title: B2C custom policy login - "The username or password provided in the request are invalid"
body: <p>We have a legacy system that we are upgrading to Azure B2C. Users need to be able to log-in using their usernames or emails. In legacy system multiple users can have the same email address.
  We created custom policy (based on <a href="https://github.com/azure-ad-b2c/samples/tree/master/policies/username-signup-or-signin" rel="nofollow noreferrer">https://github.com/azure-ad-b2c/samples/tree/master/policies/username-signup-or-signin</a> ) so that users can log-in with their usernames. To be able to support users to log-in with the emails we changed the policy.</p>
  <p>Email that user enters in log-in is passed on to our api that either returns the username if the email is linked only to one user or 409 error if email is linked to multiple users (returns error message that the user needs to use his username to log-in since we do not know who he is).</p>
  <p>If the api returns the username we then pass the username to login-NonInteractive profile but the profile returns “The username or password provided in the request are invalid”.</p>
  <p>So basically, instead of the email user enters we tried to pass the username we got form the api to log-in. But that does not work. If we use the same username we got from api to log-in it works fine.</p>
  <p>Even when we adjusted the policy and hardcoded the username (instead of calling the api) for test purposes and tried to log-in using email it failed. If we log-in with a dummy username that does not exist as a user in b2c it works fine because it uses the hardcoded username. But as soon as we try log-in with email it does not work even though we are using the same hardcoded username in the policy.</p>
  <p>We are using claim transformation (by calling singInNameCopyText technical profile) to set the hardcoded value to signInNamePlainText claim that is used in login-NonInteractive profile.</p>
  <p>Example of our sign-in policy with hardcoded username value – Sign-in is separated from sign-up:</p>
  <pre><code>    &lt;TechnicalProfile Id=&quot;SelfAsserted-LocalAccountSignin-Username&quot;&gt;
          &lt;DisplayName&gt;Local Account Signin&lt;/DisplayName&gt;
          &lt;Protocol Name=&quot;Proprietary&quot; Handler=&quot;Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null&quot; /&gt;
          &lt;Metadata&gt;
              &lt;Item Key=&quot;ContentDefinitionReferenceId&quot;&gt;api.selfasserted&lt;/Item&gt;
              &lt;Item Key=&quot;UserMessageIfClaimsTransformationStringsAreNotEqual&quot;&gt;The last names you provided are not the same&lt;/Item&gt;
              &lt;Item Key=&quot;AllowGenerationOfClaimsWithNullValues&quot;&gt;true&lt;/Item&gt;
              &lt;Item Key=&quot;setting.operatingMode&quot;&gt;Username&lt;/Item&gt;
          &lt;/Metadata&gt;
  
          &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;signInName&quot; /&gt;
  
          &lt;/InputClaims&gt;
          &lt;DisplayClaims&gt;
              &lt;DisplayClaim ClaimTypeReferenceId=&quot;signInName&quot; Required=&quot;true&quot; /&gt;
              &lt;DisplayClaim ClaimTypeReferenceId=&quot;password&quot; Required=&quot;true&quot; /&gt;
          &lt;/DisplayClaims&gt;
          &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;signInName&quot; Required=&quot;true&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;password&quot; Required=&quot;true&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;objectId&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;authenticationSource&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;isEmailBoolean&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;signInNamePlainText&quot; Required=&quot;true&quot;/&gt;
          &lt;/OutputClaims&gt;
          &lt;ValidationTechnicalProfiles&gt;
              &lt;ValidationTechnicalProfile ReferenceId=&quot;regexAnalysisUsername&quot;/&gt;
  
