B2C SAML Authentication Integration Error.

RE: B2C SAML Authentication Integration Error.

Karikalan Ramakrishnan — Wed, 04 Aug 2021 11:36:15 GMT

Done, thanks Acacio.

RE: B2C SAML Authentication Integration Error.

Acacio Barrado — Sun, 01 Aug 2021 23:01:09 GMT

Hi Karikalan,

That is a good tip, can you could you please change the status of the thread to answered so it can help more people in the future?

Regards

Acacio B

RE: B2C SAML Authentication Integration Error.

Karikalan Ramakrishnan — Sun, 01 Aug 2021 04:19:04 GMT

"The username or password provided in the request are invalid" - This issue has been resolved by granting "IdentityExperienceFramework" (User_impersonation - Delegated Type) API permission. I could not see this solution on MS documents guidance, however this has resolved my issue. thanks.

RE: B2C SAML Authentication Integration Error.

Karikalan Ramakrishnan — Fri, 23 Jul 2021 22:18:22 GMT

Thanks Acacio, yes. It's set to None.

Also I can we dont need to assign user like B2B as shown below, SAML tracer only shows the Request not Response. I've tried registering the application both B2C Service plade and B2C Tenant AAD blade still receiving the same invalid user /pwd error. Same account has been created in B2C and Appian too. It looks more common error as discussed on docs.microsoft.com/.../unable-to-sign-on-using-custom-policy.html

RE: B2C SAML Authentication Integration Error.

Acacio Barrado — Fri, 23 Jul 2021 22:11:56 GMT

Quick question,

Is your Authentication Method set to None?

RE: B2C SAML Authentication Integration Error.

Karikalan Ramakrishnan — Fri, 23 Jul 2021 22:02:03 GMT

Thanks Acacio, that issue has been resolved by changing to issuer id as suggested in the forum https://stackoverflow.com/questions/65710654/mendix-and-azure-ad-b2c-authrequest-does-not-have-assertion-consumer-service-url

However, SP sign-in page now displaying an error "The username or password provided in the request are invalid". Though username and password are correct not sure why I get this error...In B2B, I used to assign the user access to registered app whereas in B2C I don't see any such option, I was wondering how system will recognize B2C local account user has access privilege to the application?

"identifierUris": [
"https://xyz.com"
],

RE: B2C SAML Authentication Integration Error.

Acacio Barrado — Fri, 23 Jul 2021 21:53:20 GMT

Hi Karikalan,

You can try to have a look in this link, perhaps this can help you to double check your configurations on the Azure side:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/appian-tutorial#next-steps

When I got a similar error was because of the Reply URL that was not saved:

But following the steps provided on the link solved my case.

Hope that also help you.

RE: B2C SAML Authentication Integration Error.

Karikalan Ramakrishnan — Fri, 23 Jul 2021 21:35:19 GMT

Thanks Acacio, still receiving the same error without "Suite" on it.

<samlp:StatusMessage>Application registered corresponding to IssuerUri "">https://xyz.com"
in AuthRequest does not have assertion consumer service URL "https://xyz.com/suite/saml/AssertionConsumer" specified in its metadata.

Just want to make sure my B2C IdentityExperienceFramework application registration JSON Manifest, IdentifierUris format is correct,
"identifierUris": [
"https://xyz.com/c3bcfc1c-1234-4a3b-96e6-db0933071234"
],

Secondly, I'm not getting clearly what does this mean to do in TrustFrameworkExtensions.xml ? From MS Ref. doc: You can change the value of the IssuerUri metadata item in the SAML token issuer technical profile. This change will be reflected in the issuerUri attribute returned in the SAML response from Azure AD B2C. Your application should be configured to accept the same issuerUri during SAML response validation.

<Metadata> <Item Key="IssuerUri">https://issuerUriMyAppExpects</Item> </Metadata> should be replaced as shown below?

RE: B2C SAML Authentication Integration Error.

Acacio Barrado — Fri, 23 Jul 2021 18:33:27 GMT

Hi Karikalan,

Could you please check in your Admin Console if in the Service Provider Entity ID option the URL is defined in this pattern https://xyx.appiancloud.com

You should not include the /suite

Regards,

Acacio B.