Sample for use with Azure AD B2C with Custom Policies.

Home Page: http://aka.ms/aadb2ccustom

License: MIT License

C# 48.08% HTML 35.51% JavaScript 5.14% CSS 6.05% PowerShell 1.40% Ruby 0.02% Objective-C 3.78% ASP.NET 0.02%

microsoft identity azure-ad-b2c azure-active-directory azure-ad-b2c-custom

active-directory-b2c-advanced-policies's Introduction

languages

page_type

description

products

urlFragment

csharp

powershell

objc

html

javascript

sample

A demo of Azure AD B2C Custom Policies with the Identity Experience Framework (IEF).

azure

azure-active-directory

identity-experience-framework-azure-ad

Azure AD B2C Custom Policies with the Identity Experience Framework (IEF)

Active Repos:

Starter pack https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack
App samples https://docs.microsoft.com/en-us/azure/active-directory-b2c/code-samples
The community repo https://github.com/azure-ad-b2c.

Solutions and training for Azure AD B2C

https://docs.microsoft.com/en-us/azure/active-directory-b2c/solution-articles

What are the supported features and where is the supported documentation? Supported feature set of Custom Policies with IEF available via:

The inline documentation in the Identity Experience Framework tab in B2C. Click on "Developer Responsibilities"
Azure official documentation page

Unsupported material

A Demo of Azure AD B2C is deployed at https://wingtipgamesb2c.azurewebsites.net/.

Samples for Wingtipgamesb2c.azurewebsites.net. Including:

Web application /src/WingTipGamesWebApplication
Application Insights Viewer /src/WingTipUserJourneyPlayerWebApplication
Web app with admin side analytics src/WingTipToysWebApplication

The contents of this repository are unsupported and may or not be current. Replies to questions about unsupported material have the lowest priority

Why unsupported?

The Identity Experience Framework is a powerful identity engine with a very comprehensive feature set, that is used internally for Microsoft services like Azure AD B2C. Only a subset of features will be tested, monitored, documented, and supported over time. The supported list will increase quickly. Unsupported samples and documentation are provided for our fans and partners for training, and feedback only.

active-directory-b2c-advanced-policies's People

Contributors

Stargazers

Watchers

Forkers

rojasja vigunase 10thmagnitude rich-nouf bobjac zeroinfinite monaokr rom857 korakanchan pataltimore whippsp 0ldboy llenroc dlozanonavas spottedmahn indeevari clouda2z-code marcelodiiorio jaypaddy timpeteren parad0xchild mark-breen adamjbradley cwahl5 computeworks muizsyed blupike fanuer dannradkov egbill3eagle magendranvaithi onionhammer soorajpayyoor thecoder87 dawtips gopinathdeepak baltuonis bcary jeremywhiteley dinushadev johntallon camilorios johnpwsharp epandy-ahc chris-eitel rogorman9 yangsa666 angrytrashpanda learntocodekm jaychase taliesins ichirokyou janibasha1 mchudinov ramanathants apalazzin projectpete ameyvaert davidlevy-ecommbi johninfant nboettcher thejask vgardner bpruitt-goddard bizatium-dev a-d-c jasjeetsuri liodiera ashishkmishra2003 jassuri bmaggra rvdhoorncaesar leelavinothp digideskio cksodhi hugoleijtens jayallen mohammed-el-nabulsi iamalexmang sivabankapalli wofll-forks subhavivek stevenxzhou-zz retrywith b2cvteam imranrarani xinaxu leniel tasfiakhan jeevabt teejayturner katie199 rodrigo-md julescoding thearturs artmasa kareemsobhy dave22000 mohammad-saif-husain-by kumarrobin149

active-directory-b2c-advanced-policies's Issues

Unable to conditionally execute conditional OrchestrationStep

I am trying to introduce new Orchestration Step based on the value of my custom attribute. My requirement is I want to execute the a orchestration step only if the value of myattribute(boolean attribute) is set to true. The value of myattribute is either set to true or false. I am doing something like this.
<OrchestrationStep Order="3" Type="ClaimsExchange"> <ClaimsExchanges> <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" /> </ClaimsExchanges> </OrchestrationStep> <OrchestrationStep Order="4" Type="ClaimsExchange"> <Preconditions> <Precondition Type="ClaimEquals" ExecuteActionsIf="false"> <Value>mobile</Value> <Value>extension_myattributee</Value> <Action>SkipThisOrchestrationStep</Action> </Precondition> </Preconditions> <ClaimsExchanges> <ClaimsExchange Id="NewCredentials1" TechnicalProfileReferenceId="LocalAccountWritePasswordChangeUsingObjectId" /> </ClaimsExchanges> </OrchestrationStep>

But this step is not skipped irrespective of the value of myattribute. I have added the myattribute as part of the OutPutClaims of AAD-UserReadUsingObjectId. I am able see the value of extension_myattribute in the C#.

Move User Joureny Recorder/Viewer to Own Project

According to Azure Active Directory B2C: Collecting Logs:

The community has developed a user journey viewer to help identity developers. It is not supported by Microsoft and made available strictly as-is. It reads from your Application Insights instance and provides a well-structured view of the user journey events. You obtain the source code and deploy it in your own solution.

Reading the logs in app insights is really really hard to me. If this is tool then I think this source should be moved out of this sample and put on its own.

Thoughts?

Azure AD B2C: Azure AD IdP does not work with custom domain

Hi!

I'm using custom policy to add Azure AD as an identity provider for my Azure Ad B2C instance.

To make it work i had to add the following redirect uri for my app registration (otherwise i saw an error when redirecting to b2c from azure ad):

https://login.microsoftonline.com/te/coredwexposureb2c.onmicrosoft.com/oauth2/authresp

It works fine on my localhost, with the following redirect uris configured:

however when i publish it to my web app, i need to add another redirect uri for my application:

https://coredwexposure.onmicrosoft.com

The portal does not allow me to save 3 redirect uris for the app registration - it says "You may not use more than 1 external domain(s)"

Please advise how can i fix that.

Can we link both email and username for the local identities

Hello,

I am trying to create a custom policy for setting both username and email when creating a new account to be used as part of the user's identity so they can sign in with either one. I was looking at the account-linking policy you have. Is this scenario possible via custom policy or must it be done via an api call via Microsoft Graph?

Invalid object name 'AspNetUsers'

I've tried to run deploy and run "WingTipToysWebApplication". I am getting the error "Invalid object name 'AspNetUsers'". I've created an empty database and configured it in the connection string. I believe code first create the schema but its throwing the above error.
Please let me know how to resolve it.

Example of a OrchestrationStep Type ReviewScreen

Hi, can you please include a working example of a User Journey which uses an orchestrationStep with Type = "ReviewScreen"

I keep getting a 500 error when trying to submit it so im not sure what I am doing wrong

Thanks

Validation errors do not communicate reason for failed validation

Does anyone have any advice on troubleshooting validation errors? I tried setting up Application Insights for my tenant but all I see is a generic message

"Error returned was 400/Request_BadRequest: One or more property values specified are invalid."

I had a working setup based on the starter pack. All I did was add a companyName field on signup and it fails validation. I posted more info at https://stackoverflow.com/questions/57186366/how-to-troubleshoot-validation-errors-in-azure-active-directory-b2c-custom-attri

How to check whether a user is exist in firebase before sending reset email?

I am using Firebase authentication in my React Native application development. The problem I am facing is On implementing reset password functionality users receiving emails even though they are not a registered user in Firebase.

1) How can I send reset password emails only for Firebase registered users ?

2) How can I achieve this from frontend side(React Native) ?

Here is the code I am using.


import firebase from '@react-native-firebase/app';

export function onForgotPassword(email: string) {
  firebase
    .auth()
    .sendPasswordResetEmail(email)
    .then(() => {
      // alert('Please check your email...');
    })
    .catch((e) => {
      NLog.log(e);
    });
}

Thanks in advance.

Add restrictions to claim and make the claim optional in custom policy

I am trying to add collect user details using LocalAccountSignUpWithLogonName custom policy.I have added <OutputClaim ClaimTypeReferenceId="email" />
to LocalAccountSignUpWithLogonName as outputclaim. I want to make the email field optional, but if user enter the email I want to enable the restrictions.Below is my email claim
<ClaimType Id="email"> <DisplayName>Your Email Address</DisplayName> <DataType>string</DataType> <DefaultPartnerClaimTypes> <Protocol Name="OpenIdConnect" PartnerClaimType="email" /> </DefaultPartnerClaimTypes> <UserHelpText>Email address that can be used to contact you.</UserHelpText> <UserInputType>TextBox</UserInputType> <Restriction> <Pattern RegularExpression="^[a-zA-Z0-9.+!#$%&'^_{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." /> </Restriction> </ClaimType>

But when I add the pattern restriction to claim its making the field mandatory.
It is possible to make the claim optional with restrictions.

Support for Elliptic Curve (EC) key types

When trying to connect Azure B2C with another IdP, using custom policies, we encounter the following error in AppInsights logging:

Key type not supported: 'EC'.
and it bails out with a FatalException

The IdP we're trying to connect to supports RSA and EC key types, and sends both of them in the JWKS endpoint.

B2C does not seem to handle the EC key type in the JWKS.

Could you please fix this? Or is there any setting in B2C we could use to prevent the error from happening?

Thanks in advance

user journey that does not create duplicate accounts

Is it possible to simply merge an account when the same email is already verified in an existing account?
How to reproduce:

signup/signin at https://wingtipgamesb2c.azurewebsites.net with local account (email1)
logoff
signup/signin with facebook (email1) - ISSUE: A new object is created here, IMHO it should offer to merge (link automatically)
logoff
signin with local (email1)
ID Menu: "link social",
use same facebook (Email1) and we get this error:

Account link error
We can't link your WingTip Toys account to your social account because your social account already exists.

ISSUE 2: Merge is not possible without first deleting an account

Is any of these issues possible to customize by using this policy framework?
thank you

ExploreAdmin List Policy does not work

(Transferring from BEEJONES Repository)

Error being returned is
User Authorization: TenantId parameter is missing in requestb5da28e2-df78-49a1-a9fc-1a83578a4fd3

It also uses the api/tenantPolicyList endoint rather than /api/policyList

/api/policylist?tenantId=myb2ctenanr.onmicrosoft.com works fine

Identities created from external source allow duplicate email addresses

Re: https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/51798b065ef524be87c0f41339708ab4159bd54a/B2CPolicies/Final/b2ccharm.onmicrosoft.com_B2C_1A_base.xml

I'm not sure what mechanism B2C is using to validate that the user registering is not already registered, but this policy does not seem to persist the "signInNames" value for the record, this means someone who registers as an external user with "[email protected]" can also register the same email "[email protected]" and create two records in the directory with the same email address but different identity providers.

@rojasja

Password Reset flow for Username Local Accounts

As Chris answered here, one way to ensure the password reset flow is being performed by the account owner is having a REST API which connects to MS Graph API and check the pair Username-Email.

I wonder if this can't be achieve with the advanced policies only. Any tips?

Spin Off WingTip Demo

IMO, the WingTip Games demo is worthy of its own Project.

i.e. Azure-Samples/active-directory-b2c-wingtip-demo

Multi-Teant Azure AD auth in b2c with custom policies.

I am trying to use Azure AD auth in b2c using the /common Azure AD enpoint. According to https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-devhowto-multi-tenant-overview#update-your-code-to-handle-multiple-issuer-values, there needs to be a mechanism to either 1.) Allow multiple issuers, or 2.) Specify a list of issuers b2c can validate against. I do not see any possible setting in the custom policies XML that would allow this. I was able to get Azure AD auth created sucessfully, just not multi-tenant now.

OutputClaimsTransformation identityProvider DefaultValue ignored

Hi,
I am using the following profile to authenticate against login.microsoft.com:

  <Domain>live.com</Domain>
  <DisplayName>Microsoft Account</DisplayName>
  <TechnicalProfiles>
	<TechnicalProfile Id="MicrosoftLive-OIDC">
	  <DisplayName>Microsoft Account</DisplayName>
	  <Protocol Name="OpenIdConnect" />
	  <Metadata>
		<Item Key="client_id">XXX</Item>
		<Item Key="UsePolicyInRedirectUri">0</Item>
		<Item Key="METADATA">https://login.microsoftonline.com/myTenantId/v2.0/.well-known/openid-configuration</Item>
		<Item Key="response_types">code</Item>
		<Item Key="scope">openid profile</Item>
		<Item Key="response_mode">form_post</Item>
		<Item Key="HttpBinding">POST</Item>
		<Item Key="DiscoverMetadataByTokenIssuer">true</Item>
		<Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com</Item>
	  </Metadata>
	  <CryptographicKeys>
		<Key Id="client_secret" StorageReferenceId="B2C_1A_MSASecret" />
	  </CryptographicKeys>
	  <OutputClaims>
	  	<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="live.com" />
		<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
		<OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="oid" />
		<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
	  </OutputClaims>
	  <OutputClaimsTransformations>
		<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
		<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
		<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
	  </OutputClaimsTransformations>
	  <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
	</TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>`

and I want to set a fixed value for identityProvider to live.com

However, the engine seems to ignore my DefaultValue claim mapping

<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="live.com" />

and it keeps reading the value from idp claim. Here is an extract from Application Insights trace:

""Key"": ""OutputClaimsTransformation"", ""Value"": { ""Values"": [ { ""Key"": ""MappingFromPartnerClaimType"", ""Value"": { ""PartnerClaimType"": ""idp"", ""PolicyClaimType"": ""identityProvider"" } },

For other claims it works ok.
Or if I instead try to map from a "fake" claim.
<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="fakeClaim" DefaultValue="live.com" />

Is there something special about this identityProvider claim?

B2C SAML response with incorrect entityID

I have configured Azure B2C as my SAML provider using the steps mentioned here.

XML i got from here https://tenant-name.b2clogin.com/tenant-name.onmicrosoft.com/policy-name/Samlp/metadata have entity ID as below
https://login.microsoftonline.com/cvtrial.onmicrosoft.com/B2C_1A_signup_signinsaml

But when a user attempts login from SP , the SAML response contains different uri in entity field. one embedded with "/te"
https://login.microsoftonline.com/te/cvtrial.onmicrosoft.com/B2C_1A_signup_signinsaml

For me to proceed , i have edited IDP metadata XML to include this te and updated on SP. Then it worked.

Unable to set `UserJourneyRecorderEndpoint` for use with journey recorder

I am following the document from Setup User Journey Recorder - B2C which mentions to change UserJourneyRecorderEndpoint attribute as https://<mycustomweb>.azurewebsites.net/stream?id=1a6bee1c-2d3f-4a95-a6a4-440a2c61d336

I have already set DeploymentMode="Development" but on uploading the policy file I get the following error.

Unable to upload policy. Reason : Validation failed: 1 validation error(s) found in policy "B2C_1A_SIGNUP_SIGNIN" of tenant ".onmicrosoft.com".Attribute UserJourneyRecorderEndpoint in the TrustFrameworkPolicy root node in policy 'B2C_1A_signup_signin' of tenant ' .onmicrosoft.com' can only have the value set to 'urn:journeyrecorder:applicationinsights'.

The web app is already deployed. I have also tested with my custom policies and out of the box starter pack policies but get the same error every time.

Microsoft updated their URLs

You want to change the instructions at the home page and change the IssuerURL to:
https://contoso.b2clogin.com/contoso.onmicrosoft.com/SAMLRPPolicy
instead of
https://login.microsoftonline.com/te/contoso.onmicrosoft.com/SAMLRPPolicy

MFA - cache second authentication

Is it possible to cache the requirement on phone verification? Perhaps a check box that only requires phone verification after 60 days? I believe Azure AD supports that feature....

Account-linking allows unlinking facebook which causes account-lockout.

<OrchestrationStep Order="6" Type="ClaimsExchange"> <ClaimsExchanges> <ClaimsExchange Id="LinkFacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH-Link" /> <ClaimsExchange Id="UnlinkFacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH-Unlink" /> </ClaimsExchanges> </OrchestrationStep>

Scenario:

sign up using facebook
user navigates to account-linking flow
selects UnlinkFacebookExchange

User is now locked out of account with no easy way for an admin to fix this. (password reset wouldn't work, sign up with facebook again creates a second account)

How can we avoid users from unlinking the only identity remaining?
Thanks so much in advance for your time & help!

