title: Azure B2C - Custom Policy - Error connecting identity provider
body: <p>I've been trying to add a custom policy for Azure AD B2C to connect with <a href="https://forge.autodesk.com/en/docs/oauth/v2/developers_guide/overview/" rel="nofollow noreferrer">Autodesk Forge</a>, following steps on <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-get-started-custom?tabs=applications" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-get-started-custom?tabs=applications</a>.</p>
  
  <p>I modified the bit for Facebook's <code>ClaimsProvider</code> with the following:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;ClaimsProvider&gt;
        &lt;!-- The following Domain element allows this profile to be used if the request comes with domain_hint 
             query string parameter, e.g. domain_hint=facebook.com  --&gt;
        &lt;Domain&gt;autodesk.com&lt;/Domain&gt;
        &lt;DisplayName&gt;AutodeskForge&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="FORGE-OAUTH"&gt;
            &lt;!-- The text in the following DisplayName element is shown to the user on the claims provider 
                 selection screen. --&gt;
            &lt;DisplayName&gt;Forge&lt;/DisplayName&gt;
            &lt;Protocol Name="OAuth2" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="authorization_endpoint"&gt;https://developer.api.autodesk.com/authentication/v1/authorize&lt;/Item&gt;
              &lt;Item Key="AccessTokenEndpoint"&gt;https://developer.api.autodesk.com/authentication/v1/gettoken&lt;/Item&gt;
              &lt;Item Key="ClaimsEndpoint"&gt;https://developer.api.autodesk.com/userprofile/v1/users/@me&lt;/Item&gt;
              &lt;Item Key="ProviderName"&gt;AutodeskForge&lt;/Item&gt;
              &lt;Item Key="HttpBinding"&gt;POST&lt;/Item&gt;
              &lt;Item Key="UsePolicyInRedirectUri"&gt;0&lt;/Item&gt;
  
              &lt;!-- The Facebook required HTTP GET method, but the access token response is in JSON format from 3/27/2017 --&gt;
              &lt;Item Key="AccessTokenResponseFormat"&gt;json&lt;/Item&gt;
              &lt;Item Key="ClaimsEndpointFormat"&gt;json&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;CryptographicKeys&gt;
              &lt;Key Id="client_secret" StorageReferenceId="B2C_1A_ForgeSecret" /&gt;
            &lt;/CryptographicKeys&gt;
            &lt;InputClaims /&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="userId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="userName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="autodesk.com" AlwaysUseDefaultValue="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" /&gt;
            &lt;/OutputClaims&gt;
            &lt;OutputClaimsTransformations&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" /&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" /&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" /&gt;
            &lt;/OutputClaimsTransformations&gt;
            &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" /&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
  </code></pre>
  
  <p>And also replaced the claims provider id on the user journey from <code>Facebook-OAUTH</code> to <code>FORGE_OAUTH</code>.</p>
  
  <p>When run, it does redirect to Autodesk Forge authorize endpoint properly, but then it fails when trying to connect to the <code>identity provider</code>, returning the below error:</p>
  
  <pre><code>AADB2C90289: We encountered an error connecting to the identity provider. Please try again later.
  Correlation ID: 188d934d-f1f0-48c5-98c4-917b032b94d2
  Timestamp: 2019-11-29 10:54:49Z
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/BPHr1.gif" rel="nofollow noreferrer">Error Example</a></p>
  
  <p>I'm not very experienced with AAD B2C, but it seems I might just being missing one step at some point.</p>
  
