Azure B2C -- Configure "Forgot Password" workflow without redirect?

user_316847 0
Viewed 870

Background

Per the docs site, the expected step for a forgot password workflow in Azure B2C is:

  • View the sign in page
  • Click the "forgot password link"
  • B2C sends error AADB2C90118, "the user has forgotten their password", to the app.
  • The app is then expected to redirect back to the appropriate password reset workflow.

Challenge

However, in my case, I am integrating Azure AD B2C with a CMS that does not have the flexibility of a custom application. The identity workflow within this product, which I do not have access to configure, does not understand how to handle such an error from the Azure AD B2C provider.

This means that currently any user who clicks the forgot password link on the sign in page is instead taken to a 500 error in the CMS.

Question

  • Is there any way to modify this workflow such that it redirects to a named user journey / workflow, rather than returning an error? It's OK in this case if that workflow is hard-coded.
  • Barring that, is there any way to instruct Azure B2C not to render the "Forgot password" link? Or will I need to remove that via custom CSS / JS? (fine if that's necessary, but hoping to avoid it.)
azure-ad-b2c-custom-policy azure-ad-b2c
2 Answers
user_979460

While the answers provided by Brad C are excellent and worth considering, I ended up solving this in a slightly different way that fit our use case with less effort.

Upon the sign-in page load, I replace the contents of the ForgotPassword link with a reference to the passwordreset workflow I'd created. I take the current URL of the page, and replace the instance of signin_signup with passwordreset.

The jQuery in my custom HTML page is as follows:

$(document).ready(function() {
    var currentUrl =  $(location).attr('href');
    var modifiedPasswordResetUrl = currentUrl.replace('signup_signin', 'passwordreset');

    var passwordResetLinkSelector = $("a#forgotPassword");

    if(passwordResetLinkSelector.length > 0) {
        // only try to set the href if it's actually found; it won't be there on some screens that use this template.
        passwordResetLinkSelector.attr('href', modifiedPasswordResetUrl);
    }
});
user_3168470
Related