              &lt;ValidationTechnicalProfile ReferenceId=&quot;SecureREST-AccessToken&quot;&gt;
                  &lt;Preconditions&gt;
                      &lt;Precondition Type=&quot;ClaimEquals&quot; ExecuteActionsIf=&quot;false&quot;&gt;
                          &lt;Value&gt;isEmailBoolean&lt;/Value&gt;
                          &lt;Value&gt;True&lt;/Value&gt;
                          &lt;Action&gt;SkipThisValidationTechnicalProfile&lt;/Action&gt;
                      &lt;/Precondition&gt;
                  &lt;/Preconditions&gt;
              &lt;/ValidationTechnicalProfile&gt;
                  &lt;ValidationTechnicalProfile ReferenceId=&quot;REST-CheckEmail&quot; &gt;
                  &lt;Preconditions&gt;
                      &lt;Precondition Type=&quot;ClaimEquals&quot; ExecuteActionsIf=&quot;false&quot;&gt;
                          &lt;Value&gt;isEmailBoolean&lt;/Value&gt;
                          &lt;Value&gt;True&lt;/Value&gt;
                          &lt;Action&gt;SkipThisValidationTechnicalProfile&lt;/Action&gt;
                      &lt;/Precondition&gt;
                  &lt;/Preconditions&gt;
              &lt;/ValidationTechnicalProfile&gt;
              &lt;ValidationTechnicalProfile ReferenceId=&quot;singInNameCopyText&quot; &gt;
  
              &lt;/ValidationTechnicalProfile&gt;
  
              &lt;ValidationTechnicalProfile ReferenceId=&quot;log-in-NonInteractive2&quot; /&gt;
          &lt;/ValidationTechnicalProfiles&gt;
          &lt;UseTechnicalProfileForSessionManagement ReferenceId=&quot;SM-AAD&quot; /&gt;
      &lt;/TechnicalProfile&gt;
  
      &lt;TechnicalProfile Id=&quot;log-in-NonInteractive2&quot;&gt;
          &lt;DisplayName&gt;Local Account SignIn&lt;/DisplayName&gt;
          &lt;Protocol Name=&quot;OpenIdConnect&quot; /&gt;
          &lt;Metadata&gt;
              &lt;Item Key=&quot;client_id&quot;&gt;{{ProxyIdentityExperienceFramework}}&lt;/Item&gt;
              &lt;Item Key=&quot;IdTokenAudience&quot;&gt;{{IdentityExperienceFramework}}&lt;/Item&gt;
              &lt;Item Key=&quot;UserMessageIfClaimsPrincipalDoesNotExist&quot;&gt;We can't seem to find your account&lt;/Item&gt;
              &lt;Item Key=&quot;UserMessageIfInvalidPassword&quot;&gt;Your password is incorrect&lt;/Item&gt;
              &lt;Item Key=&quot;UserMessageIfOldPasswordUsed&quot;&gt;Looks like you used an old password&lt;/Item&gt;
  
              &lt;Item Key=&quot;ProviderName&quot;&gt;https://sts.windows.net/&lt;/Item&gt;
              &lt;Item Key=&quot;METADATA&quot;&gt;https://log-in.microsoftonline.com/{tenant}/.well-known/openid-configuration&lt;/Item&gt;
              &lt;Item Key=&quot;authorization_endpoint&quot;&gt;https://log-in.microsoftonline.com/{tenant}/oauth2/token&lt;/Item&gt;
              &lt;Item Key=&quot;response_types&quot;&gt;id_token&lt;/Item&gt;
              &lt;Item Key=&quot;response_mode&quot;&gt;query&lt;/Item&gt;
              &lt;Item Key=&quot;scope&quot;&gt;email openid&lt;/Item&gt;
              &lt;Item Key=&quot;LocalAccountProfile&quot;&gt;true&lt;/Item&gt;
              &lt;Item Key=&quot;grant_type&quot;&gt;password&lt;/Item&gt;
  
              &lt;!-- Policy Engine Clients --&gt;
              &lt;Item Key=&quot;UsePolicyInRedirectUri&quot;&gt;false&lt;/Item&gt;
              &lt;Item Key=&quot;HttpBinding&quot;&gt;POST&lt;/Item&gt;
  