  <p>When adding Application Insight, the <code>trace</code> log outputs this:</p>
  
  <pre><code>[
    {
      "Kind": "Headers",
      "Content": {
        "UserJourneyRecorderEndpoint": "urn:journeyrecorder:applicationinsights",
        "CorrelationId": "99e13295-a206-449c-b011-a33422112b29",
        "EventInstance": "Event:ClaimsExchange",
        "TenantId": "alvarob2c.onmicrosoft.com",
        "PolicyId": "B2C_1A_signup_signin"
      }
    },
    {
      "Kind": "Transition",
      "Content": {
        "EventName": "ClaimsExchange",
        "StateName": "Initial"
      }
    },
    {
      "Kind": "Predicate",
      "Content": "Web.TPEngine.StateMachineHandlers.ClaimsExchangeMessageValidationHandler"
    },
    {
      "Kind": "Transition",
      "Content": {
        "EventName": "ClaimsExchange",
        "StateName": "Microsoft.Cpim.Protocols.PartnerProtocolException"
      }
    },
    {
      "Kind": "Predicate",
      "Content": "Web.TPEngine.StateMachineHandlers.IsPartnerErrorReachesMaximumRetriesHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true,
        "Statebag": {
          "MACHSTATE": {
            "c": "2019-11-29T11:07:31.6899756Z",
            "k": "MACHSTATE",
            "v": "Microsoft.Cpim.Protocols.PartnerProtocolException",
            "p": true
          },
          "JC": {
            "c": "2019-11-29T11:07:27.797697Z",
            "k": "JC",
            "v": "en-US",
            "p": true
          },
          "ORCH_CS": {
            "c": "2019-11-29T11:07:27.953952Z",
            "k": "ORCH_CS",
            "v": "2",
            "p": true
          },
          "ORCH_IDX": {
            "c": "2019-11-29T11:07:27.953952Z",
            "k": "ORCH_IDX",
            "v": "0",
            "p": true
          },
          "RA": {
            "c": "2019-11-29T11:07:27.953952Z",
            "k": "RA",
            "v": "0",
            "p": true
          },
          "RPP": {
            "c": "2019-11-29T11:07:27.797697Z",
            "k": "RPP",
            "v": "OAUTH2",
            "p": true
          },
          "RPIPP": {
            "c": "2019-11-29T11:07:27.797697Z",
            "k": "RPIPP",
            "v": "OAuth2ProtocolProvider",
            "p": true
          },
          "OTID": {
            "c": "2019-11-29T11:07:27.797697Z",
            "k": "OTID",
            "v": "alvarob2c.onmicrosoft.com",
            "p": true
          },
          "IC": {
            "c": "2019-11-29T11:07:27.9383272Z",
            "k": "IC",
            "v": "True",
            "p": true
          },
          "MSG(283863a3-02dd-4c87-b4ae-2500a398fed4)": {
            "c": "2019-11-29T11:07:27.9383272Z",
            "k": "MSG(283863a3-02dd-4c87-b4ae-2500a398fed4)",
            "v": "{\"TenantId\":\"alvarob2c.onmicrosoft.com\",\"PolicyId\":\"B2C_1A_signup_signin\",\"RedirectUri\":\"https://jwt.ms/\",\"AdditionalParameters\":{\"p\":\"B2C_1A_signup_signin\"},\"Nonce\":\"defaultNonce\",\"ClientId\":\"4b03fe96-24d9-40b5-b01d-c45b95422b31\",\"ResponseType\":\"id_token\",\"ResponseRedirector\":{\"URI\":\"https://jwt.ms\",\"D\":false,\"WF\":true,\"R\":false},\"Scope\":\"openid\",\"AppModelVersion\":1,\"ScopedProviders\":[]}",
            "p": true,
            "t": "OAuth2"
          },
          "IMESSAGE": {
            "c": "2019-11-29T11:07:27.9383272Z",
            "k": "IMESSAGE",
            "v": "283863a3-02dd-4c87-b4ae-2500a398fed4",
            "p": true
          },
          "TAGE": {
            "c": "2019-11-29T11:07:31.5024363Z",
            "k": "TAGE",
            "v": "ForgeExchange",
            "p": true
          },
          "SE": {
            "c": "2019-11-29T11:07:27.953952Z",
            "k": "SE",
            "v": "Social",
            "p": true
          },
          "CMESSAGE": {
            "c": "2019-11-29T11:07:31.3461838Z",
            "k": "CMESSAGE",
            "v": "283863a3-02dd-4c87-b4ae-2500a398fed4",
            "p": true
          },
          "ComplexItems": "_MachineEventQ, REPRM, TCTX, M_EXCP"
        },
        "PredicateResult": "False"
      }
    },
    {
      "Kind": "Predicate",
      "Content": "Web.TPEngine.StateMachineHandlers.IsPartnerReauthenticateActionHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true,
        "PredicateResult": "False"
      }
    },
    {
      "Kind": "Predicate",
      "Content": "Web.TPEngine.StateMachineHandlers.IsPartnerClientInvalidActionHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true,
        "PredicateResult": "False"
      }
    },
    {
      "Kind": "Predicate",
      "Content": "Web.TPEngine.StateMachineHandlers.NoOpHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true,
        "PredicateResult": "True"
      }
    },
    {
      "Kind": "Action",
      "Content": "Web.TPEngine.SSO.SSOSessionEndHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true
      }
    },
    {
      "Kind": "Action",
      "Content": "Web.TPEngine.StateMachineHandlers.SendErrorHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true,
        "RecorderRecord": {
          "Values": [
            {
              "Key": "SendErrorTechnicalProfile",
              "Value": "OAuth2ProtocolProvider"
            },
            {
              "Key": "Exception",
              "Value": {
                "Kind": "Handled",
                "HResult": "80131500",
                "Message": "We encountered an error connecting to the identity provider. Please try again later.",
                "Data": {
                  "IsPolicySpecificError": false
                }
              }
            }
          ]
        },
        "Statebag": {
          "SE": {
            "c": "2019-11-29T11:07:31.6899756Z",
            "k": "SE",
            "v": "",
            "p": true
          }
        }
      }
    },
    {
      "Kind": "Action",
      "Content": "Web.TPEngine.StateMachineHandlers.TransactionEndHandler"
    },
    {
      "Kind": "HandlerResult",
      "Content": {
        "Result": true
      }
    }
  ]
  </code></pre>