Trying to make custom policy work with username instead of email

Hi there,

I am desperately trying to setup a custom policy that uses the users username for login and also provides a registration. To achieve this I took the example here and replaced every occurance of email with username or signInName. However, no matter what combination of username, signInName or signInNames.userName I use, the registration fails because it seems like Active Directory fails to create the user since it throws this exception (or one alike):

 {
	"Key": "Exception",
	"Value": {
		"Kind": "Handled",
		"HResult": "80131500",
		"Message": "An error occurred while writing User claims using identifier claim type \"signInNames.userName\" in tenant \"mytenant.onmicrosoft.com\". Error returned was 400/Request_BadRequest: One or more property values specified are invalid.",
		"Data": {
			"TenantId": "mytenat.onmicrosoft.com",
			"PolicyId": "B2C_1A_signup_signin"
		},
		"Exception": {
			"Kind": "Handled",
			"HResult": "80131509",
			"Message": "The remote server returned an error: (400) Bad Request.",
			"Data": {}
		}
	}
}

The related technical profile where the exception is thrown looks as follows:

<TechnicalProfile Id="AAD-UserWriteUsingLogonName">
	<Metadata>
		<Item Key="Operation">Write</Item>
		<Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
	</Metadata>
	<IncludeInSso>false</IncludeInSso>
	<InputClaims>
		<InputClaim ClaimTypeReferenceId="username" PartnerClaimType="signInNames.userName" Required="true" />
	</InputClaims>
	<PersistedClaims>
		<!-- Required claims -->
		<PersistedClaim ClaimTypeReferenceId="username" PartnerClaimType="signInNames.userName"/>
		<PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
		<PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password"/>
		<PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" />
		<PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" />
		<!-- Optional claims. -->
		<PersistedClaim ClaimTypeReferenceId="givenName" />
		<PersistedClaim ClaimTypeReferenceId="surname" />
	</PersistedClaims>
	<OutputClaims>
		<OutputClaim ClaimTypeReferenceId="objectId" />
		<OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
		<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
		<OutputClaim ClaimTypeReferenceId="userPrincipalName" />
		<OutputClaim ClaimTypeReferenceId="signInNames.userName" />
	</OutputClaims>
	<IncludeTechnicalProfile ReferenceId="AAD-Common" />
	<UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

Since I have tried every possible combination I really do not now to proceed with this. Hopefully you can push me in the right direction...

Thanks!

PS: Here's the complete TrustFrameworkBase.xml for your reference: https://gist.github.com/mmaedler/452c8bfdf179ef706931d36f1bb93183

Can I use two email addresses for MFA using custom policies?

I would just like to know, can we use two email addresses for Multi-factor authentication in custom policies just like two phone numbers. Is it possible to do that?

Any help would be appreciated in this regard.

Custom policies getting mixed together

I have two custom policies (six total files) that are very similar. They both allow signin through two of three ADFS servers I have set up. One server is shared by each policy and each policy also has its own server. For the unique ADFS servers, they each have a different technical profile policy1-SAML and policy2-SAML. For the shared server, each policy has its own technical profile but both technical profiles have the same name e.g. SharedProfile although the ClaimsExchange referencing the technical profile has a different name e.g.

Policy 1:
<ClaimsExchange Id="policy1Exchange" TechnicalProfileReferenceId="SharedProfile"/>

Policy 2:
<ClaimsExchange Id="policy2Exchange" TechnicalProfileReferenceId="SharedProfile"/>

If I sign in to policy 1 using the policy1Exchange, then open policy 2 and sign in using the policy2Exchange, policy 2 crashes after being unable to find the claims exchange from the other policy.

{
    "Kind": "FatalException",
    "Content": {
      "Time": "4:22 PM",
      "Exception": {
        "Kind": "Handled",
        "HResult": "80131509",
        "Message": "Claims exchange with id 'policy1Exchange' could not be found in orchestration step '2' and the step contains more than one claims exchange.",
        "Data": {}
      }
    }
  }

I was able to fix this by renaming the technical profile inside policy 2 which now has

<ClaimsExchange Id="policy2Exchange" TechnicalProfileReferenceId="Policy2SharedProfile"/>

I wouldn't expect two policies that aren't related to get their technical profiles mixed together like this.

"Object reference not set to an instance of an object." when login triggered on existing session

If the user attempts to invoke the login after they already have an active session cookie in B2C using AAD-UserReadUsingAlternativeSecurityId, an object reference error occurs.

If a pre-requisite is missing, it should display a more helpful error

Still investigating...

"Wrong Link" error in "Claim your free game rental email"

In the demo when I click on the link in the "Claim you free game rental email" I get the error:

"Wrong Link

You have clicked on an invalid link. Please make sure that you have typed the link correctly. If are copying this link from a mail reader please ensure that you have copied all the lines in the link."

If I copy and paste the URL in the email into my web browser it works successfully.

Repo Steps:

Go to https://wingtipgamesb2c.azurewebsites.net/Invitation/Create
Fill out the form. (I choose "Policy link" redemption method.)
Click on link in email.

Expected Results:

I should be able to click on the link in the email and be taken to the web page.

Actual Result:

Clicking on the link goes to a sendgrid.net page and the error message is shown.

Upload - Object reference not set to an instance of an object

Hi !

I'm working on Custom Policies for ADB2C.
Recently I've started to have some problems during the Upload of my policies.

Sometimes everything uploads fine and other times I just have an error and cannot upload it.
Here is the error : ##[error]An error has occurred.Validation failed: 1 validation error(s) found in policy "B2C_1A_COMMON_BASE" of tenant "XXXXX".Object reference not set to an instance of an object.62414603-5c62-440b-b772-a1792624c012AADB2C
(I have hidden the tenant)

Here is my Common Base Policy :

<TrustFrameworkPolicy
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
  PolicySchemaVersion="0.3.0.0"
  TenantId="{##Tenant##}"
  PolicyId="B2C_1A_Common_Base"
  PublicPolicyUri="http://{##Tenant##}/B2C_1A_Common_Base">
  <BuildingBlocks>
    <ClaimsSchema>
      <!-- C'est ici que sont déclarés les Claims utilisés tout au long de ce fichier -->
      <!--<ClaimType Id="socialIdpUserId">
        <DisplayName>Username</DisplayName>
        <DataType>string</DataType>
        <UserHelpText />
        <UserInputType>TextBox</UserInputType>
        <Restriction>
          <Pattern RegularExpression="^[a-zA-Z0-9]+[a-zA-Z0-9_-]*$" HelpText="The username you provided is not valid. It must begin with an alphabet or number and can contain alphabets, numbers and the following symbols: _ -" />
        </Restriction>
      </ClaimType>-->
      <ClaimType Id="tenantId">
        <DisplayName>User's Object's Tenant ID</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="tid" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="tid" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/tenantid" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Tenant identifier (ID) of the user object in Azure AD.</UserHelpText>
      </ClaimType>
      <ClaimType Id="objectId">
        <DisplayName>User's Object ID</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="oid" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="oid" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/objectidentifier" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Object identifier (ID) of the user object in Azure AD.</UserHelpText>
      </ClaimType>
      <ClaimType Id="publicId">
        <DisplayName>publicId</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="publicId" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="publicId" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/publicId" />
        </DefaultPartnerClaimTypes>
      </ClaimType>
      <!-- Claims needed for local accounts. -->
      <ClaimType Id="signInName">
        <DisplayName>Sign in name</DisplayName>
        <DataType>string</DataType>
        <UserHelpText />
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="signInNames.emailAddress">
        <DisplayName>Email Address</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Email address to use for signing in.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="passwordPolicies">
        <DisplayName>Password Policies</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Password policies used by Azure AD to determine password strength, expiry etc.</UserHelpText>
      </ClaimType>
      <ClaimType Id="client_id">
        <DisplayName>client_id</DisplayName>
        <DataType>string</DataType>
        <AdminHelpText>Special parameter passed to EvoSTS.</AdminHelpText>
        <UserHelpText>Special parameter passed to EvoSTS.</UserHelpText>
      </ClaimType>
      <ClaimType Id="resource_id">
        <DisplayName>resource_id</DisplayName>
        <DataType>string</DataType>
        <AdminHelpText>Special parameter passed to EvoSTS.</AdminHelpText>
        <UserHelpText>Special parameter passed to EvoSTS.</UserHelpText>
      </ClaimType>
      <ClaimType Id="sub">
        <DisplayName>Subject</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OpenIdConnect" PartnerClaimType="sub" />
        </DefaultPartnerClaimTypes>
        <UserHelpText />
      </ClaimType>
      <ClaimType Id="identityProvider">
        <DisplayName>Identity Provider</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="idp" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="idp" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/identityprovider" />
        </DefaultPartnerClaimTypes>
        <UserHelpText />
      </ClaimType>
      <ClaimType Id="displayName">
        <DisplayName>Display Name</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="unique_name" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="name" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Your display name.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="otherMails">
        <DisplayName>Alternate Email Addresses</DisplayName>
        <DataType>stringCollection</DataType>
        <UserHelpText>Email addresses that can be used to contact the user.</UserHelpText>
      </ClaimType>
      <ClaimType Id="userPrincipalName">
        <DisplayName>UserPrincipalName</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="upn" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="upn" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/userprincipalname" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Your user name as stored in the Azure Active Directory.</UserHelpText>
      </ClaimType>
      <ClaimType Id="upnUserName">
        <DisplayName>UPN User Name</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>The user name for creating user principal name.</UserHelpText>
      </ClaimType>
      <ClaimType Id="newUser">
        <DisplayName>User is new</DisplayName>
        <DataType>boolean</DataType>
        <UserHelpText />
      </ClaimType>
      <ClaimType Id="executed-SelfAsserted-Input">
        <DisplayName>Executed-SelfAsserted-Input</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>A claim that specifies whether attributes were collected from the user.</UserHelpText>
      </ClaimType>
      <ClaimType Id="authenticationSource">
        <DisplayName>AuthenticationSource</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Specifies whether the user was authenticated at Social IDP or local account.</UserHelpText>
      </ClaimType>
      <!-- SECTION II: Claims required to pass on special parameters (including some query string parameters) to other claims providers -->
      <ClaimType Id="nca">
        <DisplayName>nca</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
      </ClaimType>
      <ClaimType Id="grant_type">
        <DisplayName>grant_type</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
      </ClaimType>
      <ClaimType Id="scope">
        <DisplayName>scope</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
      </ClaimType>
      <ClaimType Id="objectIdFromSession">
        <DisplayName>objectIdFromSession</DisplayName>
        <DataType>boolean</DataType>
        <UserHelpText>Parameter provided by the default session management provider to indicate that the object id has been retrieved from an SSO session.</UserHelpText>
      </ClaimType>
      <ClaimType Id="isActiveMFASession">
        <DisplayName>isActiveMFASession</DisplayName>
        <DataType>boolean</DataType>
        <UserHelpText>Parameter provided by the MFA session management to indicate that the user has an active MFA session.</UserHelpText>
      </ClaimType>
      <!-- SECTION III: Additional claims that can be collected from the users, stored in the directory, and sent in the token. Add additional claims here. -->
      <ClaimType Id="groups">
        <DisplayName>Groups ids</DisplayName>
        <DataType>stringCollection</DataType>
      </ClaimType>
      <ClaimType Id="groupsNames">
        <DisplayName>Groups Names</DisplayName>
        <DataType>stringCollection</DataType>
      </ClaimType>
      <!-- SECTION IV: Formulaire -->
      <ClaimType Id="civility">
        <DisplayName>Civility</DisplayName>
        <DataType>string</DataType>
        <UserInputType>DropdownSingleSelect</UserInputType>
        <Restriction>
          <Enumeration Text="Monsieur" Value="M" SelectByDefault="false" />
          <Enumeration Text="Madame" Value="MME" SelectByDefault="false" />
          <Enumeration Text="Mademoiselle" Value="MISS" SelectByDefault="false" />
          <Enumeration Text="Mister" Value="MR" SelectByDefault="false" />
          <Enumeration Text="Mistress" Value="MRS" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="givenName">
        <DisplayName>Given Name</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="given_name" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="given_name" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Your given name (also known as first name).</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="surname">
        <DisplayName>Surname</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="family_name" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="family_name" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Your surname (also known as family name or last name).</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="email">
        <DisplayName>Email Address</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OpenIdConnect" PartnerClaimType="email" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Email address that can be used to contact you.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
        <Restriction>
          <Pattern RegularExpression="^[a-zA-Z0-9.!#$%&amp;'^_`{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." />
        </Restriction>
      </ClaimType>
      <ClaimType Id="password">
        <DisplayName>Password</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Enter password</UserHelpText>
        <UserInputType>Password</UserInputType>
      </ClaimType>
      <!-- The claim types newPassword and reenterPassword are considered special, please do not change the names. 
           The UI validates the the user correctly re-entered their password during account creation based on these 
           claim types.   -->
      <ClaimType Id="newPassword">
        <DisplayName>New Password</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Enter new password</UserHelpText>
        <UserInputType>Password</UserInputType>
        <Restriction>
          <Pattern RegularExpression="^((?=.*[a-z])(?=.*[A-Z])(?=.*\d)|(?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9])|(?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9])|(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]))([A-Za-z\d@#$%^&amp;*\-_+=[\]{}|\\:',?/`~&quot;();!]|\.(?!@)){8,16}$" HelpText="8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ &quot; ( ) ; ." />
        </Restriction>
      </ClaimType>
      <!-- The password regular expression above is constructed for AAD passwords based on restrictions at https://msdn.microsoft.com/en-us/library/azure/jj943764.aspx

        ^( # one of the following four combinations must appear in the password
         (?=.*[a-z])(?=.*[A-Z])(?=.*\d) |            # matches lower case, upper case or digit
         (?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9]) |  # matches lower case, upper case or special character (i.e. non-alpha or digit)
         (?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9]) |     # matches lower case, digit, or special character
         (?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9])       # matches upper case, digit, or special character
        )
        ( # The password must match the following restrictions
         [A-Za-z\d@#$%^&*\-_+=[\]{}|\\:',?/`~"();!] |   # The list of all acceptable characters (without .)
         \.(?!@)                                        # or . can appear as long as not followed by @
        ) {8,16}$                                       # the length must be between 8 and 16 chars inclusive

