Search code examples
azure-ad-b2cidentity-experience-framework

Email verification box disappears when passing email from Facebook as input claim to self-asserted profile

We want to force users to provide and verify their email address even when they reject passing their email claim from Facebook.

enter image description here

We created an orchestration step which calls the following technical profile after coming back from Facebook:

        <TechnicalProfile Id="SelfAsserted-ConfirmEmailSocial">
          <DisplayName>Confirm email social</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
          </OutputClaims>
        </TechnicalProfile>

If the user rejects the facebook setting, the code works as expected: The verification control is shown. However, if the user accepts the facebook setting, both the input field and the verification control disappear. (And the email gets pre-populated)

enter image description here

(Someone explains here stack overflow that the control is too dumb to realize that you want to verify the input claim https://stackoverflow.com/a/44429492/509464) but we haven't been able to get the suggested solution to work.

How can we force validation of emails provided in a previous orchestration step?

Update: It seems we could create a workaround by making the input claim read-only somehow. (But only if it was empty).

Solution

  • Yes the only option is making it read only, since otherwise we assume the passed in email is already verified, which it is with Facebook. If you change the email, then you must verify it. You could modify the JavaScript/css to show the controls. Or in the custom policy, use an input claim transform to copy the email claim into a new read-only claim id. Then pre-populate the form using input claim. Then display the claim using output claim.