azure-ad-b2cazure-ad-b2c-custom-policyidentity-experience-framework

B2C Custom Policy - Are SubJourney OutputClaims accessible in parent UserJourney

There appears to be limited documentation around sub journeys. https://learn.microsoft.com/en-us/azure/active-directory-b2c/subjourneys

I have a problem where in my SubJourney, I read the user and get the object Id. In the main UserJourney, I later use that object Id to read the user again, but it complains.

Error image

Although objectId is an output claim in the first step of the SubJourney, the main User Journey cannot use that output.

<SubJourneys>
        <SubJourney Id="ResetPhoneNumberOnAccount" Type="Call">
            <OrchestrationSteps>
                <!-- Look to see if the user exists if its a phone recovery -->
                <OrchestrationStep Order="1" Type="ClaimsExchange">
                    <ClaimsExchanges>
                        <ClaimsExchange Id="CheckIfUserExists" TechnicalProfileReferenceId="AAD-UserDiscoveryUsingLogonPhoneNumber-FullProfile" />
                    </ClaimsExchanges>
                </OrchestrationStep>
           <!-- Other Step -->
    </SubJourney>
</SubJourneys>

AAD-UserDiscoveryUsingLogonPhoneNumber-FullProfile is defined: https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/master/scenarios/phone-number-passwordless/Phone_Email_Base.xml#L905

Are SubJourneys not able to send output claims up the chain?

Solution

  • Yes, output claims from orchestration steps in sub journeys are accessible from the parent user journey. It seems like when an orchestration step depends on an output claim returned from a sub journey, the step must itself be encapsulated in its own sub journey.

    If AAD-UserReadUsingObjectId exists in the main journey, but objectId is only output in a sub journey, the policy will fail validation. This appears to me to be bug with the XML schema validator.

    I have examined trace logs in app insights and, after applying this workaround, can confirm that claims output in sub journeys do persist until the main journey has ended.

    For a more in depth look at this problem, check out my issue on GitHub.