          &lt;/Metadata&gt;
          &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;client_id&quot; DefaultValue=&quot;{{ProxyIdentityExperienceFramework}}&quot; /&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;resource_id&quot; PartnerClaimType=&quot;resource&quot; DefaultValue=&quot;{{IdentityExperienceFramework}}&quot; /&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;signInNamePlainText&quot; PartnerClaimType=&quot;username&quot; Required=&quot;true&quot;/&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;password&quot; PartnerClaimType=&quot;password&quot; Required=&quot;true&quot; /&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;grant_type&quot; DefaultValue=&quot;password&quot; /&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;scope&quot; DefaultValue=&quot;openid&quot; /&gt;
              &lt;InputClaim ClaimTypeReferenceId=&quot;nca&quot; PartnerClaimType=&quot;nca&quot; DefaultValue=&quot;1&quot; /&gt;
  
          &lt;/InputClaims&gt;
          &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;signInName&quot; PartnerClaimType=&quot;username&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;objectId&quot; PartnerClaimType=&quot;oid&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;tenantId&quot; PartnerClaimType=&quot;tid&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;givenName&quot; PartnerClaimType=&quot;given_name&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;surName&quot; PartnerClaimType=&quot;family_name&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;displayName&quot; PartnerClaimType=&quot;name&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;userPrincipalName&quot; PartnerClaimType=&quot;upn&quot; /&gt;
              &lt;OutputClaim ClaimTypeReferenceId=&quot;authenticationSource&quot; DefaultValue=&quot;localAccountAuthentication&quot; /&gt;
          &lt;/OutputClaims&gt;
      &lt;/TechnicalProfile&gt;
  </code></pre>
  <p>User journey:</p>
  <pre><code>&lt;UserJourney Id=&quot;SignInUsernameOrEmail&quot;&gt;
              &lt;OrchestrationSteps&gt;
                  &lt;OrchestrationStep Order=&quot;1&quot; Type=&quot;ClaimsExchange&quot;&gt;
                      &lt;ClaimsProviderSelections&gt;
                          &lt;ClaimsProviderSelection ValidationClaimsExchangeId=&quot;LocalAccountSigninLog-inNoLog-in&quot; /&gt;
                      &lt;/ClaimsProviderSelections&gt;
                      &lt;ClaimsExchanges&gt;
                          &lt;ClaimsExchange Id=&quot;LocalAccountSigninLog-inNoLog-in&quot; TechnicalProfileReferenceId=&quot;SelfAsserted-LocalAccountSignin-Username&quot; /&gt;
                      &lt;/ClaimsExchanges&gt;
                  &lt;/OrchestrationStep&gt;
  
                  &lt;OrchestrationStep Order=&quot;2&quot; Type=&quot;SendClaims&quot; CpimIssuerTechnicalProfileReferenceId=&quot;JwtIssuer&quot; /&gt;
              &lt;/OrchestrationSteps&gt;
              &lt;ClientDefinition ReferenceId=&quot;DefaultWeb&quot; /&gt;
          &lt;/UserJourney&gt;
  </code></pre>
  <p>Sign-in policy Relying party:</p>
  <pre><code>&lt;RelyingParty&gt;
          &lt;DefaultUserJourney ReferenceId=&quot;SignInUsernameOrEmail&quot; /&gt;
          &lt;UserJourneyBehaviors&gt;
              &lt;JourneyInsights TelemetryEngine=&quot;ApplicationInsights&quot; InstrumentationKey=&quot;{{appInsightsInstrumentationKey}}&quot;
               DeveloperMode=&quot;true&quot; ClientEnabled=&quot;false&quot; ServerEnabled=&quot;true&quot; TelemetryVersion=&quot;1.0.0&quot; /&gt;
          &lt;/UserJourneyBehaviors&gt;
          &lt;TechnicalProfile Id=&quot;PolicyProfile&quot;&gt;
              &lt;DisplayName&gt;PolicyProfile&lt;/DisplayName&gt;
              &lt;Protocol Name=&quot;OpenIdConnect&quot; /&gt;
              &lt;OutputClaims&gt;
                  
