same task as you are doing a few months ago and worked fine.

Unless something has changed, this should work.

Can you share a few snapshots of your Azure user flow (properties / application claims)?

Was this reply helpful? Yes No
Bryant Boyer 106 on at

Like (0)

Report

Here are some screenshots. This is all in the developer tenant where I didn't make any customizations:

Was this reply helpful? Yes No
Verified answer

oliver.rodrigues 9,368 Most Valuable Professional on at

Like (1)

Report
Thanks for the snapshots.. try the follwoing changes:

App Registration > Authentication

add another Redirect URI, with just the Portal URL

enable ID Tokens for implicit grant

SignUpSignIn > Properties

those look fine to me

SignUpSignIn > User Attributes / Application Claims

I normally also enable Surname/Given Name, but that's optional

Reset Password > Properties

Issuer claim doesn't seem right to me, can you select the other (non-TFP) option from the drop-down (but keep TFP selected in the toggles there):

Reset Password > Application Claims

In my environment I only have selected Given Name/Surname, but I don't think this would make any difference

Portal Configuration > Valid Issuers

Here you need both Issuer URL for your Sign Up Sign In + Reset Pwd flows, the article above I shared explains how to retrieve those URLs

hope this helps

Was this reply helpful? Yes No
Bryant Boyer 106 on at

Like (1)

Report

Thank you Oliver!! I applied all the changes except the claims ones and it worked!!

I don't know if anyone from the product team is here in the forum, but it would be helpful feedback I think that the wizard in the make.preview.powerapps.com sets up the issuer incorrectly for password reset flows.

Thanks again Oliver, you rock!

Was this reply helpful? Yes No
oliver.rodrigues 9,368 Most Valuable Professional on at

Like (1)

Report

I am glad it worked

@justinburch would you be able to let the product team aware of this possible issue?

Was this reply helpful? Yes No