      -->
      <ClaimType Id="reenterPassword">
        <DisplayName>Confirm New Password</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Confirm new password</UserHelpText>
        <UserInputType>Password</UserInputType>
        <Restriction>
          <Pattern RegularExpression="^((?=.*[a-z])(?=.*[A-Z])(?=.*\d)|(?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9])|(?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9])|(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]))([A-Za-z\d@#$%^&amp;*\-_+=[\]{}|\\:',?/`~&quot;();!]|\.(?!@)){8,16}$" HelpText=" " />
        </Restriction>
      </ClaimType>
      <ClaimType Id="mobile">
        <DisplayName>Mobile</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Your mobile phone.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="birthdate">
        <DisplayName>Birthdate</DisplayName>
        <DataType>date</DataType>
        <UserInputType>DateTimeDropdown</UserInputType>
      </ClaimType>
      <ClaimType Id="street1">
        <DisplayName>Street 1</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Your street 1 address.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="street2">
        <DisplayName>Street 2</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Your street 2 address.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="street3">
        <DisplayName>Street 3</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Your street 3 address.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="street4">
        <DisplayName>Street 4</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Your street 4 address.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="zipCode">
        <DisplayName>Zip Code</DisplayName>
        <DataType>string</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OAuth2" PartnerClaimType="postal_code" />
          <Protocol Name="OpenIdConnect" PartnerClaimType="postal_code" />
          <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcode" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Your zip code.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="city">
        <DisplayName>City</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Your city.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>
      <ClaimType Id="country">
        <DisplayName>Country</DisplayName>
        <DataType>string</DataType>
        <UserInputType>DropdownSingleSelect</UserInputType>
        <Restriction>
          <Enumeration Text="ABW" Value="ABW" SelectByDefault="false" />
          <Enumeration Text="AFG" Value="AFG" SelectByDefault="false" />
          <Enumeration Text="AGO" Value="AGO" SelectByDefault="false" />
          <Enumeration Text="AIA" Value="AIA" SelectByDefault="false" />
          <Enumeration Text="ALA" Value="ALA" SelectByDefault="false" />
          <Enumeration Text="ALB" Value="ALB" SelectByDefault="false" />
          <Enumeration Text="AND" Value="AND" SelectByDefault="false" />
          <Enumeration Text="ANT" Value="ANT" SelectByDefault="false" />
          <Enumeration Text="ARE" Value="ARE" SelectByDefault="false" />
          <Enumeration Text="ARG" Value="ARG" SelectByDefault="false" />
          <Enumeration Text="ARM" Value="ARM" SelectByDefault="false" />
          <Enumeration Text="ASM" Value="ASM" SelectByDefault="false" />
          <Enumeration Text="ATA" Value="ATA" SelectByDefault="false" />
          <Enumeration Text="ATF" Value="ATF" SelectByDefault="false" />
          <Enumeration Text="ATG" Value="ATG" SelectByDefault="false" />
          <Enumeration Text="AUS" Value="AUS" SelectByDefault="false" />
          <Enumeration Text="AUT" Value="AUT" SelectByDefault="false" />
          <Enumeration Text="AZE" Value="AZE" SelectByDefault="false" />
          <Enumeration Text="BDI" Value="BDI" SelectByDefault="false" />
          <Enumeration Text="BEL" Value="BEL" SelectByDefault="false" />
          <Enumeration Text="BEN" Value="BEN" SelectByDefault="false" />
          <Enumeration Text="BFA" Value="BFA" SelectByDefault="false" />
          <Enumeration Text="BGD" Value="BGD" SelectByDefault="false" />
          <Enumeration Text="BGR" Value="BGR" SelectByDefault="false" />
          <Enumeration Text="BHR" Value="BHR" SelectByDefault="false" />
          <Enumeration Text="BHS" Value="BHS" SelectByDefault="false" />
          <Enumeration Text="BIH" Value="BIH" SelectByDefault="false" />
          <Enumeration Text="BLR" Value="BLR" SelectByDefault="false" />
          <Enumeration Text="BLZ" Value="BLZ" SelectByDefault="false" />
          <Enumeration Text="BMU" Value="BMU" SelectByDefault="false" />
          <Enumeration Text="BOL" Value="BOL" SelectByDefault="false" />
          <Enumeration Text="BRA" Value="BRA" SelectByDefault="false" />
          <Enumeration Text="BRB" Value="BRB" SelectByDefault="false" />
          <Enumeration Text="BRN" Value="BRN" SelectByDefault="false" />
          <Enumeration Text="BTN" Value="BTN" SelectByDefault="false" />
          <Enumeration Text="BVT" Value="BVT" SelectByDefault="false" />
          <Enumeration Text="BWA" Value="BWA" SelectByDefault="false" />
          <Enumeration Text="CAF" Value="CAF" SelectByDefault="false" />
          <Enumeration Text="CAN" Value="CAN" SelectByDefault="false" />
          <Enumeration Text="CCK" Value="CCK" SelectByDefault="false" />
          <Enumeration Text="CHE" Value="CHE" SelectByDefault="false" />
          <Enumeration Text="CHL" Value="CHL" SelectByDefault="false" />
          <Enumeration Text="CHN" Value="CHN" SelectByDefault="false" />
          <Enumeration Text="CIV" Value="CIV" SelectByDefault="false" />
          <Enumeration Text="CMR" Value="CMR" SelectByDefault="false" />
          <Enumeration Text="COD" Value="COD" SelectByDefault="false" />
          <Enumeration Text="COG" Value="COG" SelectByDefault="false" />
          <Enumeration Text="COK" Value="COK" SelectByDefault="false" />
          <Enumeration Text="COL" Value="COL" SelectByDefault="false" />
          <Enumeration Text="COM" Value="COM" SelectByDefault="false" />
          <Enumeration Text="CPV" Value="CPV" SelectByDefault="false" />
          <Enumeration Text="CRI" Value="CRI" SelectByDefault="false" />
          <Enumeration Text="CUB" Value="CUB" SelectByDefault="false" />
          <Enumeration Text="CXR" Value="CXR" SelectByDefault="false" />
          <Enumeration Text="CYM" Value="CYM" SelectByDefault="false" />
          <Enumeration Text="CYP" Value="CYP" SelectByDefault="false" />
          <Enumeration Text="CZE" Value="CZE" SelectByDefault="false" />
          <Enumeration Text="DEU" Value="DEU" SelectByDefault="false" />
          <Enumeration Text="DJI" Value="DJI" SelectByDefault="false" />
          <Enumeration Text="DMA" Value="DMA" SelectByDefault="false" />
          <Enumeration Text="DNK" Value="DNK" SelectByDefault="false" />
          <Enumeration Text="DOM" Value="DOM" SelectByDefault="false" />
          <Enumeration Text="DZA" Value="DZA" SelectByDefault="false" />
          <Enumeration Text="ECU" Value="ECU" SelectByDefault="false" />
          <Enumeration Text="EGY" Value="EGY" SelectByDefault="false" />
          <Enumeration Text="ERI" Value="ERI" SelectByDefault="false" />
          <Enumeration Text="ESH" Value="ESH" SelectByDefault="false" />
          <Enumeration Text="ESP" Value="ESP" SelectByDefault="false" />
          <Enumeration Text="EST" Value="EST" SelectByDefault="false" />
          <Enumeration Text="ETH" Value="ETH" SelectByDefault="false" />
          <Enumeration Text="FIN" Value="FIN" SelectByDefault="false" />
          <Enumeration Text="FJI" Value="FJI" SelectByDefault="false" />
          <Enumeration Text="FLK" Value="FLK" SelectByDefault="false" />
          <Enumeration Text="FRA" Value="FRA" SelectByDefault="false" />
          <Enumeration Text="FRO" Value="FRO" SelectByDefault="false" />
          <Enumeration Text="FSM" Value="FSM" SelectByDefault="false" />
          <Enumeration Text="GAB" Value="GAB" SelectByDefault="false" />
          <Enumeration Text="GBR" Value="GBR" SelectByDefault="false" />
          <Enumeration Text="GEO" Value="GEO" SelectByDefault="false" />
          <Enumeration Text="GHA" Value="GHA" SelectByDefault="false" />
          <Enumeration Text="GIB" Value="GIB" SelectByDefault="false" />
          <Enumeration Text="GIN" Value="GIN" SelectByDefault="false" />
          <Enumeration Text="GLP" Value="GLP" SelectByDefault="false" />
          <Enumeration Text="GMB" Value="GMB" SelectByDefault="false" />
          <Enumeration Text="GNB" Value="GNB" SelectByDefault="false" />
          <Enumeration Text="GNQ" Value="GNQ" SelectByDefault="false" />
          <Enumeration Text="GRC" Value="GRC" SelectByDefault="false" />
          <Enumeration Text="GRD" Value="GRD" SelectByDefault="false" />
          <Enumeration Text="GRL" Value="GRL" SelectByDefault="false" />
          <Enumeration Text="GTM" Value="GTM" SelectByDefault="false" />
          <Enumeration Text="GUF" Value="GUF" SelectByDefault="false" />
          <Enumeration Text="GUM" Value="GUM" SelectByDefault="false" />
          <Enumeration Text="GUY" Value="GUY" SelectByDefault="false" />
          <Enumeration Text="HKG" Value="HKG" SelectByDefault="false" />
          <Enumeration Text="HMD" Value="HMD" SelectByDefault="false" />
          <Enumeration Text="HND" Value="HND" SelectByDefault="false" />
          <Enumeration Text="HRV" Value="HRV" SelectByDefault="false" />
          <Enumeration Text="HTI" Value="HTI" SelectByDefault="false" />
          <Enumeration Text="HUN" Value="HUN" SelectByDefault="false" />
          <Enumeration Text="IDN" Value="IDN" SelectByDefault="false" />
          <Enumeration Text="IMN" Value="IMN" SelectByDefault="false" />
          <Enumeration Text="IND" Value="IND" SelectByDefault="false" />
          <Enumeration Text="IOT" Value="IOT" SelectByDefault="false" />
          <Enumeration Text="IRL" Value="IRL" SelectByDefault="false" />
          <Enumeration Text="IRN" Value="IRN" SelectByDefault="false" />
          <Enumeration Text="IRQ" Value="IRQ" SelectByDefault="false" />
          <Enumeration Text="ISL" Value="ISL" SelectByDefault="false" />
          <Enumeration Text="ISR" Value="ISR" SelectByDefault="false" />
          <Enumeration Text="ITA" Value="ITA" SelectByDefault="false" />
          <Enumeration Text="JAM" Value="JAM" SelectByDefault="false" />
          <Enumeration Text="JEY" Value="JEY" SelectByDefault="false" />
          <Enumeration Text="JOR" Value="JOR" SelectByDefault="false" />
          <Enumeration Text="JPN" Value="JPN" SelectByDefault="false" />
          <Enumeration Text="KAZ" Value="KAZ" SelectByDefault="false" />
          <Enumeration Text="KEN" Value="KEN" SelectByDefault="false" />
          <Enumeration Text="KGZ" Value="KGZ" SelectByDefault="false" />
          <Enumeration Text="KHM" Value="KHM" SelectByDefault="false" />
          <Enumeration Text="KIR" Value="KIR" SelectByDefault="false" />
          <Enumeration Text="KNA" Value="KNA" SelectByDefault="false" />
          <Enumeration Text="KOR" Value="KOR" SelectByDefault="false" />
          <Enumeration Text="KWT" Value="KWT" SelectByDefault="false" />
          <Enumeration Text="LAO" Value="LAO" SelectByDefault="false" />
          <Enumeration Text="LBN" Value="LBN" SelectByDefault="false" />
          <Enumeration Text="LBR" Value="LBR" SelectByDefault="false" />
          <Enumeration Text="LBY" Value="LBY" SelectByDefault="false" />
          <Enumeration Text="LCA" Value="LCA" SelectByDefault="false" />
          <Enumeration Text="LIE" Value="LIE" SelectByDefault="false" />
          <Enumeration Text="LKA" Value="LKA" SelectByDefault="false" />
          <Enumeration Text="LSO" Value="LSO" SelectByDefault="false" />
          <Enumeration Text="LTU" Value="LTU" SelectByDefault="false" />
          <Enumeration Text="LUX" Value="LUX" SelectByDefault="false" />
          <Enumeration Text="LVA" Value="LVA" SelectByDefault="false" />
          <Enumeration Text="MAC" Value="MAC" SelectByDefault="false" />
          <Enumeration Text="MAR" Value="MAR" SelectByDefault="false" />
          <Enumeration Text="MCO" Value="MCO" SelectByDefault="false" />
          <Enumeration Text="MDA" Value="MDA" SelectByDefault="false" />
          <Enumeration Text="MDG" Value="MDG" SelectByDefault="false" />
          <Enumeration Text="MDV" Value="MDV" SelectByDefault="false" />
          <Enumeration Text="MEX" Value="MEX" SelectByDefault="false" />
          <Enumeration Text="MHL" Value="MHL" SelectByDefault="false" />
          <Enumeration Text="MKD" Value="MKD" SelectByDefault="false" />
          <Enumeration Text="MLI" Value="MLI" SelectByDefault="false" />
          <Enumeration Text="MLT" Value="MLT" SelectByDefault="false" />
          <Enumeration Text="MMR" Value="MMR" SelectByDefault="false" />
          <Enumeration Text="MNG" Value="MNG" SelectByDefault="false" />
          <Enumeration Text="MNP" Value="MNP" SelectByDefault="false" />
          <Enumeration Text="MOZ" Value="MOZ" SelectByDefault="false" />
          <Enumeration Text="MRT" Value="MRT" SelectByDefault="false" />
          <Enumeration Text="MSR" Value="MSR" SelectByDefault="false" />
          <Enumeration Text="MTQ" Value="MTQ" SelectByDefault="false" />
          <Enumeration Text="MUS" Value="MUS" SelectByDefault="false" />
          <Enumeration Text="MWI" Value="MWI" SelectByDefault="false" />
          <Enumeration Text="MYS" Value="MYS" SelectByDefault="false" />
          <Enumeration Text="MYT" Value="MYT" SelectByDefault="false" />
          <Enumeration Text="NAM" Value="NAM" SelectByDefault="false" />
          <Enumeration Text="NCL" Value="NCL" SelectByDefault="false" />
          <Enumeration Text="NER" Value="NER" SelectByDefault="false" />
          <Enumeration Text="NFK" Value="NFK" SelectByDefault="false" />
          <Enumeration Text="NGA" Value="NGA" SelectByDefault="false" />
          <Enumeration Text="NIC" Value="NIC" SelectByDefault="false" />
          <Enumeration Text="NIU" Value="NIU" SelectByDefault="false" />
          <Enumeration Text="NLD" Value="NLD" SelectByDefault="false" />
          <Enumeration Text="NOR" Value="NOR" SelectByDefault="false" />
          <Enumeration Text="NPL" Value="NPL" SelectByDefault="false" />
          <Enumeration Text="NRU" Value="NRU" SelectByDefault="false" />
          <Enumeration Text="NZL" Value="NZL" SelectByDefault="false" />
          <Enumeration Text="OMN" Value="OMN" SelectByDefault="false" />
          <Enumeration Text="PAK" Value="PAK" SelectByDefault="false" />
          <Enumeration Text="PAN" Value="PAN" SelectByDefault="false" />
          <Enumeration Text="PCN" Value="PCN" SelectByDefault="false" />
          <Enumeration Text="PER" Value="PER" SelectByDefault="false" />
          <Enumeration Text="PHL" Value="PHL" SelectByDefault="false" />
          <Enumeration Text="PLW" Value="PLW" SelectByDefault="false" />
          <Enumeration Text="PNG" Value="PNG" SelectByDefault="false" />
          <Enumeration Text="POL" Value="POL" SelectByDefault="false" />
          <Enumeration Text="PRI" Value="PRI" SelectByDefault="false" />
          <Enumeration Text="PRK" Value="PRK" SelectByDefault="false" />
          <Enumeration Text="PRT" Value="PRT" SelectByDefault="false" />
          <Enumeration Text="PRY" Value="PRY" SelectByDefault="false" />
          <Enumeration Text="PSE" Value="PSE" SelectByDefault="false" />
          <Enumeration Text="PYF" Value="PYF" SelectByDefault="false" />
          <Enumeration Text="QAT" Value="QAT" SelectByDefault="false" />
          <Enumeration Text="REU" Value="REU" SelectByDefault="false" />
          <Enumeration Text="ROU" Value="ROU" SelectByDefault="false" />
          <Enumeration Text="RUS" Value="RUS" SelectByDefault="false" />
          <Enumeration Text="RWA" Value="RWA" SelectByDefault="false" />
          <Enumeration Text="SAU" Value="SAU" SelectByDefault="false" />
          <Enumeration Text="SCG" Value="SCG" SelectByDefault="false" />
          <Enumeration Text="SDN" Value="SDN" SelectByDefault="false" />
          <Enumeration Text="SEN" Value="SEN" SelectByDefault="false" />
          <Enumeration Text="SGP" Value="SGP" SelectByDefault="false" />
          <Enumeration Text="SGS" Value="SGS" SelectByDefault="false" />
          <Enumeration Text="SHN" Value="SHN" SelectByDefault="false" />
          <Enumeration Text="SJM" Value="SJM" SelectByDefault="false" />
          <Enumeration Text="SLB" Value="SLB" SelectByDefault="false" />
          <Enumeration Text="SLE" Value="SLE" SelectByDefault="false" />
          <Enumeration Text="SLV" Value="SLV" SelectByDefault="false" />
          <Enumeration Text="SMR" Value="SMR" SelectByDefault="false" />
          <Enumeration Text="SOM" Value="SOM" SelectByDefault="false" />
          <Enumeration Text="SPM" Value="SPM" SelectByDefault="false" />
          <Enumeration Text="STP" Value="STP" SelectByDefault="false" />
          <Enumeration Text="SUR" Value="SUR" SelectByDefault="false" />
          <Enumeration Text="SVK" Value="SVK" SelectByDefault="false" />
          <Enumeration Text="SVN" Value="SVN" SelectByDefault="false" />
          <Enumeration Text="SWE" Value="SWE" SelectByDefault="false" />
          <Enumeration Text="SWZ" Value="SWZ" SelectByDefault="false" />
          <Enumeration Text="SYC" Value="SYC" SelectByDefault="false" />
          <Enumeration Text="SYR" Value="SYR" SelectByDefault="false" />
          <Enumeration Text="TCA" Value="TCA" SelectByDefault="false" />
          <Enumeration Text="TCD" Value="TCD" SelectByDefault="false" />
          <Enumeration Text="TGO" Value="TGO" SelectByDefault="false" />
          <Enumeration Text="THA" Value="THA" SelectByDefault="false" />
          <Enumeration Text="TJK" Value="TJK" SelectByDefault="false" />
          <Enumeration Text="TKL" Value="TKL" SelectByDefault="false" />
          <Enumeration Text="TKM" Value="TKM" SelectByDefault="false" />
          <Enumeration Text="TLS" Value="TLS" SelectByDefault="false" />
          <Enumeration Text="TON" Value="TON" SelectByDefault="false" />
          <Enumeration Text="TTO" Value="TTO" SelectByDefault="false" />
          <Enumeration Text="TUN" Value="TUN" SelectByDefault="false" />
          <Enumeration Text="TUR" Value="TUR" SelectByDefault="false" />
          <Enumeration Text="TUV" Value="TUV" SelectByDefault="false" />
          <Enumeration Text="TWN" Value="TWN" SelectByDefault="false" />
          <Enumeration Text="TZA" Value="TZA" SelectByDefault="false" />
          <Enumeration Text="UGA" Value="UGA" SelectByDefault="false" />
          <Enumeration Text="UKR" Value="UKR" SelectByDefault="false" />
          <Enumeration Text="UMI" Value="UMI" SelectByDefault="false" />
          <Enumeration Text="URY" Value="URY" SelectByDefault="false" />
          <Enumeration Text="USA" Value="USA" SelectByDefault="false" />
          <Enumeration Text="UZB" Value="UZB" SelectByDefault="false" />
          <Enumeration Text="VAT" Value="VAT" SelectByDefault="false" />
          <Enumeration Text="VCT" Value="VCT" SelectByDefault="false" />
          <Enumeration Text="VEN" Value="VEN" SelectByDefault="false" />
          <Enumeration Text="VGB" Value="VGB" SelectByDefault="false" />
          <Enumeration Text="VIR" Value="VIR" SelectByDefault="false" />
          <Enumeration Text="VNM" Value="VNM" SelectByDefault="false" />
          <Enumeration Text="VUT" Value="VUT" SelectByDefault="false" />
          <Enumeration Text="WLF" Value="WLF" SelectByDefault="false" />
          <Enumeration Text="WSM" Value="WSM" SelectByDefault="false" />
          <Enumeration Text="YEM" Value="YEM" SelectByDefault="false" />
          <Enumeration Text="ZAF" Value="ZAF" SelectByDefault="false" />
          <Enumeration Text="ZMB" Value="ZMB" SelectByDefault="false" />
          <Enumeration Text="ZWE" Value="ZWE" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="language">
        <DisplayName>Language</DisplayName>
        <DataType>string</DataType>
        <UserInputType>DropdownSingleSelect</UserInputType>
        <Restriction>
          <Enumeration Text="Abkhazian" Value="Abkhazian" SelectByDefault="false" />
          <Enumeration Text="Afar" Value="Afar" SelectByDefault="false" />
          <Enumeration Text="Afrikaans" Value="Afrikaans" SelectByDefault="false" />
          <Enumeration Text="Akan" Value="Akan" SelectByDefault="false" />
          <Enumeration Text="Albanian" Value="Albanian" SelectByDefault="false" />
          <Enumeration Text="Amharic" Value="Amharic" SelectByDefault="false" />
          <Enumeration Text="Arabic" Value="Arabic" SelectByDefault="false" />
          <Enumeration Text="Armenian" Value="Armenian" SelectByDefault="false" />
          <Enumeration Text="Assamese" Value="Assamese" SelectByDefault="false" />
          <Enumeration Text="Asturian" Value="Asturian" SelectByDefault="false" />
          <Enumeration Text="Avar" Value="Avar" SelectByDefault="false" />
          <Enumeration Text="Avestan" Value="Avestan" SelectByDefault="false" />
          <Enumeration Text="Aymara" Value="Aymara" SelectByDefault="false" />
          <Enumeration Text="Azerbaijani" Value="Azerbaijani" SelectByDefault="false" />
          <Enumeration Text="Bambara" Value="Bambara" SelectByDefault="false" />
          <Enumeration Text="Bashkir" Value="Bashkir" SelectByDefault="false" />
          <Enumeration Text="Basque" Value="Basque" SelectByDefault="false" />
          <Enumeration Text="Belarusian" Value="Belarusian" SelectByDefault="false" />
          <Enumeration Text="Bengali" Value="Bengali" SelectByDefault="false" />
          <Enumeration Text="Bhutani" Value="Bhutani" SelectByDefault="false" />
          <Enumeration Text="Bihari" Value="Bihari" SelectByDefault="false" />
          <Enumeration Text="Bislama" Value="Bislama" SelectByDefault="false" />
          <Enumeration Text="Bosnian" Value="Bosnian" SelectByDefault="false" />
          <Enumeration Text="Breton" Value="Breton" SelectByDefault="false" />
          <Enumeration Text="Bulgarian" Value="Bulgarian" SelectByDefault="false" />
          <Enumeration Text="Burmese" Value="Burmese" SelectByDefault="false" />
          <Enumeration Text="Cambodian" Value="Cambodian" SelectByDefault="false" />
          <Enumeration Text="Catalan" Value="Catalan" SelectByDefault="false" />
          <Enumeration Text="Chamorro" Value="Chamorro" SelectByDefault="false" />
          <Enumeration Text="Chechen" Value="Chechen" SelectByDefault="false" />
          <Enumeration Text="Chichewa" Value="Chichewa" SelectByDefault="false" />
          <Enumeration Text="Chinese Simplified" Value="Chinese Simplified" SelectByDefault="false" />
          <Enumeration Text="Chinese Traditional" Value="Chinese Traditional" SelectByDefault="false" />
          <Enumeration Text="Chuvash" Value="Chuvash" SelectByDefault="false" />
          <Enumeration Text="Cornish" Value="Cornish" SelectByDefault="false" />
          <Enumeration Text="Corsican" Value="Corsican" SelectByDefault="false" />
          <Enumeration Text="Cree" Value="Cree" SelectByDefault="false" />
          <Enumeration Text="Croatian" Value="Croatian" SelectByDefault="false" />
          <Enumeration Text="Czech" Value="Czech" SelectByDefault="false" />
          <Enumeration Text="Danish" Value="Danish" SelectByDefault="false" />
          <Enumeration Text="Dutch" Value="Dutch" SelectByDefault="false" />
          <Enumeration Text="English" Value="English" SelectByDefault="false" />
          <Enumeration Text="English British" Value="English British" SelectByDefault="false" />
          <Enumeration Text="Esperanto" Value="Esperanto" SelectByDefault="false" />
          <Enumeration Text="Estonian" Value="Estonian" SelectByDefault="false" />
          <Enumeration Text="Ewe" Value="Ewe" SelectByDefault="false" />
          <Enumeration Text="Faeroese" Value="Faeroese" SelectByDefault="false" />
          <Enumeration Text="Fiji" Value="Fiji" SelectByDefault="false" />
          <Enumeration Text="Filipino" Value="Filipino" SelectByDefault="false" />
          <Enumeration Text="Finnish" Value="Finnish" SelectByDefault="false" />
          <Enumeration Text="French" Value="French" SelectByDefault="false" />
          <Enumeration Text="Frisian" Value="Frisian" SelectByDefault="false" />
          <Enumeration Text="Fulah" Value="Fulah" SelectByDefault="false" />
          <Enumeration Text="Galician" Value="Galician" SelectByDefault="false" />
          <Enumeration Text="Georgian" Value="Georgian" SelectByDefault="false" />
          <Enumeration Text="German" Value="German" SelectByDefault="false" />
          <Enumeration Text="Greek" Value="Greek" SelectByDefault="false" />
          <Enumeration Text="Greenlandic" Value="Greenlandic" SelectByDefault="false" />
          <Enumeration Text="Guarani" Value="Guarani" SelectByDefault="false" />
          <Enumeration Text="Gujarati" Value="Gujarati" SelectByDefault="false" />
          <Enumeration Text="HaitianCreole" Value="HaitianCreole" SelectByDefault="false" />
          <Enumeration Text="Hausa" Value="Hausa" SelectByDefault="false" />
          <Enumeration Text="Hebrew" Value="Hebrew" SelectByDefault="false" />
          <Enumeration Text="Herero" Value="Herero" SelectByDefault="false" />
          <Enumeration Text="Hindi" Value="Hindi" SelectByDefault="false" />
          <Enumeration Text="HiriMotu" Value="HiriMotu" SelectByDefault="false" />
          <Enumeration Text="Hungarian" Value="Hungarian" SelectByDefault="false" />
          <Enumeration Text="Icelandic" Value="Icelandic" SelectByDefault="false" />
          <Enumeration Text="Igbo" Value="Igbo" SelectByDefault="false" />
          <Enumeration Text="Indonesian" Value="Indonesian" SelectByDefault="false" />
          <Enumeration Text="Interlingua" Value="Interlingua" SelectByDefault="false" />
          <Enumeration Text="Interlingue" Value="Interlingue" SelectByDefault="false" />
          <Enumeration Text="Inuktitut" Value="Inuktitut" SelectByDefault="false" />
          <Enumeration Text="Inupiak" Value="Inupiak" SelectByDefault="false" />
          <Enumeration Text="Irish" Value="Irish" SelectByDefault="false" />
          <Enumeration Text="Italian" Value="Italian" SelectByDefault="false" />
          <Enumeration Text="Japanese" Value="Japanese" SelectByDefault="false" />
          <Enumeration Text="Javanese" Value="Javanese" SelectByDefault="false" />
          <Enumeration Text="Kannada" Value="Kannada" SelectByDefault="false" />
          <Enumeration Text="Kanuri" Value="Kanuri" SelectByDefault="false" />
          <Enumeration Text="Kashmiri" Value="Kashmiri" SelectByDefault="false" />
          <Enumeration Text="Kazakh" Value="Kazakh" SelectByDefault="false" />
          <Enumeration Text="Kikuyu" Value="Kikuyu" SelectByDefault="false" />
          <Enumeration Text="Kinyarwanda" Value="Kinyarwanda" SelectByDefault="false" />
          <Enumeration Text="Kirundi" Value="Kirundi" SelectByDefault="false" />
          <Enumeration Text="Komi" Value="Komi" SelectByDefault="false" />
          <Enumeration Text="Kongo" Value="Kongo" SelectByDefault="false" />
          <Enumeration Text="Korean" Value="Korean" SelectByDefault="false" />
          <Enumeration Text="Kurdish" Value="Kurdish" SelectByDefault="false" />
          <Enumeration Text="Kwanyama" Value="Kwanyama" SelectByDefault="false" />
          <Enumeration Text="Kyrgyz" Value="Kyrgyz" SelectByDefault="false" />
          <Enumeration Text="Laothian" Value="Laothian" SelectByDefault="false" />
          <Enumeration Text="Latin" Value="Latin" SelectByDefault="false" />
          <Enumeration Text="Latvian" Value="Latvian" SelectByDefault="false" />
          <Enumeration Text="Lingala" Value="Lingala" SelectByDefault="false" />
          <Enumeration Text="Lithuanian" Value="Lithuanian" SelectByDefault="false" />
          <Enumeration Text="Lolspeak" Value="Lolspeak" SelectByDefault="false" />
          <Enumeration Text="Luganda" Value="Luganda" SelectByDefault="false" />
          <Enumeration Text="Luxembourgish" Value="Luxembourgish" SelectByDefault="false" />
          <Enumeration Text="Macedonian" Value="Macedonian" SelectByDefault="false" />
          <Enumeration Text="Malagasy" Value="Malagasy" SelectByDefault="false" />
          <Enumeration Text="Malay" Value="Malay" SelectByDefault="false" />
          <Enumeration Text="Malayalam" Value="Malayalam" SelectByDefault="false" />
          <Enumeration Text="Maldivian" Value="Maldivian" SelectByDefault="false" />
          <Enumeration Text="Maltese" Value="Maltese" SelectByDefault="false" />
          <Enumeration Text="Manx" Value="Manx" SelectByDefault="false" />
          <Enumeration Text="Maori" Value="Maori" SelectByDefault="false" />
          <Enumeration Text="Marathi" Value="Marathi" SelectByDefault="false" />
          <Enumeration Text="Marshallese" Value="Marshallese" SelectByDefault="false" />
          <Enumeration Text="Moldavian" Value="Moldavian" SelectByDefault="false" />
          <Enumeration Text="Mongolian" Value="Mongolian" SelectByDefault="false" />
          <Enumeration Text="Nauru" Value="Nauru" SelectByDefault="false" />
          <Enumeration Text="Navajo" Value="Navajo" SelectByDefault="false" />
          <Enumeration Text="Ndonga" Value="Ndonga" SelectByDefault="false" />
          <Enumeration Text="Nepali" Value="Nepali" SelectByDefault="false" />
          <Enumeration Text="NorthernSami" Value="NorthernSami" SelectByDefault="false" />
          <Enumeration Text="NorthNdebele" Value="NorthNdebele" SelectByDefault="false" />
          <Enumeration Text="NorwegianBokmål" Value="NorwegianBokmål" SelectByDefault="false" />
          <Enumeration Text="NorwegianNynorsk" Value="NorwegianNynorsk" SelectByDefault="false" />
          <Enumeration Text="Occitan" Value="Occitan" SelectByDefault="false" />
          <Enumeration Text="OldSlavonic" Value="OldSlavonic" SelectByDefault="false" />
          <Enumeration Text="Oriya" Value="Oriya" SelectByDefault="false" />
          <Enumeration Text="Oromo" Value="Oromo" SelectByDefault="false" />
          <Enumeration Text="Ossetian" Value="Ossetian" SelectByDefault="false" />
          <Enumeration Text="Pali" Value="Pali" SelectByDefault="false" />
          <Enumeration Text="Pashto" Value="Pashto" SelectByDefault="false" />
          <Enumeration Text="Persian" Value="Persian" SelectByDefault="false" />
          <Enumeration Text="Polish" Value="Polish" SelectByDefault="false" />
          <Enumeration Text="Portuguese" Value="Portuguese" SelectByDefault="false" />
          <Enumeration Text="Punjabi" Value="Punjabi" SelectByDefault="false" />
          <Enumeration Text="Quechua" Value="Quechua" SelectByDefault="false" />
          <Enumeration Text="Rhaeto-Romance" Value="Rhaeto-Romance" SelectByDefault="false" />
          <Enumeration Text="Romanian" Value="Romanian" SelectByDefault="false" />
          <Enumeration Text="Russian" Value="Russian" SelectByDefault="false" />
          <Enumeration Text="Samoan" Value="Samoan" SelectByDefault="false" />
          <Enumeration Text="Sango" Value="Sango" SelectByDefault="false" />
          <Enumeration Text="Sanskrit" Value="Sanskrit" SelectByDefault="false" />
          <Enumeration Text="Sardinian" Value="Sardinian" SelectByDefault="false" />
          <Enumeration Text="Scots" Value="Scots" SelectByDefault="false" />
          <Enumeration Text="ScotsGaelic" Value="ScotsGaelic" SelectByDefault="false" />
          <Enumeration Text="Serbian" Value="Serbian" SelectByDefault="false" />
          <Enumeration Text="Serbo-Croatian" Value="Serbo-Croatian" SelectByDefault="false" />
          <Enumeration Text="Sesotho" Value="Sesotho" SelectByDefault="false" />
          <Enumeration Text="Setswana" Value="Setswana" SelectByDefault="false" />