                  &lt;OutputClaim ClaimTypeReferenceId=&quot;signInName&quot; PartnerClaimType=&quot;username&quot; /&gt;
                  &lt;OutputClaim ClaimTypeReferenceId=&quot;signInNamePlainText&quot; /&gt;
                  
                  &lt;OutputClaim ClaimTypeReferenceId=&quot;isEmailBoolean&quot; /&gt;
                  
                  &lt;OutputClaim ClaimTypeReferenceId=&quot;objectId&quot; PartnerClaimType=&quot;sub&quot; DefaultValue=&quot;{Policy:TenantObjectId}&quot;/&gt;
      
                  &lt;OutputClaim ClaimTypeReferenceId=&quot;tenantId&quot; AlwaysUseDefaultValue=&quot;true&quot; DefaultValue=&quot;{Policy:TenantObjectId}&quot; /&gt;
              &lt;/OutputClaims&gt;
              &lt;SubjectNamingInfo ClaimType=&quot;sub&quot; /&gt;
          &lt;/TechnicalProfile&gt;
      &lt;/RelyingParty&gt;
  </code></pre>
  <p>UPDATE 1:
  Just figured out that the reason why we are getting the issue when login with email is the token we request for the api.</p>
  <p>Our api is protected with bearer token.</p>
  <p>We get the token from b2c using the following technical profile</p>
  <pre><code> &lt;TechnicalProfile Id=&quot;SecureREST-AccessToken&quot;&gt;
        &lt;DisplayName&gt;&lt;/DisplayName&gt;
        &lt;Protocol Name=&quot;Proprietary&quot; Handler=&quot;Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null&quot; /&gt;
        &lt;Metadata&gt;
               &lt;Item Key=&quot;ServiceUrl&quot;&gt;https://login.microsoftonline.com/{{tenantID}}.onmicrosoft.com/oauth2/v2.0/token&lt;/Item&gt;
               &lt;Item Key=&quot;AuthenticationType&quot;&gt;Basic&lt;/Item&gt;
               &lt;Item Key=&quot;SendClaimsIn&quot;&gt;Form&lt;/Item&gt;
        &lt;/Metadata&gt;
        &lt;CryptographicKeys&gt;
               &lt;Key Id=&quot;BasicAuthenticationUsername&quot; StorageReferenceId=&quot;B2C_1A_SecureRESTClientId&quot; /&gt;
               &lt;Key Id=&quot;BasicAuthenticationPassword&quot; StorageReferenceId=&quot;B2C_1A_SecureRESTClientSecret&quot; /&gt;
        &lt;/CryptographicKeys&gt;
        &lt;InputClaims&gt;
               &lt;InputClaim ClaimTypeReferenceId=&quot;grant_type&quot; DefaultValue=&quot;client_credentials&quot; /&gt;
               &lt;InputClaim ClaimTypeReferenceId=&quot;scope&quot; DefaultValue=&quot;https://{{tenantID}}.onmicrosoft.com/{{registeredApiAppName}}/.default&quot; /&gt;
        &lt;/InputClaims&gt;
        &lt;OutputClaims&gt;
               &lt;OutputClaim ClaimTypeReferenceId=&quot;bearerToken&quot; PartnerClaimType=&quot;access_token&quot; /&gt;
        &lt;/OutputClaims&gt;
        &lt;UseTechnicalProfileForSessionManagement ReferenceId=&quot;SM-Noop&quot; /&gt;
   &lt;/TechnicalProfile&gt;
  
   
  </code></pre>
  <p>When i remove the call to the SecureREST-AccessToken  and call the login-NonInteractive i no longer get the „The username or password provided in the request are invalid”.</p>
  <p>Not sure why that is causing the issue though.</p>
  <p>UPDATE 2: Updated SelfAsserted-LocalAccountSignin-Username to reflect the api calls.</p>