Skip to content

Commit d557b30

Browse files
mrochonmrochon
committed
Added TOTPApproval
1 parent 19f8143 commit d557b30

File tree

4 files changed

+57
-85
lines changed

4 files changed

+57
-85
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -334,3 +334,5 @@ ASALocalRun/
334334
# MFractors (Xamarin productivity tool) working folder
335335
.mfractor/
336336
/Policies/GuestUsers/gen/mrochonb2cprod.onmicrosoft.com
337+
338+
.codegpt

‎Policies/TOTP/policy/.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
2+
.codegpt

‎Policies/TOTPBasedApproval/TOTPExtensions.xml

+51-84
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,15 @@
22
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
33
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0"
44
TenantId="yourtenant.onmicrosoft.com"
5-
PolicyId="B2C_1A_TrustFrameworkExtensions_TOTP"
6-
PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions_TOTP">
5+
PolicyId="B2C_1A_TOTP_Extensions"
6+
PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_TOTP_Extensions">
77

88
<BasePolicy>
99
<TenantId>yourtenant.onmicrosoft.com</TenantId>
1010
<PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
1111
</BasePolicy>
1212
<BuildingBlocks>
1313
<ClaimsSchema>
14-
<!--TOTP
15-
claims-->
1614
<ClaimType Id="emails">
1715
<DisplayName>Email Addresses</DisplayName>
1816
<DataType>stringCollection</DataType>
@@ -49,7 +47,7 @@
4947
</ClaimType>
5048

5149
<ClaimType Id="QrCodeVerifyInstruction">
52-
<DisplayName>Enter the verification code from your authenticator app.</DisplayName>
50+
<DisplayName>Enter the code from District Manager.</DisplayName>
5351
<DataType>string</DataType>
5452
<UserInputType>Paragraph</UserInputType>
5553
</ClaimType>
@@ -69,7 +67,7 @@
6967
</ClaimType>
7068

7169
<ClaimType Id="otpCode">
72-
<DisplayName>Enter your code</DisplayName>
70+
<DisplayName>Enter the code</DisplayName>
7371
<DataType>string</DataType>
7472
<UserHelpText>Enter the 6-digit verification code generated by the the Authenticator
7573
app in the box</UserHelpText>
@@ -241,6 +239,15 @@
241239

242240
<!-- end of TOTP Claims Transforms-->
243241

242+
<ClaimsTransformation Id="CreateRandomPassword" TransformationMethod="CreateRandomString">
243+
<InputParameters>
244+
<InputParameter Id="randomGeneratorType" DataType="string" Value="GUID" />
245+
</InputParameters>
246+
<OutputClaims>
247+
<OutputClaim ClaimTypeReferenceId="password" TransformationClaimType="outputClaim" />
248+
</OutputClaims>
249+
</ClaimsTransformation>
250+
244251
</ClaimsTransformations>
245252

246253
<ContentDefinitions>
@@ -296,7 +303,7 @@
296303
StringId="DisplayName">Enter the verification code from your authenticator
297304
app.</LocalizedString>
298305
<LocalizedString ElementType="ClaimType" ElementId="otpCode"
299-
StringId="DisplayName">Enter your code.</LocalizedString>
306+
StringId="DisplayName">Enter the code.</LocalizedString>
300307
<!-- <LocalizedString ElementType="UxElement"
301308
StringId="button_continue">Verify</LocalizedString> -->
302309
</LocalizedStrings>
@@ -573,120 +580,80 @@
573580
<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
574581
</OutputClaims>
575582
</TechnicalProfile>
583+
<TechnicalProfile Id="AAD-UserWriteUsingAlternativeSecurityId">
584+
<InputClaimsTransformations>
585+
<InputClaimsTransformation ReferenceId="CreateRandomPassword" />
586+
</InputClaimsTransformations>
587+
<!-- <InputClaims>
588+
<InputClaim ClaimTypeReferenceId="email" Required="true" />
589+
</InputClaims> -->
590+
<PersistedClaims>
591+
<PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
592+
<PersistedClaim ClaimTypeReferenceId="password" />
593+
<PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration,DisableStrongPassword" />
594+
</PersistedClaims>
595+
</TechnicalProfile>
576596
</TechnicalProfiles>
577597
</ClaimsProvider>
578598

579-
<ClaimsProvider>
580-
<DisplayName>Local Account</DisplayName>
581-
<TechnicalProfiles>
582-
<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
583-
<OutputClaims>
584-
<!-- The userPrincipalName is required for the AzureMfaProtocolProvider
585-
technical profiles-->
586-
<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
587-
</OutputClaims>
588-
</TechnicalProfile>
589-
590-
<TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
591-
<OutputClaims>
592-
<!-- The userPrincipalName is required for the AzureMfaProtocolProvider
593-
technical profiles-->
594-
<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
595-
</OutputClaims>
596-
</TechnicalProfile>
597-
</TechnicalProfiles>
598-
</ClaimsProvider>
599599
</ClaimsProviders>
600600