          <Enumeration Text="Shona" Value="Shona" SelectByDefault="false" />
          <Enumeration Text="Sindhi" Value="Sindhi" SelectByDefault="false" />
          <Enumeration Text="Sinhala" Value="Sinhala" SelectByDefault="false" />
          <Enumeration Text="Siswati" Value="Siswati" SelectByDefault="false" />
          <Enumeration Text="Slovak" Value="Slovak" SelectByDefault="false" />
          <Enumeration Text="Slovenian" Value="Slovenian" SelectByDefault="false" />
          <Enumeration Text="Somali" Value="Somali" SelectByDefault="false" />
          <Enumeration Text="SouthNdebele" Value="SouthNdebele" SelectByDefault="false" />
          <Enumeration Text="Spanish" Value="Spanish" SelectByDefault="false" />
          <Enumeration Text="Sudanese" Value="Sudanese" SelectByDefault="false" />
          <Enumeration Text="Swahili" Value="Swahili" SelectByDefault="false" />
          <Enumeration Text="Swedish" Value="Swedish" SelectByDefault="false" />
          <Enumeration Text="SwissGerman" Value="SwissGerman" SelectByDefault="false" />
          <Enumeration Text="Tagalog" Value="Tagalog" SelectByDefault="false" />
          <Enumeration Text="Tahitian" Value="Tahitian" SelectByDefault="false" />
          <Enumeration Text="Tajik" Value="Tajik" SelectByDefault="false" />
          <Enumeration Text="Tamil" Value="Tamil" SelectByDefault="false" />
          <Enumeration Text="Tatar" Value="Tatar" SelectByDefault="false" />
          <Enumeration Text="Telugu" Value="Telugu" SelectByDefault="false" />
          <Enumeration Text="Thai" Value="Thai" SelectByDefault="false" />
          <Enumeration Text="Tibetan" Value="Tibetan" SelectByDefault="false" />
          <Enumeration Text="Tigrinya" Value="Tigrinya" SelectByDefault="false" />
          <Enumeration Text="Tonga" Value="Tonga" SelectByDefault="false" />
          <Enumeration Text="Tsonga" Value="Tsonga" SelectByDefault="false" />
          <Enumeration Text="Turkish" Value="Turkish" SelectByDefault="false" />
          <Enumeration Text="Turkmen" Value="Turkmen" SelectByDefault="false" />
          <Enumeration Text="Twi" Value="Twi" SelectByDefault="false" />
          <Enumeration Text="Ukrainian" Value="Ukrainian" SelectByDefault="false" />
          <Enumeration Text="Urdu" Value="Urdu" SelectByDefault="false" />
          <Enumeration Text="Uyghur" Value="Uyghur" SelectByDefault="false" />
          <Enumeration Text="Uzbek" Value="Uzbek" SelectByDefault="false" />
          <Enumeration Text="Venda" Value="Venda" SelectByDefault="false" />
          <Enumeration Text="Vietnamese" Value="Vietnamese" SelectByDefault="false" />
          <Enumeration Text="Welsh" Value="Welsh" SelectByDefault="false" />
          <Enumeration Text="Wolof" Value="Wolof" SelectByDefault="false" />
          <Enumeration Text="Xhosa" Value="Xhosa" SelectByDefault="false" />
          <Enumeration Text="Yiddish" Value="Yiddish" SelectByDefault="false" />
          <Enumeration Text="Yoruba" Value="Yoruba" SelectByDefault="false" />
          <Enumeration Text="Zhuang" Value="Zhuang" SelectByDefault="false" />
          <Enumeration Text="Zulu" Value="Zulu" SelectByDefault="false" />
          <Enumeration Text="Portuguese,Brazil" Value="Portuguese,Brazil" SelectByDefault="false" />
          <Enumeration Text="Portuguese,International" Value="Portuguese,International" SelectByDefault="false" />
          <Enumeration Text="Portuguese,Portugal" Value="Portuguese,Portugal" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="nationality">
        <DisplayName>Nationality</DisplayName>
        <DataType>string</DataType>
        <UserInputType>DropdownSingleSelect</UserInputType>
        <Restriction>
          <Enumeration Text="ABW" Value="ABW" SelectByDefault="false" />
          <Enumeration Text="AFG" Value="AFG" SelectByDefault="false" />
          <Enumeration Text="AGO" Value="AGO" SelectByDefault="false" />
          <Enumeration Text="AIA" Value="AIA" SelectByDefault="false" />
          <Enumeration Text="ALA" Value="ALA" SelectByDefault="false" />
          <Enumeration Text="ALB" Value="ALB" SelectByDefault="false" />
          <Enumeration Text="AND" Value="AND" SelectByDefault="false" />
          <Enumeration Text="ANT" Value="ANT" SelectByDefault="false" />
          <Enumeration Text="ARE" Value="ARE" SelectByDefault="false" />
          <Enumeration Text="ARG" Value="ARG" SelectByDefault="false" />
          <Enumeration Text="ARM" Value="ARM" SelectByDefault="false" />
          <Enumeration Text="ASM" Value="ASM" SelectByDefault="false" />
          <Enumeration Text="ATA" Value="ATA" SelectByDefault="false" />
          <Enumeration Text="ATF" Value="ATF" SelectByDefault="false" />
          <Enumeration Text="ATG" Value="ATG" SelectByDefault="false" />
          <Enumeration Text="AUS" Value="AUS" SelectByDefault="false" />
          <Enumeration Text="AUT" Value="AUT" SelectByDefault="false" />
          <Enumeration Text="AZE" Value="AZE" SelectByDefault="false" />
          <Enumeration Text="BDI" Value="BDI" SelectByDefault="false" />
          <Enumeration Text="BEL" Value="BEL" SelectByDefault="false" />
          <Enumeration Text="BEN" Value="BEN" SelectByDefault="false" />
          <Enumeration Text="BFA" Value="BFA" SelectByDefault="false" />
          <Enumeration Text="BGD" Value="BGD" SelectByDefault="false" />
          <Enumeration Text="BGR" Value="BGR" SelectByDefault="false" />
          <Enumeration Text="BHR" Value="BHR" SelectByDefault="false" />
          <Enumeration Text="BHS" Value="BHS" SelectByDefault="false" />
          <Enumeration Text="BIH" Value="BIH" SelectByDefault="false" />
          <Enumeration Text="BLR" Value="BLR" SelectByDefault="false" />
          <Enumeration Text="BLZ" Value="BLZ" SelectByDefault="false" />
          <Enumeration Text="BMU" Value="BMU" SelectByDefault="false" />
          <Enumeration Text="BOL" Value="BOL" SelectByDefault="false" />
          <Enumeration Text="BRA" Value="BRA" SelectByDefault="false" />
          <Enumeration Text="BRB" Value="BRB" SelectByDefault="false" />
          <Enumeration Text="BRN" Value="BRN" SelectByDefault="false" />
          <Enumeration Text="BTN" Value="BTN" SelectByDefault="false" />
          <Enumeration Text="BVT" Value="BVT" SelectByDefault="false" />
          <Enumeration Text="BWA" Value="BWA" SelectByDefault="false" />
          <Enumeration Text="CAF" Value="CAF" SelectByDefault="false" />
          <Enumeration Text="CAN" Value="CAN" SelectByDefault="false" />
          <Enumeration Text="CCK" Value="CCK" SelectByDefault="false" />
          <Enumeration Text="CHE" Value="CHE" SelectByDefault="false" />
          <Enumeration Text="CHL" Value="CHL" SelectByDefault="false" />
          <Enumeration Text="CHN" Value="CHN" SelectByDefault="false" />
          <Enumeration Text="CIV" Value="CIV" SelectByDefault="false" />
          <Enumeration Text="CMR" Value="CMR" SelectByDefault="false" />
          <Enumeration Text="COD" Value="COD" SelectByDefault="false" />
          <Enumeration Text="COG" Value="COG" SelectByDefault="false" />
          <Enumeration Text="COK" Value="COK" SelectByDefault="false" />
          <Enumeration Text="COL" Value="COL" SelectByDefault="false" />
          <Enumeration Text="COM" Value="COM" SelectByDefault="false" />
          <Enumeration Text="CPV" Value="CPV" SelectByDefault="false" />
          <Enumeration Text="CRI" Value="CRI" SelectByDefault="false" />
          <Enumeration Text="CUB" Value="CUB" SelectByDefault="false" />
          <Enumeration Text="CXR" Value="CXR" SelectByDefault="false" />
          <Enumeration Text="CYM" Value="CYM" SelectByDefault="false" />
          <Enumeration Text="CYP" Value="CYP" SelectByDefault="false" />
          <Enumeration Text="CZE" Value="CZE" SelectByDefault="false" />
          <Enumeration Text="DEU" Value="DEU" SelectByDefault="false" />
          <Enumeration Text="DJI" Value="DJI" SelectByDefault="false" />
          <Enumeration Text="DMA" Value="DMA" SelectByDefault="false" />
          <Enumeration Text="DNK" Value="DNK" SelectByDefault="false" />
          <Enumeration Text="DOM" Value="DOM" SelectByDefault="false" />
          <Enumeration Text="DZA" Value="DZA" SelectByDefault="false" />
          <Enumeration Text="ECU" Value="ECU" SelectByDefault="false" />
          <Enumeration Text="EGY" Value="EGY" SelectByDefault="false" />
          <Enumeration Text="ERI" Value="ERI" SelectByDefault="false" />
          <Enumeration Text="ESH" Value="ESH" SelectByDefault="false" />
          <Enumeration Text="ESP" Value="ESP" SelectByDefault="false" />
          <Enumeration Text="EST" Value="EST" SelectByDefault="false" />
          <Enumeration Text="ETH" Value="ETH" SelectByDefault="false" />
          <Enumeration Text="FIN" Value="FIN" SelectByDefault="false" />
          <Enumeration Text="FJI" Value="FJI" SelectByDefault="false" />
          <Enumeration Text="FLK" Value="FLK" SelectByDefault="false" />
          <Enumeration Text="FRA" Value="FRA" SelectByDefault="false" />
          <Enumeration Text="FRO" Value="FRO" SelectByDefault="false" />
          <Enumeration Text="FSM" Value="FSM" SelectByDefault="false" />
          <Enumeration Text="GAB" Value="GAB" SelectByDefault="false" />
          <Enumeration Text="GBR" Value="GBR" SelectByDefault="false" />
          <Enumeration Text="GEO" Value="GEO" SelectByDefault="false" />
          <Enumeration Text="GHA" Value="GHA" SelectByDefault="false" />
          <Enumeration Text="GIB" Value="GIB" SelectByDefault="false" />
          <Enumeration Text="GIN" Value="GIN" SelectByDefault="false" />
          <Enumeration Text="GLP" Value="GLP" SelectByDefault="false" />
          <Enumeration Text="GMB" Value="GMB" SelectByDefault="false" />
          <Enumeration Text="GNB" Value="GNB" SelectByDefault="false" />
          <Enumeration Text="GNQ" Value="GNQ" SelectByDefault="false" />
          <Enumeration Text="GRC" Value="GRC" SelectByDefault="false" />
          <Enumeration Text="GRD" Value="GRD" SelectByDefault="false" />
          <Enumeration Text="GRL" Value="GRL" SelectByDefault="false" />
          <Enumeration Text="GTM" Value="GTM" SelectByDefault="false" />
          <Enumeration Text="GUF" Value="GUF" SelectByDefault="false" />
          <Enumeration Text="GUM" Value="GUM" SelectByDefault="false" />
          <Enumeration Text="GUY" Value="GUY" SelectByDefault="false" />
          <Enumeration Text="HKG" Value="HKG" SelectByDefault="false" />
          <Enumeration Text="HMD" Value="HMD" SelectByDefault="false" />
          <Enumeration Text="HND" Value="HND" SelectByDefault="false" />
          <Enumeration Text="HRV" Value="HRV" SelectByDefault="false" />
          <Enumeration Text="HTI" Value="HTI" SelectByDefault="false" />
          <Enumeration Text="HUN" Value="HUN" SelectByDefault="false" />
          <Enumeration Text="IDN" Value="IDN" SelectByDefault="false" />
          <Enumeration Text="IMN" Value="IMN" SelectByDefault="false" />
          <Enumeration Text="IND" Value="IND" SelectByDefault="false" />
          <Enumeration Text="IOT" Value="IOT" SelectByDefault="false" />
          <Enumeration Text="IRL" Value="IRL" SelectByDefault="false" />
          <Enumeration Text="IRN" Value="IRN" SelectByDefault="false" />
          <Enumeration Text="IRQ" Value="IRQ" SelectByDefault="false" />
          <Enumeration Text="ISL" Value="ISL" SelectByDefault="false" />
          <Enumeration Text="ISR" Value="ISR" SelectByDefault="false" />
          <Enumeration Text="ITA" Value="ITA" SelectByDefault="false" />
          <Enumeration Text="JAM" Value="JAM" SelectByDefault="false" />
          <Enumeration Text="JEY" Value="JEY" SelectByDefault="false" />
          <Enumeration Text="JOR" Value="JOR" SelectByDefault="false" />
          <Enumeration Text="JPN" Value="JPN" SelectByDefault="false" />
          <Enumeration Text="KAZ" Value="KAZ" SelectByDefault="false" />
          <Enumeration Text="KEN" Value="KEN" SelectByDefault="false" />
          <Enumeration Text="KGZ" Value="KGZ" SelectByDefault="false" />
          <Enumeration Text="KHM" Value="KHM" SelectByDefault="false" />
          <Enumeration Text="KIR" Value="KIR" SelectByDefault="false" />
          <Enumeration Text="KNA" Value="KNA" SelectByDefault="false" />
          <Enumeration Text="KOR" Value="KOR" SelectByDefault="false" />
          <Enumeration Text="KWT" Value="KWT" SelectByDefault="false" />
          <Enumeration Text="LAO" Value="LAO" SelectByDefault="false" />
          <Enumeration Text="LBN" Value="LBN" SelectByDefault="false" />
          <Enumeration Text="LBR" Value="LBR" SelectByDefault="false" />
          <Enumeration Text="LBY" Value="LBY" SelectByDefault="false" />
          <Enumeration Text="LCA" Value="LCA" SelectByDefault="false" />
          <Enumeration Text="LIE" Value="LIE" SelectByDefault="false" />
          <Enumeration Text="LKA" Value="LKA" SelectByDefault="false" />
          <Enumeration Text="LSO" Value="LSO" SelectByDefault="false" />
          <Enumeration Text="LTU" Value="LTU" SelectByDefault="false" />
          <Enumeration Text="LUX" Value="LUX" SelectByDefault="false" />
          <Enumeration Text="LVA" Value="LVA" SelectByDefault="false" />
          <Enumeration Text="MAC" Value="MAC" SelectByDefault="false" />
          <Enumeration Text="MAR" Value="MAR" SelectByDefault="false" />
          <Enumeration Text="MCO" Value="MCO" SelectByDefault="false" />
          <Enumeration Text="MDA" Value="MDA" SelectByDefault="false" />
          <Enumeration Text="MDG" Value="MDG" SelectByDefault="false" />
          <Enumeration Text="MDV" Value="MDV" SelectByDefault="false" />
          <Enumeration Text="MEX" Value="MEX" SelectByDefault="false" />
          <Enumeration Text="MHL" Value="MHL" SelectByDefault="false" />
          <Enumeration Text="MKD" Value="MKD" SelectByDefault="false" />
          <Enumeration Text="MLI" Value="MLI" SelectByDefault="false" />
          <Enumeration Text="MLT" Value="MLT" SelectByDefault="false" />
          <Enumeration Text="MMR" Value="MMR" SelectByDefault="false" />
          <Enumeration Text="MNG" Value="MNG" SelectByDefault="false" />
          <Enumeration Text="MNP" Value="MNP" SelectByDefault="false" />
          <Enumeration Text="MOZ" Value="MOZ" SelectByDefault="false" />
          <Enumeration Text="MRT" Value="MRT" SelectByDefault="false" />
          <Enumeration Text="MSR" Value="MSR" SelectByDefault="false" />
          <Enumeration Text="MTQ" Value="MTQ" SelectByDefault="false" />
          <Enumeration Text="MUS" Value="MUS" SelectByDefault="false" />
          <Enumeration Text="MWI" Value="MWI" SelectByDefault="false" />
          <Enumeration Text="MYS" Value="MYS" SelectByDefault="false" />
          <Enumeration Text="MYT" Value="MYT" SelectByDefault="false" />
          <Enumeration Text="NAM" Value="NAM" SelectByDefault="false" />
          <Enumeration Text="NCL" Value="NCL" SelectByDefault="false" />
          <Enumeration Text="NER" Value="NER" SelectByDefault="false" />
          <Enumeration Text="NFK" Value="NFK" SelectByDefault="false" />
          <Enumeration Text="NGA" Value="NGA" SelectByDefault="false" />
          <Enumeration Text="NIC" Value="NIC" SelectByDefault="false" />
          <Enumeration Text="NIU" Value="NIU" SelectByDefault="false" />
          <Enumeration Text="NLD" Value="NLD" SelectByDefault="false" />
          <Enumeration Text="NOR" Value="NOR" SelectByDefault="false" />
          <Enumeration Text="NPL" Value="NPL" SelectByDefault="false" />
          <Enumeration Text="NRU" Value="NRU" SelectByDefault="false" />
          <Enumeration Text="NZL" Value="NZL" SelectByDefault="false" />
          <Enumeration Text="OMN" Value="OMN" SelectByDefault="false" />
          <Enumeration Text="PAK" Value="PAK" SelectByDefault="false" />
          <Enumeration Text="PAN" Value="PAN" SelectByDefault="false" />
          <Enumeration Text="PCN" Value="PCN" SelectByDefault="false" />
          <Enumeration Text="PER" Value="PER" SelectByDefault="false" />
          <Enumeration Text="PHL" Value="PHL" SelectByDefault="false" />
          <Enumeration Text="PLW" Value="PLW" SelectByDefault="false" />
          <Enumeration Text="PNG" Value="PNG" SelectByDefault="false" />
          <Enumeration Text="POL" Value="POL" SelectByDefault="false" />
          <Enumeration Text="PRI" Value="PRI" SelectByDefault="false" />
          <Enumeration Text="PRK" Value="PRK" SelectByDefault="false" />
          <Enumeration Text="PRT" Value="PRT" SelectByDefault="false" />
          <Enumeration Text="PRY" Value="PRY" SelectByDefault="false" />
          <Enumeration Text="PSE" Value="PSE" SelectByDefault="false" />
          <Enumeration Text="PYF" Value="PYF" SelectByDefault="false" />
          <Enumeration Text="QAT" Value="QAT" SelectByDefault="false" />
          <Enumeration Text="REU" Value="REU" SelectByDefault="false" />
          <Enumeration Text="ROU" Value="ROU" SelectByDefault="false" />
          <Enumeration Text="RUS" Value="RUS" SelectByDefault="false" />
          <Enumeration Text="RWA" Value="RWA" SelectByDefault="false" />
          <Enumeration Text="SAU" Value="SAU" SelectByDefault="false" />
          <Enumeration Text="SCG" Value="SCG" SelectByDefault="false" />
          <Enumeration Text="SDN" Value="SDN" SelectByDefault="false" />
          <Enumeration Text="SEN" Value="SEN" SelectByDefault="false" />
          <Enumeration Text="SGP" Value="SGP" SelectByDefault="false" />
          <Enumeration Text="SGS" Value="SGS" SelectByDefault="false" />
          <Enumeration Text="SHN" Value="SHN" SelectByDefault="false" />
          <Enumeration Text="SJM" Value="SJM" SelectByDefault="false" />
          <Enumeration Text="SLB" Value="SLB" SelectByDefault="false" />
          <Enumeration Text="SLE" Value="SLE" SelectByDefault="false" />
          <Enumeration Text="SLV" Value="SLV" SelectByDefault="false" />
          <Enumeration Text="SMR" Value="SMR" SelectByDefault="false" />
          <Enumeration Text="SOM" Value="SOM" SelectByDefault="false" />
          <Enumeration Text="SPM" Value="SPM" SelectByDefault="false" />
          <Enumeration Text="STP" Value="STP" SelectByDefault="false" />
          <Enumeration Text="SUR" Value="SUR" SelectByDefault="false" />
          <Enumeration Text="SVK" Value="SVK" SelectByDefault="false" />
          <Enumeration Text="SVN" Value="SVN" SelectByDefault="false" />
          <Enumeration Text="SWE" Value="SWE" SelectByDefault="false" />
          <Enumeration Text="SWZ" Value="SWZ" SelectByDefault="false" />
          <Enumeration Text="SYC" Value="SYC" SelectByDefault="false" />
          <Enumeration Text="SYR" Value="SYR" SelectByDefault="false" />
          <Enumeration Text="TCA" Value="TCA" SelectByDefault="false" />
          <Enumeration Text="TCD" Value="TCD" SelectByDefault="false" />
          <Enumeration Text="TGO" Value="TGO" SelectByDefault="false" />
          <Enumeration Text="THA" Value="THA" SelectByDefault="false" />
          <Enumeration Text="TJK" Value="TJK" SelectByDefault="false" />
          <Enumeration Text="TKL" Value="TKL" SelectByDefault="false" />
          <Enumeration Text="TKM" Value="TKM" SelectByDefault="false" />
          <Enumeration Text="TLS" Value="TLS" SelectByDefault="false" />
          <Enumeration Text="TON" Value="TON" SelectByDefault="false" />
          <Enumeration Text="TTO" Value="TTO" SelectByDefault="false" />
          <Enumeration Text="TUN" Value="TUN" SelectByDefault="false" />
          <Enumeration Text="TUR" Value="TUR" SelectByDefault="false" />
          <Enumeration Text="TUV" Value="TUV" SelectByDefault="false" />
          <Enumeration Text="TWN" Value="TWN" SelectByDefault="false" />
          <Enumeration Text="TZA" Value="TZA" SelectByDefault="false" />
          <Enumeration Text="UGA" Value="UGA" SelectByDefault="false" />
          <Enumeration Text="UKR" Value="UKR" SelectByDefault="false" />
          <Enumeration Text="UMI" Value="UMI" SelectByDefault="false" />
          <Enumeration Text="URY" Value="URY" SelectByDefault="false" />
          <Enumeration Text="USA" Value="USA" SelectByDefault="false" />
          <Enumeration Text="UZB" Value="UZB" SelectByDefault="false" />
          <Enumeration Text="VAT" Value="VAT" SelectByDefault="false" />
          <Enumeration Text="VCT" Value="VCT" SelectByDefault="false" />
          <Enumeration Text="VEN" Value="VEN" SelectByDefault="false" />
          <Enumeration Text="VGB" Value="VGB" SelectByDefault="false" />
          <Enumeration Text="VIR" Value="VIR" SelectByDefault="false" />
          <Enumeration Text="VNM" Value="VNM" SelectByDefault="false" />
          <Enumeration Text="VUT" Value="VUT" SelectByDefault="false" />
          <Enumeration Text="WLF" Value="WLF" SelectByDefault="false" />
          <Enumeration Text="WSM" Value="WSM" SelectByDefault="false" />
          <Enumeration Text="YEM" Value="YEM" SelectByDefault="false" />
          <Enumeration Text="ZAF" Value="ZAF" SelectByDefault="false" />
          <Enumeration Text="ZMB" Value="ZMB" SelectByDefault="false" />
          <Enumeration Text="ZWE" Value="ZWE" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="gender">
        <DisplayName>Gender</DisplayName>
        <DataType>string</DataType>
        <UserInputType>DropdownSingleSelect</UserInputType>
        <Restriction>
          <Enumeration Text="Homme" Value="M" SelectByDefault="false" />
          <Enumeration Text="Femme" Value="F" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="consents">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
        <UserInputType>CheckboxMultiSelect</UserInputType>
        <Restriction>
          <Enumeration Text="J'accepte de créer un compte" Value="ToU" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="allpurposes">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
      </ClaimType>
      <ClaimType Id="allmandatorypurposes">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
      </ClaimType>
      <ClaimType Id="mandatoryConsent_1">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
        <UserInputType>CheckboxMultiSelect</UserInputType>
        <Restriction>
          <Enumeration Text="J'accepte de créer un compte" Value="ToU" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="mandatoryConsent_2">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
        <UserInputType>CheckboxMultiSelect</UserInputType>
        <Restriction>
          <Enumeration Text="J'accepte de créer un compte 2" Value="ToU2" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="mandatoryConsent_3">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
        <UserInputType>CheckboxMultiSelect</UserInputType>
        <Restriction>
          <Enumeration Text="J'accepte de créer un compte" Value="ToU" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="mandatoryConsent_4">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
        <UserInputType>CheckboxMultiSelect</UserInputType>
        <Restriction>
          <Enumeration Text="J'accepte de créer un compte 2" Value="ToU2" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="mandatoryConsent_5">
        <DisplayName></DisplayName>
        <DataType>string</DataType>
        <UserInputType>CheckboxMultiSelect</UserInputType>
        <Restriction>
          <Enumeration Text="J'accepte de créer un compte 2" Value="ToU2" SelectByDefault="false" />
        </Restriction>
      </ClaimType>
    </ClaimsSchema>
    <ClientDefinitions>
      <ClientDefinition Id="DefaultWeb">
        <ClientUIFilterFlags>LineMarkers, MetaRefresh</ClientUIFilterFlags>
      </ClientDefinition>
    </ClientDefinitions>
    <ContentDefinitions>
      <!-- This content definition is to render an error page that displays unhandled errors. -->
      <ContentDefinition Id="api.error">
        <LoadUri>~/tenant/default/exception.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:globalexception:1.1.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Error page</Item>
        </Metadata>
      </ContentDefinition>
      <ContentDefinition Id="api.signuporsignin">
        <LoadUri>~/tenant/default/unified.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:unifiedssp:1.0.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Signin and Signup</Item>
        </Metadata>
      </ContentDefinition>
      <ContentDefinition Id="api.selfasserted">
        <LoadUri>~/tenant/default/selfAsserted.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Collect information from user page</Item>
        </Metadata>
      </ContentDefinition>
      <ContentDefinition Id="api.selfasserted.profileupdate">
        <LoadUri>~/tenant/default/updateProfile.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Collect information from user page</Item>
        </Metadata>
      </ContentDefinition>
      <ContentDefinition Id="api.localaccountsignup">
        <LoadUri>~/tenant/default/selfAsserted.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Local account sign up page</Item>
        </Metadata>
      </ContentDefinition>
      <ContentDefinition Id="api.localaccountpasswordreset">
        <LoadUri>~/tenant/default/selfAsserted.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Local account change password page</Item>
        </Metadata>
      </ContentDefinition>
      <ContentDefinition Id="api.idpselections">
        <LoadUri>~/tenant/default/idpSelector.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:idpselection:1.0.0</DataUri>
        <Metadata>
          <Item Key="DisplayName">Idp selection page</Item>
          <Item Key="language.intro">Sign in</Item>
        </Metadata>
      </ContentDefinition>
    </ContentDefinitions>
  </BuildingBlocks>
  <!--
        A list of all the claim providers that can be used in the technical policies. If a claims provider is not listed 
        in this section, then it cannot be used in a technical policy.
    -->
  <ClaimsProviders>
    <ClaimsProvider>
      <DisplayName>Local Account SignIn</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="login-NonInteractive">
          <DisplayName>Local Account SignIn</DisplayName>
          <Protocol Name="OpenIdConnect" />
          <Metadata>
            <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">We can't seem to find your account</Item>
            <Item Key="UserMessageIfInvalidPassword">Your password is incorrect</Item>
            <Item Key="UserMessageIfOldPasswordUsed">Looks like you used an old password</Item>
            <Item Key="ProviderName">https://sts.windows.net/</Item>
            <Item Key="METADATA">https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration</Item>
            <Item Key="authorization_endpoint">https://login.microsoftonline.com/{tenant}/oauth2/token</Item>
            <Item Key="response_types">id_token</Item>
            <Item Key="response_mode">query</Item>
            <Item Key="scope">email openid</Item>
            <!-- Policy Engine Clients -->
            <Item Key="UsePolicyInRedirectUri">false</Item>
            <Item Key="HttpBinding">POST</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" />
            <InputClaim ClaimTypeReferenceId="password" Required="true" />
            <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="password" />
            <InputClaim ClaimTypeReferenceId="scope" DefaultValue="openid" />
            <InputClaim ClaimTypeReferenceId="nca" PartnerClaimType="nca" DefaultValue="1" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" />
            <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
            <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
            <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
          </OutputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Azure Active Directory</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AAD-Common">
          <DisplayName>Azure Active Directory</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureActiveDirectoryProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <!-- Provide objectId and appId before using extension properties. -->
          <Metadata>
            <Item Key="ApplicationObjectId">{##ExtensionApplicationObjectId##}</Item>
            <Item Key="ClientId">{##ExtensionApplicationId##}</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
          </CryptographicKeys>
          <!-- We need this here to suppress the SelfAsserted provider from invoking SSO on validation profiles. -->
          <IncludeInSso>false</IncludeInSso>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
        <!-- The following technical profile is used to read data after user authenticates. -->
        <TechnicalProfile Id="AAD-UserReadUsingObjectId">
          <Metadata>
            <Item Key="Operation">Read</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
          </InputClaims>
          <OutputClaims>
            <!-- Required claims -->
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
            <!-- Optional claims -->
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
            <OutputClaim ClaimTypeReferenceId="displayName" />
            <OutputClaim ClaimTypeReferenceId="otherMails" />
            <OutputClaim ClaimTypeReferenceId="givenName" />
            <OutputClaim ClaimTypeReferenceId="surname" />
            <OutputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" />
            <OutputClaim ClaimTypeReferenceId="publicId" PartnerClaimType="#{PublicIdFieldName}#" />
            <OutputClaim ClaimTypeReferenceId="civility" PartnerClaimType="#{CivilityFieldName}#" />
            <OutputClaim ClaimTypeReferenceId="gender" PartnerClaimType="#{GenderFieldName}#" />
            <OutputClaim ClaimTypeReferenceId="birthdate" PartnerClaimType="#{BirthdateFieldName}#" />
            <OutputClaim ClaimTypeReferenceId="zipCode" />
            <OutputClaim ClaimTypeReferenceId="street1" />
            <OutputClaim ClaimTypeReferenceId="street2" />
          </OutputClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
        </TechnicalProfile>
        <!--Retrieve groups membership of the user-->
        <TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
          <Metadata>
            <Item Key="Operation">Write</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
          </InputClaims>
          <PersistedClaims>
            <!-- Required claims -->
            <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
            <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="displayName" />
            <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
            <PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" />
            <!-- Optional claims. -->
            <PersistedClaim ClaimTypeReferenceId="givenName" />
            <PersistedClaim ClaimTypeReferenceId="surname" />
            <PersistedClaim ClaimTypeReferenceId="publicId" PartnerClaimType="#{PublicIdFieldName}#" />
            <PersistedClaim ClaimTypeReferenceId="civility" PartnerClaimType="#{CivilityFieldName}#" />
            <PersistedClaim ClaimTypeReferenceId="zipCode" />
            <PersistedClaim ClaimTypeReferenceId="gender" PartnerClaimType="#{GenderFieldName}#" />
            <PersistedClaim ClaimTypeReferenceId="birthdate" PartnerClaimType="#{BirthdateFieldName}#" />
          </PersistedClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
          </OutputClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>
        <TechnicalProfile Id="AAD-UserWriteProfileUsingObjectId">
          <Metadata>
            <Item Key="Operation">Write</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">false</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
          </InputClaims>
          <PersistedClaims>
            <!-- Required claims -->
            <PersistedClaim ClaimTypeReferenceId="objectId" />

            <!-- Optional claims -->
            <PersistedClaim ClaimTypeReferenceId="givenName" />
            <PersistedClaim ClaimTypeReferenceId="surname" />
            <PersistedClaim ClaimTypeReferenceId="civility" PartnerClaimType="#{CivilityFieldName}#" />
            <PersistedClaim ClaimTypeReferenceId="zipCode" />
            <PersistedClaim ClaimTypeReferenceId="birthdate" PartnerClaimType="#{BirthdateFieldName}#" />
            <PersistedClaim ClaimTypeReferenceId="gender" PartnerClaimType="#{GenderFieldName}#" />
          </PersistedClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
        </TechnicalProfile>
        <TechnicalProfile Id="AAD-UserReadUsingEmailAddress">
          <Metadata>
            <Item Key="Operation">Read</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
            <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An account could not be found for the provided user ID.</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames" Required="true" />
          </InputClaims>
          <OutputClaims>
            <!-- Required claims -->
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />

            <!-- Optional claims -->
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="displayName" />
            <OutputClaim ClaimTypeReferenceId="otherMails" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
          </OutputClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
        </TechnicalProfile>
        <TechnicalProfile Id="AAD-UserWritePasswordUsingObjectId">
          <Metadata>
            <Item Key="Operation">Write</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
          </InputClaims>
          <PersistedClaims>
            <PersistedClaim ClaimTypeReferenceId="objectId" />
            <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password"/>