601601
<UserJourneys>
602-
<UserJourney Id="PasswordResetWithTOTP">
603-
<OrchestrationSteps>
604-
<OrchestrationStep Order="1" Type="ClaimsExchange">
605-
<ClaimsExchanges>
606-
<ClaimsExchange Id="PasswordResetUsingEmailAddressExchange"
607-
TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress" />
608-
</ClaimsExchanges>
609-
</OrchestrationStep>
610-
611-
<!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey
612-
will not ask the user to enroll -->
613-
<OrchestrationStep Order="2" Type="InvokeSubJourney">
614-
<JourneyList>
615-
<Candidate SubJourneyReferenceId="TotpFactor-Input" />
616-
</JourneyList>
617-
</OrchestrationStep>
618-
619-
<!-- Call the TOTP validation sub journey-->
620-
<OrchestrationStep Order="3" Type="InvokeSubJourney">
621-
<JourneyList>
622-
<Candidate SubJourneyReferenceId="TotpFactor-Verify" />
623-
</JourneyList>
624-
</OrchestrationStep>
625-
626-
<OrchestrationStep Order="4" Type="ClaimsExchange">
627-
<ClaimsExchanges>
628-
<ClaimsExchange Id="NewCredentials"
629-
TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
630-
</ClaimsExchanges>
631-
</OrchestrationStep>
632-
633-
<OrchestrationStep Order="5" Type="SendClaims"
634-
CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
635-
</OrchestrationSteps>
636-
<ClientDefinition ReferenceId="DefaultWeb" />
637-
</UserJourney>
638602

639603
<UserJourney Id="SignUpOrSignInTOTP">
640604
<OrchestrationSteps>
641-
642605
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp"
643606
ContentDefinitionReferenceId="api.signuporsignin">
644607
<ClaimsProviderSelections>
645-
<ClaimsProviderSelection
646-
ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
608+
<ClaimsProviderSelection TargetClaimsExchangeId="WORKExchange" />
647609
</ClaimsProviderSelections>
610+
</OrchestrationStep>
611+
<OrchestrationStep Order="2" Type="ClaimsExchange">
648612
<ClaimsExchanges>
649-
<ClaimsExchange Id="LocalAccountSigninEmailExchange"
650-
TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
613+
<ClaimsExchange Id="WORKExchange" TechnicalProfileReferenceId="WORK-OIDC" />
651614
</ClaimsExchanges>
652615
</OrchestrationStep>
653616

654-
<OrchestrationStep Order="2" Type="ClaimsExchange">
617+
<!-- For social IDP authentication, attempt to find the user account in the
618+
directory. -->
619+
<OrchestrationStep Order="3" Type="ClaimsExchange">
620+
<ClaimsExchanges>
621+
<ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId"
622+
TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
623+
</ClaimsExchanges>
624+
</OrchestrationStep>
625+
626+
<!-- The previous step (SelfAsserted-Social) could have been skipped if there were
627+
no attributes to collect
628+
from the user. So, in that case, create the user in the directory if one does not already exist
629+
(verified using objectId which would be set from the last step if account was created in the
630+
directory. -->
631+
<OrchestrationStep Order="4" Type="ClaimsExchange">
655632
<Preconditions>
656633
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
657634
<Value>objectId</Value>
658635
<Action>SkipThisOrchestrationStep</Action>
659636
</Precondition>
660637
</Preconditions>
661638
<ClaimsExchanges>
662-
<ClaimsExchange Id="SignUpWithLogonEmailExchange"
663-
TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
639+
<ClaimsExchange Id="AADUserWrite"
640+
TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
664641
</ClaimsExchanges>
665642
</OrchestrationStep>
666643

667-
<OrchestrationStep Order="3" Type="ClaimsExchange">
668-
<ClaimsExchanges>
669-
<ClaimsExchange Id="AADUserReadWithObjectId"
670-
TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
671-
</ClaimsExchanges>
672-
</OrchestrationStep>
673-
674-
<!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey
675-
will not ask the user to enroll -->
676-
<OrchestrationStep Order="4" Type="InvokeSubJourney">
644+
<OrchestrationStep Order="5" Type="InvokeSubJourney">
677645
<JourneyList>
678646
<Candidate SubJourneyReferenceId="TotpFactor-Input" />
679647
</JourneyList>
680648
</OrchestrationStep>
681649

682-
<!-- Call the TOTP validation sub journey-->
683-
<OrchestrationStep Order="5" Type="InvokeSubJourney">
650+
<OrchestrationStep Order="6" Type="InvokeSubJourney">
684651
<JourneyList>
685652
<Candidate SubJourneyReferenceId="TotpFactor-Verify" />
686653
</JourneyList>
687654
</OrchestrationStep>
688655

689-
<OrchestrationStep Order="6" Type="SendClaims"
656+
<OrchestrationStep Order="7" Type="SendClaims"
690657
CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
691658

692659
</OrchestrationSteps>

‎README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@ section.
9999
| Jun 2022 | New: batch migration |
100100
| Nov 2022 | New: user choice of 2nd FA |
101101
| Mar 2023 | New: call Graph |
102-
| Jun 2023 | New: embedded pwd reset |
102+
| Jan 2025 | New: TOTP as approval code |
103+
103104

104105

105106
## Tips and tricks

0 commit comments

Comments
 (0)