          </PersistedClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>API</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="API-Signup">
          <DisplayName>API Signup</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">#{ApiConnectPartyCreateEndpoint}#</Item>
            <Item Key="AuthenticationType">Basic</Item>
            <Item Key="IgnoreServerCertificateErrors">True</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="SendClaimsIn">Body</Item>
            <Item Key="ClaimsFormat">Body</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ApiConnectClientId" />
            <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_ApiConnectClientSecret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="civility" PartnerClaimType="Civility" />
            <InputClaim ClaimTypeReferenceId="gender" PartnerClaimType="Gender" />
            <InputClaim ClaimTypeReferenceId="surname" PartnerClaimType="LastName" />
            <InputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="FirstName" />
            <InputClaim ClaimTypeReferenceId="mobile" PartnerClaimType="Mobile" />
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="Email" />
            <InputClaim ClaimTypeReferenceId="street1" PartnerClaimType="Street1" />
            <InputClaim ClaimTypeReferenceId="street2" PartnerClaimType="Street2" />
            <InputClaim ClaimTypeReferenceId="street3" PartnerClaimType="Street3" />
            <InputClaim ClaimTypeReferenceId="street4" PartnerClaimType="Street4" />
            <InputClaim ClaimTypeReferenceId="zipCode" PartnerClaimType="ZipCode" />
            <InputClaim ClaimTypeReferenceId="city" PartnerClaimType="City" />
            <InputClaim ClaimTypeReferenceId="country" PartnerClaimType="Country" />
            <InputClaim ClaimTypeReferenceId="nationality" PartnerClaimType="Nationality" />
            <InputClaim ClaimTypeReferenceId="language" PartnerClaimType="Language" />
            <InputClaim ClaimTypeReferenceId="birthdate" PartnerClaimType="BirthDate" />
            <InputClaim ClaimTypeReferenceId="allpurposes" PartnerClaimType="AllPurposes" />
            <InputClaim ClaimTypeReferenceId="consents" PartnerClaimType="Consents" />
            <InputClaim ClaimTypeReferenceId="allmandatorypurposes" PartnerClaimType="AllMandatoryPurposes" />
            <InputClaim ClaimTypeReferenceId="mandatoryConsent_1" PartnerClaimType="MandatoryConsent_1" />
            <InputClaim ClaimTypeReferenceId="mandatoryConsent_2" PartnerClaimType="MandatoryConsent_2" />
            <InputClaim ClaimTypeReferenceId="mandatoryConsent_3" PartnerClaimType="MandatoryConsent_3" />
            <InputClaim ClaimTypeReferenceId="mandatoryConsent_4" PartnerClaimType="MandatoryConsent_4" />
            <InputClaim ClaimTypeReferenceId="mandatoryConsent_5" PartnerClaimType="MandatoryConsent_5" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="publicId" PartnerClaimType="PublicId" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
        <TechnicalProfile Id="API-Update">
          <DisplayName>API Update</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">#{ApiConnectPartyUpdateEndpoint}#</Item>
            <Item Key="AuthenticationType">Basic</Item>
            <Item Key="IgnoreServerCertificateErrors">True</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="SendClaimsIn">Body</Item>
            <Item Key="ClaimsFormat">Body</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ApiConnectClientId" />
            <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_ApiConnectClientSecret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="Email" />
            <InputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="FirstName" />
            <InputClaim ClaimTypeReferenceId="surname" PartnerClaimType="LastName" />
            <InputClaim ClaimTypeReferenceId="consents" PartnerClaimType="Consents" />
            <InputClaim ClaimTypeReferenceId="publicId" PartnerClaimType="PublicId" />
            <InputClaim ClaimTypeReferenceId="allpurposes" PartnerClaimType="AllPurposes" />
            <InputClaim ClaimTypeReferenceId="civility" PartnerClaimType="Civility" />
            <InputClaim ClaimTypeReferenceId="zipCode" PartnerClaimType="ZipCode" />
            <InputClaim ClaimTypeReferenceId="gender" PartnerClaimType="Gender" />
            <InputClaim ClaimTypeReferenceId="birthdate" PartnerClaimType="BirthDate" />
          </InputClaims>
          <OutputClaims>
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
        <TechnicalProfile Id="API-GetUserConsents">
          <DisplayName>API GetUserConsents</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">#{ApiConnectConsentGetEndpoint}#</Item>
            <Item Key="AuthenticationType">Basic</Item>
            <Item Key="IgnoreServerCertificateErrors">True</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="SendClaimsIn">Body</Item>
            <Item Key="ClaimsFormat">Body</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ApiConnectClientId" />
            <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_ApiConnectClientSecret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="publicId" PartnerClaimType="PublicId" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="consents" PartnerClaimType="Consents" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
        <TechnicalProfile Id="API-SetActivity">
          <DisplayName>API SetActivity</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">#{ApiConnectAuthPostEndpoint}#</Item>
            <Item Key="AuthenticationType">Basic</Item>
            <Item Key="IgnoreServerCertificateErrors">True</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="SendClaimsIn">Body</Item>
            <Item Key="ClaimsFormat">Body</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ApiConnectClientId" />
            <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_ApiConnectClientSecret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="publicId" PartnerClaimType="PublicId" />
          </InputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Local Account</DisplayName>
      <TechnicalProfiles>
        <!-- This technical profile uses a validation technical profile to authenticate the user. -->
        <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
          <DisplayName>Local Account Signin</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="SignUpTarget">SignUpWithLogonEmailExchange</Item>
            <Item Key="setting.operatingMode">Email</Item>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="signInName" />
          </InputClaims>
          <OutputClaims>
            <!-- Required claims -->
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
            <OutputClaim ClaimTypeReferenceId="password" Required="true" />
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
          </ValidationTechnicalProfiles>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>
        <TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
          <DisplayName>Email signup</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
            <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
            <Item Key="language.button_continue">Create</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
            <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="givenName" Required="true" />
            <OutputClaim ClaimTypeReferenceId="surname" Required="true" />
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />
            <OutputClaim ClaimTypeReferenceId="newUser" />
            <!-- Optional claims, to be collected from the user -->
            <OutputClaim ClaimTypeReferenceId="publicId" />
            <OutputClaim ClaimTypeReferenceId="mandatoryConsent_1" Required="true" />
            <OutputClaim ClaimTypeReferenceId="mandatoryConsent_2" Required="true" />
            <OutputClaim ClaimTypeReferenceId="civility" />
            <OutputClaim ClaimTypeReferenceId="zipCode" />
            <OutputClaim ClaimTypeReferenceId="gender" />
            <OutputClaim ClaimTypeReferenceId="birthdate" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="API-Signup" />
            <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
          </ValidationTechnicalProfiles>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>
        <TechnicalProfile Id="LocalAccountSignUpWithLogonEmail-Unverified">
          <DisplayName>Email signup</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="EnforceEmailVerification">False</Item>
            <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
            <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
            <Item Key="language.button_continue">Create</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />
            <OutputClaim ClaimTypeReferenceId="newUser" />

            <!-- Formulaire -->
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
            <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="givenName" Required="true" />
            <OutputClaim ClaimTypeReferenceId="surname" Required="true" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="API-Signup" />
            <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
          </ValidationTechnicalProfiles>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>
        <TechnicalProfile Id="SelfAsserted-ProfileUpdate">
          <DisplayName>User ID signup</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted.profileupdate</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>

            <InputClaim ClaimTypeReferenceId="userPrincipalName" />

            <!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                 ValidationTechnicalProfile referenced below so it can be written to directory after being updateed by the user, i.e. AAD-UserWriteProfileUsingObjectId. -->
            <InputClaim ClaimTypeReferenceId="givenName" />
            <InputClaim ClaimTypeReferenceId="surname" />
            <InputClaim ClaimTypeReferenceId="consents" />
            <InputClaim ClaimTypeReferenceId="civility" />
            <InputClaim ClaimTypeReferenceId="zipCode" />
            <InputClaim ClaimTypeReferenceId="gender" />
            <InputClaim ClaimTypeReferenceId="birthdate" />
          </InputClaims>
          <OutputClaims>
            <!-- Required claims -->
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />

            <!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                 ValidationTechnicalProfile referenced below so it can be written to directory after being updateed by the user, i.e. AAD-UserWriteProfileUsingObjectId. -->
            <OutputClaim ClaimTypeReferenceId="givenName" />
            <OutputClaim ClaimTypeReferenceId="surname" />
            <OutputClaim ClaimTypeReferenceId="consents" />
            <OutputClaim ClaimTypeReferenceId="civility" />
            <OutputClaim ClaimTypeReferenceId="zipCode" />
            <OutputClaim ClaimTypeReferenceId="gender" />
            <OutputClaim ClaimTypeReferenceId="birthdate" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="API-Update" />
            <ValidationTechnicalProfile ReferenceId="AAD-UserWriteProfileUsingObjectId" />
          </ValidationTechnicalProfiles>
        </TechnicalProfile>
        <TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddress">
          <DisplayName>Reset password using email address</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
            <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
          </CryptographicKeys>
          <IncludeInSso>false</IncludeInSso>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />

          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />
          </ValidationTechnicalProfiles>
        </TechnicalProfile>
        <TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
          <DisplayName>Change password (username)</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="objectId" />

          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" />
          </ValidationTechnicalProfiles>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Session Management</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="SM-Noop">
          <DisplayName>Noop Session Management Provider</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.NoopSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
        </TechnicalProfile>
        <TechnicalProfile Id="SM-AAD">
          <DisplayName>Session Mananagement Provider</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <PersistedClaims>
            <PersistedClaim ClaimTypeReferenceId="objectId" />
            <PersistedClaim ClaimTypeReferenceId="signInName" />
            <PersistedClaim ClaimTypeReferenceId="authenticationSource" />
            <PersistedClaim ClaimTypeReferenceId="identityProvider" />
            <PersistedClaim ClaimTypeReferenceId="newUser" />
            <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" />
          </PersistedClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true" />
          </OutputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Trustframework Policy Engine TechnicalProfiles</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="TpEngine_c3bd4fe2-1775-4013-b91d-35f16d377d13">
          <DisplayName>Trustframework Policy Engine Default Technical Profile</DisplayName>
          <Protocol Name="None" />
          <Metadata>
            <Item Key="url">{service:te}</Item>
          </Metadata>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Token Issuer</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="JwtIssuer">
          <DisplayName>JWT Issuer</DisplayName>
          <Protocol Name="None" />
          <OutputTokenFormat>JWT</OutputTokenFormat>
          <Metadata>
            <Item Key="token_lifetime_secs">72000</Item>
            <Item Key="client_id">{service:te}</Item>
            <Item Key="issuer_refresh_token_user_identity_claim_type">objectId</Item>
            <Item Key="SendTokenResponseBodyWithJsonNumbers">true</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
            <Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" />
          </CryptographicKeys>
          <InputClaims />
          <OutputClaims />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>
  <UserJourneys>
    <UserJourney Id="SuSi">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail-Unverified" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- This step reads any user attributes that we may not have received when in the token. -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>newUser</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="ApiSetActivity" TechnicalProfileReferenceId="API-SetActivity" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="ApiGetUserConsents" TechnicalProfileReferenceId="API-GetUserConsents" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
    <UserJourney Id="ProfileUpdate">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="ApiGetUserConsents" TechnicalProfileReferenceId="API-GetUserConsents" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="B2CUserProfileUpdateExchange" TechnicalProfileReferenceId="SelfAsserted-ProfileUpdate" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
    <UserJourney Id="PasswordReset">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
  </UserJourneys>
</TrustFrameworkPolicy>

For information : Each {##Key##} or #{Key}# tokens are correctly replace during by their correct values.

I have found nothing about this problem.

Thank you for your help.

Azure B2C - Single Sign On for multiple C# WebForms (no mvc)

Hi,
I am trying to find some samples for Azure B2C - Single Sign On for multiple C# WebForms 4.7.2 (no MVC).
Please refer me to the correct place.

Thanks a lot.

Clarification on claim transformation method

I saw CreateAlternativeSecurityId as claim transformation method in the official guideline.
But in the code, I saw CreateUserIdentity.

May I know which one shall I use instead?

E-mail Output Claim with Local Account Username Signin

I'm trying to ouput the E-mail claim when the user login with his Username but can't make it work.

I don't know which claim I should use. Tried these below separatelly with no success.

Any tips?
Thanks!!

<OutputClaim ClaimTypeReferenceId="email" />
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="strongAuthenticationEmailAddress" />
<OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />

part of TrustFrameworkBase.xml

  <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Username">
          <DisplayName>Local Account Signin</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
              <Item Key="SignUpTarget">SignUpWithLogonUsernameExchange</Item>
              <Item Key="setting.operatingMode">Username</Item>
              <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
              <InputClaim ClaimTypeReferenceId="signInName" />
          </InputClaims>
          <OutputClaims>
              <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
              <OutputClaim ClaimTypeReferenceId="password" Required="true" />
              <OutputClaim ClaimTypeReferenceId="objectId" />
              <OutputClaim ClaimTypeReferenceId="authenticationSource" />
              <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="strongAuthenticationEmailAddress" />
          </OutputClaims>

part of SignUpOrSignin.xml

<RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
    <UserJourneyBehaviors>
      <SingleSignOn Scope="Tenant" KeepAliveInDays="14" />
      <SessionExpiryType>Absolute</SessionExpiryType>
      <SessionExpiryInSeconds>1200</SessionExpiryInSeconds>
    </UserJourneyBehaviors>
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.userName" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="strongAuthenticationEmailAddress" />
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
        <OutputClaim ClaimTypeReferenceId="otherMails" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>

Documentation part 1 diagram difficult to read

Could the diagram in part 1 of the documentation be replaced with a clearer image? Most of the text, especially in the orange blocks is difficult to read.

This piece: https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Documentation/media/01_06.png

If you open it in a completely new tab it's readable, but the issue is that the text is white with a black shadow that gets blurred when resized.

Keep me signed in (KMSI) experience

I was able to enable KMSI experience by using the UserJourneyBehaviors XML node. The Sign-in Or Sign-Up policy already shows the button "Keep me signed in?".

Notwithstanding, by acessing the URL for Login again (i.e. Run Now), the user is still redirect to the login page. Should'nt the user be redirect to the final page after checking KMSI option the first time?

Otherwise, how can I test the KMSI experience?

Thanks once more for these wonderful resources.

PS> Import-Module .\ExploreAdmin.dll getting error

Adding the cryptographic key for the “generic” IdP as claims provider
To add the cryptographic key needed by the “generic” IdP as claims provider, proceed with the following steps:

Open a Windows PowerShell command prompt. Change to the directory to the ExploreAdmin folder in the Starter-Pack folder.
The Starter-Pack folder corresponds to the path C:\Code\AAD-B2C\B2CDemoTools-master in our configuration.

PS> cd C:\Code\AAD-B2C\B2CDemoTools-master\ExploreAdmin

Generate the cryptographic key in your B2C tenant by running the following commands:
PS> Import-Module .\ExploreAdmin.dll

PS> Set-CpimKeyContainer -Tenant contoso369b2c.onmicrosoft.com -StorageReferenceId B2CAuthClientSecret -UnencodedAsciiKey abcdef

------- my steps ------------
0. Open powershell as administrator

I have a folder on my pc at C:\Code\ExploreAdmin
PS> cd C:\Code
3, PS C:\Code> Import-Module .\ExploreAdmin.dll
Import-Module : The specified module '.\ExploreAdmin.dll' was not loaded because no valid module file was found in any
module directory.
At line:1 char:2

Import-Module .\ExploreAdmin.dll

 + CategoryInfo          : ResourceUnavailable: (.\ExploreAdmin.dll:String) [Import-Module], FileNotFoundException
 + FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

I have one more question, why i need to create a key like above mentioned? when we have option in azure portal to create a key.
I assume the key will be used in TrustFrameworkExtensions.xml.

stack over flow refernec:
https://stackoverflow.com/questions/49324501/how-to-use-identityserver3-or-4-in-azure-b2c-as-custom-policy
any one has idea, why i am getting error

Incorrect UI on WingTip Game Demo Link

When I visit the WingTip game demo page, the header overlays with the demo's making them hard to read:

Angular8/Vue custom component not loading in google sites in chrome browser

I have created an angular 8 custom component for pages in my Google site website. I have included the component as an embedded code in google sites.

Initially it was loading correctly in google sites but most recently the pages are not correctly rendering in chrome. We didn't change any configurations but it seems to be not working for both Vue and angular components. When trying with other browsers it seems good. What can be the issue?

Here is the embedded code for google site website


<html>
<style>
/* Center the loader */
#loader {
   position: absolute;
  left: 50%;
  top: 50%;
  z-index: 1;
  width: 150px;
  height: 150px;
  margin: -75px 0 0 -75px;
  border: 16px solid #f3f3f3;
  border-radius: 50%;
  border-top: 16px solid #3498db;
  width: 120px;
  height: 120px;
  -webkit-animation: spin 2s linear infinite;
  animation: spin 2s linear infinite;
}

@-webkit-keyframes spin {
  0% { -webkit-transform: rotate(0deg); }
  100% { -webkit-transform: rotate(360deg); }
}

@keyframes spin {
  0% { transform: rotate(0deg); }
  100% { transform: rotate(360deg); }
}
/* Add animation to "page content" */
.animate-bottom {
  position: relative;
  -webkit-animation-name: animatebottom;
  -webkit-animation-duration: 2s;
  animation-name: animatebottom;
  animation-duration: 2s
}

@-webkit-keyframes animatebottom {
  from { bottom:-100px; opacity:0 } 
  to { bottom:0px; opacity:1 }
}

@keyframes animatebottom { 
  from{ bottom:-100px; opacity:0 } 
  to{ bottom:0; opacity:1 }
}
#commonapps {
  display: none;
  text-align: center;
}
</style>
<script src="https://unpkg.com/vue"></script>
<script src="https://<base url>/common-apps.js"></script>
<script type="text/javascript">
setTimeout(function(){
var x = window.localStorage.getItem('email');
console.log(x);
if(x==null || x==undefined){
window.open("https:<gsuiteURL>",'_blank');
return false;
}
document.getElementById("commonapps").innerHTML='<common-apps-manage-requests></common-apps-manage-requests>';
  document.getElementById("loader").style.display = "none";
  document.getElementById("commonapps").style.display = "block";
}, 2000);
</script>
<div id="loader"></div>
<div  style="width: 100%; height:79% !important; display:none; " id="commonapps" class="animate-bottom">
</div>
</html>

Having trouble following RP-SAML walkthrough

Hello,

I've been trying to follow https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Walkthroughs/RP-SAML.md after having completed the instructions on https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-get-started-custom.

Having gone through it, I have yet to get things working. Here are some of the issues/discrepancies I've run into after following both tutorials:

In step 3 of “create the SAML token issuer”, it has you setting up the technical profile for Saml2AssertionIssuer. There, it makes no reference to changing the StorageReferenceIds for the crypto keys. However, towards the bottom, it has an example profile with these filled in with the auto-generated name prefixes. Which is right?
In step 2 of “add the saml relaying party to user journey(s)”, it asks you to find the UserJourney with Id=”SignIn”. I only had “SignUpOrSignIn”, so I used that, is that OK?
Similarly, in step 6, it tells you to copy the SignIn.xml file, but I only had SignUpOrSignin.xml so I used that. Is that OK?
Same section, step 8, it says to “modify its policy ID to new GUID”. My policy ID was currently “B2C_1A_signup_signin”. Should it be “B2C_1A_signup_signin_saml” or truly a GUID?
Relatedly, there is also a PublicPolicyUri="http://thetenantimusing.onmicrosoft.com/B2C_1A_signup_signin. Does this need to change?

Embedded Translations

Does the final policies support language customizations (enable/disable languagues, set the default language)? And what about customized resources for each language?

These are features from the simpler Azure B2C UI Customization that I would need in order to switch to advanced policies.

Thanks for these resources. Very usefull.

Clarification for WeChat custom authentication

Hello, I am setting wechat custom provider, up to now I have followed the documents of wechat available here:

Wechat Docs on English

And Azure Docs:

Define an OAuth2 Technical Profile

I also set up application insights for debugging:

I am getting this error:

Exception | {"Kind":"Handled","HResult":"80070057","Message":"The value must not be null or white space.\r\nParameter name: key","Data":{}}
-- | --
  | Data{}HResult80070057KindHandledMessageThe value must not be null or white space. Parameter name: key |   | Data | {} |   | HResult | 80070057 |   | Kind | Handled |   | Message | The value must not be null or white space. Parameter name: key
  | Data | {}
  | HResult | 80070057
  | Kind | Handled
  | Message | The value must not be null or white space. Parameter name: key

Not very clear about what would be the step that might be failing, the main log of the user flow says on the last step:

31 | {"Kind":"HandlerResult","Content":{"Result":true,"RecorderRecord":{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}}}
-- | --
  | Content{"Result":true,"RecorderRecord":{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}}RecorderRecord{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}Values[{"Key":"SendingRequest","Value":"WechatExchange"}]0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | Content | {"Result":true,"RecorderRecord":{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}} |   | RecorderRecord{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}Values[{"Key":"SendingRequest","Value":"WechatExchange"}]0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | RecorderRecord | {"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]} |   | Values[{"Key":"SendingRequest","Value":"WechatExchange"}]0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | Values | [{"Key":"SendingRequest","Value":"WechatExchange"}] |   | 0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | 0 | {"Key":"SendingRequest","Value":"WechatExchange"} |   | KeySendingRequestValueWechatExchang |   | Key | SendingRequest |   | Value | WechatExchang
  | Content | {"Result":true,"RecorderRecord":{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}}
  | RecorderRecord{"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}Values[{"Key":"SendingRequest","Value":"WechatExchange"}]0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | RecorderRecord | {"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]} |   | Values[{"Key":"SendingRequest","Value":"WechatExchange"}]0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | Values | [{"Key":"SendingRequest","Value":"WechatExchange"}] |   | 0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | 0 | {"Key":"SendingRequest","Value":"WechatExchange"} |   | KeySendingRequestValueWechatExchang |   | Key | SendingRequest |   | Value | WechatExchang
  | RecorderRecord | {"Values":[{"Key":"SendingRequest","Value":"WechatExchange"}]}
  | Values[{"Key":"SendingRequest","Value":"WechatExchange"}]0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | Values | [{"Key":"SendingRequest","Value":"WechatExchange"}] |   | 0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | 0 | {"Key":"SendingRequest","Value":"WechatExchange"} |   | KeySendingRequestValueWechatExchang |   | Key | SendingRequest |   | Value | WechatExchang
  | Values | [{"Key":"SendingRequest","Value":"WechatExchange"}]
  | 0{"Key":"SendingRequest","Value":"WechatExchange"}KeySendingRequestValueWechatExchang |   | 0 | {"Key":"SendingRequest","Value":"WechatExchange"} |   | KeySendingRequestValueWechatExchang |   | Key | SendingRequest |   | Value | WechatExchang
  | 0 | {"Key":"SendingRequest","Value":"WechatExchange"}
  | KeySendingRequestValueWechatExchang |   | Key | SendingRequest |   | Value | WechatExchang
  | Key | SendingRequest
  | Value | WechatExchange

My technical profile looks like this:

    <ClaimsProvider>
      <Domain>weixin.qq.com</Domain>
      <DisplayName>WeChat</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="WeChat-OAUTH">
          <!-- The text in the following DisplayName element is shown to the user on the claims provider 
               selection screen. -->
          <DisplayName>WeChat</DisplayName>
          <Protocol Name="OAuth2" />
          <Metadata>
            <Item Key="ProviderName">wechat</Item>
            <Item Key="authorization_endpoint">https://open.weixin.qq.com/connect/qrconnect</Item>
            <Item Key="AccessTokenEndpoint">https://api.weixin.qq.com/sns/oauth2/access_token</Item>
            <Item Key="ClaimsEndpoint">https://api.weixin.qq.com/sns/userinfo</Item>
            <Item Key="HttpBinding">GET</Item>
            <Item Key="scope">snsapi_login</Item>
            <Item Key="UsePolicyInRedirectUri">0</Item>
            <Item Key="client_id">my_clientid</Item>
            <Item Key="AdditionalRequestQueryParameters">appid=my_clientid,secret=my_secret</Item>
            <Item Key="ClaimsEndpointAccessTokenName">access_token</Item>
            <Item Key="ExtraParamsInAccessTokenEndpointResponse">openid</Item>
            <Item Key="AccessTokenResponseFormat">json</Item>
            <Item Key="ClaimsEndpointFormat">json</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_WXSecret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="appid" DefaultValue="my_clientid" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="unionid" DefaultValue="wechatuser"/>
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="nickname"/>
            <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="weixin.qq.com" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
            <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
            <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
            <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
          </OutputClaimsTransformations>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

Many thanks in advance for any helpful hint or help you can provide

Host TrustFrameworkPolicy_0.3.0.0.xsd at a public url

I shouldn't have to manually download set Visual Studio to use TrustFrameworkPolicy_0.3.0.0.xsd as a schema. It should be hosted at a public url so I can do xsi:schemaLocation="http://schemas.microsoft.com/online/cpim/schemas/2013/06 http://whterver.xsd". If it is published somewhere, the example XMS should reference that.

Support focus on the first attribute (HTML input element) - urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0

Content definitions (TrustFrameworkPolicy element "ContentDefinition") with DataUri="urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0" do not set the focus on the first attribute (HTML input element for claim).

Only the content definiton with DataUri="urn:com:microsoft:aad:b2c:elements:unifiedssp:1.0.0" contains a useful focus setting.

Because own JavaScript is filtered out, this should be fixed rapidly. Otherwise we have to inform the users that they must press TAB or use mouse.

Please fix this problem asap. It is one line JavaScript/jQuery

$(document).ready(function() {
    $('form:first *:input[type!=hidden]:first').focus();
});

OR (much easier)

A line similar to the following (marked with "/* FIX HERE */") for all attributes:

Handlebars.registerHelper('buildTextInput', function (id, type, placeholder, value, pattern, patternDesc, title, required, readonly, index, options) {
        var input = '<input id="' + id + '" class="textInput" type="' + type + '" ';
        var ariaLabel = "";
        var passwordErrorMsgsStr = "";
		
	/* FIX HERE */ input += 'autofocus '; // New line inserted

        if (placeholder) {
            input += 'placeholder="' + placeholder + '" ';
        }

P. S.: Twice posted (other entry: Azure-Samples/active-directory-b2c-custom-policy-starterpack#27) - please decide which repo is the right one.

saml custom policy logout url

Hello I'm trying to integrate zendesk and azure b2c using custom policies with SAML flow

So I followed documentation described here https://docs.microsoft.com/en-us/azure/active-directory-b2c/connect-with-saml-service-providers

I modified NameId to use email. So login works fine and I can reach zendesk SP.
The only issue left that I cannot find documentation how to configure logout url on service provider side. I took logout url from policy metadata, it looks like:
https://tenant.b2clogin.com/tenant.onmicrosoft.com/B2C_1A_signup_signin_saml/samlp/sso/logout
unfortunately when Service Provider redirects to this endpoint it complains about missing session index. it is true that saml logout request does not contain session index and I configured session management provider not to include session index

<TechnicalProfile Id="SM-Saml-issuer">
		  <DisplayName>Session Management Provider</DisplayName>
		  <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
		  <Metadata>
			<Item Key="IncludeSessionIndex">false</Item>
			<Item Key="RegisterServiceProviders">false</Item>
		  </Metadata>
		</TechnicalProfile>

so what is the proper way to handle logout with SAML?

Account Linking example needs to be updated to use alternativeSecurityId

It seems that the account linking example is now out of date. It refers to the userIdentities claim being of type userIdentityCollection, which it is now not. Instead, any reference to UserIdentity and UserIdentityCollection are now AlternativeSecurityId and AlternativeSecurityIdCollection. This change seems to be spread across a few different docs, i.e. how to link is in this repo, but how to use alternativeSecurityId with respect to linking and claim transformations is found elsewhere

If I have time to change these samples and test them, which is unlikely, then I will. Otherwise, for those who need to know what to do, I'll outline the steps below.

I have had to refactor the account linking example to use, in all policies that reference them. the following:

identityProvider in place of issuer
alternativeSecurityId in place of userIdentity
alternativeSecurityIdCollection in place of userIdentityCollection
alternativeSecurityIds in place of userIdentities

Also, the transformations that relate to modifying and creating userIdentity now need to refer to alternativeSecurityId, as follows:

      <ClaimsTransformation Id="CreateUserIdentity" TransformationMethod="CreateAlternativeSecurityId">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="issuerUserId" TransformationClaimType="key" />
          <InputClaim ClaimTypeReferenceId="identityProvider" TransformationClaimType="identityProvider" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="alternativeSecurityId" TransformationClaimType="alternativeSecurityId" />
        </OutputClaims>
      </ClaimsTransformation>

      <ClaimsTransformation Id="CreateUserIdentityToLink" TransformationMethod="CreateAlternativeSecurityId">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="issuerUserIdToLink" TransformationClaimType="key" />
          <InputClaim ClaimTypeReferenceId="identityProviderToLink" TransformationClaimType="identityProvider" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="userIdentityToLink" TransformationClaimType="alternativeSecurityId" />
        </OutputClaims>
      </ClaimsTransformation>

      <ClaimsTransformation Id="AppendUserIdentity" TransformationMethod="AddItemToAlternativeSecurityIdCollection">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="alternativeSecurityId" TransformationClaimType="item" />
          <InputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="collection" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="collection" />
        </OutputClaims>
      </ClaimsTransformation>

      <ClaimsTransformation Id="AppendUserIdentityToLink" TransformationMethod="AddItemToAlternativeSecurityIdCollection">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="userIdentityToLink" TransformationClaimType="item" />
          <InputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="collection" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="collection" />
        </OutputClaims>
      </ClaimsTransformation>

      <ClaimsTransformation Id="RemoveUserIdentityFromCollectionByIssuer" TransformationMethod="RemoveAlternativeSecurityIdByIdentityProvider">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="identityProviderToUnlink" TransformationClaimType="identityProvider" />
          <InputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="collection" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="collection" />
        </OutputClaims>
      </ClaimsTransformation>

      <ClaimsTransformation Id="ExtractIdentityProviders" TransformationMethod="GetIdentityProvidersFromAlternativeSecurityIdCollectionTransformation">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="alternativeSecurityIds" TransformationClaimType="alternativeSecurityIdCollection" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="identityProviders" TransformationClaimType="identityProvidersCollection" />
        </OutputClaims>
      </ClaimsTransformation>

UserInputType should include "Email"

When we create a ClaimType for an email address, we should be able to define the UserInputType as Email so that we can have the correct keyboard on screen when using a mobile device.

Proposal

  <xs:simpleType name="UserInputType">
    <xs:annotation>
      <xs:documentation>
        Represents the type of input controls that should be available to the user when manually entering claim data.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="TextBox"/>
      <xs:enumeration value="DateTimeDropdown"/>
      <xs:enumeration value="RadioSingleSelect"/>
      <xs:enumeration value="DropdownSingleSelect"/>
      <xs:enumeration value="CheckboxMultiSelect"/>
      <xs:enumeration value="Password"/>
      <xs:enumeration value="Readonly"/>
      <xs:enumeration value="Button"/>
     <!-- ADD THIS -->
      <xs:enumeration value="Email"/>
    </xs:restriction>
  </xs:simpleType>

Use Like This

<ClaimType Id="signInName">
  <DisplayName>Email Address</DisplayName>
  <DataType>string</DataType>
  <UserHelpText/>
  <UserInputType>Email</UserInputType>
</ClaimType>

Generates an email input field.

<input type="email">

Allowing the browser to display the correct keyboard on mobile devices.

Invalid client assertion

After clicking on link received in email, I am getting this error:

The client assertion provided in the request is invalid: 'client_secret' was used as the verification key

Unable to stream to B2C user journey recorder at https://b2crecorder.azurewebsites.net

When following the tutorial at https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Documentation/Features%20part%205.md#using-the-user-journey-recorderplayer
I am not able to retrieve any logs regarding my GUID.

I tried to debug and made a POST request against https://b2crecorder.azurewebsites.net/stream?id=XXX and got the error message:

System.IO.IOException: There is not enough space on the disk.

How to create users with same email but with different in custom user attribute in Azure AD B2C?

I have to create multiple users in Azure AD B2C which only differs in a custom user claim.

Eg : I have an email '[email protected]' and also I have created a custom user attribute called as 'Project' and then added this attribute in SignIn/SignUp user flow. What I need is

1) To register the given email with differs in Project. ie;
User 1 email : '[email protected]', project : 'Project1'

User 2 email : '[email protected]', project : 'Project2'

In the sign up flow I can create a user and can provide the specified attribute. But it doesn't allow me to create another account with the same email.

2) At the time of login user need to provide the 'Project' as a second step of authorization.

Any help would be highly appreciated. Thanks in advance.

Serialize StringCollection claim in the cookie

I have the following setup for my B2C custom policy:

<TechnicalProfile Id="SM-AAD">
      <DisplayName>Session Mananagement Provider</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <PersistedClaims>
        <PersistedClaim ClaimTypeReferenceId="objectId" />
        <PersistedClaim ClaimTypeReferenceId="signInName" />
        <PersistedClaim ClaimTypeReferenceId="email" />
        <PersistedClaim ClaimTypeReferenceId="groups" />
        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" />
      </PersistedClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>
      </OutputClaims>
    </TechnicalProfile>

Notice one of the persisted claim is of StringCollection <PersistedClaim ClaimTypeReferenceId="groups" /> type. The original values are like:

"groups": ["guid1", "guid2", "guid3", ...]

All the claims are persisted fine in the session (cookie) except the groups claim. Instead of properly serializing/deserializing the values, on the next token request retrieve from the b2c session cookie without going back to idp, we've gotten the following in the JWT instead:

"groups": ["System.Collections.Generic.List1[System.String]"],`

Is there a way to properly serialize StringCollection claim type?

Is there any method to get MAC address of the user's system using custom policies?

Hi,

I want to uniquely identify the user's machine other than IP addresses and want to store it into the claims as well. Is there any method to get MAC address of the user's machine using the custom policies flow or is there any other way to uniquely identify the user's machine. The reason behind why I don't want to go with the IP address is that this approach cannot uniquely identify the user's machine if all the machines are on the same network let's say on an organisational network. In that case it will give me the public IP address which I don't want because public IP address will be same for all the machines inside that network.

SAML2 custom policies: The SAML initiating message with id '' cannot be found in state

I have carefully followed the steps in these 2 tutorials to configure custom policies for SSO using SAML2, connecting AD B2C with a Java WebApp:

When logging in, my Web App (SP) builds the SAMLRequest and posts it to https://login.microsoftonline.com/te/TENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/login. After that, I'm automatically redirected to the following URL:

https://login.microsoftonline.com/te/MYTENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/assertionconsumer

And the following error is displayed:

Sorry, but we're having trouble signing you in.We track these errors automatically, but if the problem persists feel free to contact us. In the meantime, please try again.
Correlation ID: 5bc89c54-bd95-4a4a-8072-fc4f5721c8d2
Timestamp: 2018-10-02 03:08:30Z
AADB2C90165: The SAML initiating message with id '' cannot be found in state.

Already googled the issue and asked to Microsoft's support, but no answer found in either of them. Since Identity Framework is in Preview, there's no official support for these features.

Attached my custom policies

customPolicies.zip

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

azure-samples / active-directory-b2c-advanced-policies Goto Github PK