Azure AD B2C SSO: Configure & Upload Policies / Keys

The steps in this section are critical to perform after you have completed steps in the previous section. Here you manage the keys and policies to support the overall configuration.

If you stop and return to any of the procedures in this configuration process, ensure that you switch to the correct directory before you continue so that you are working on the correct Azure AD B2C Tenant container.

The order in which you perform certain steps matters. Perform the steps in exactly the order shown.

Upload the Stellar Cyber DP Server Certificate

StepsClosed

  1. Locate the Stellar Cyber DP server .pfx you obtained before you started the steps in this topic. If you created a password for it, have that value noted.

    Self-signed server certificates are NOT supported by Azure AD B2C for this purpose.

  2. Access All services from the top-left corner of the Azure portal, and then search for and select Azure AD B2C.

  3. From the Overview page, select Identity Experience Framework.

  4. Select Policy Keys and then select Add.

  5. For Options, choose Upload.

  6. Enter a Name for the policy key for the Stellar Cyber pfx file. For example, enter SamlIdpCert. The prefix B2C_1A_is added automatically to the name of your key.

    The name you enter here MUST be the same as the values for the following fields in the file ending with TrustFrameworkBase.xml:

    <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />

    <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />

    <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />

  7. Browse to and select the public .pfx certificate file with the private key that you obtained for the Stellar Cyber DP. (Password is not required unless you created the pfx with a password)

  8. Click Create.

  9. The pane refreshes to display the key and the associated container file that is automatically created: B2C_1A_AdminClientEncryptionKeyContainer.

Configure Custom Policies to support SAML

If you stop and return to any of the procedures in this configuration process, ensure that you switch to the correct directory before you continue so that you are working on the correct Azure AD B2C Tenant container.

Download & Rename Sample Template Files

StepsClosed

The following instructions are based on sample templates that you can download below. The template files are set up to support configuration of both Authentication and Authorization, but can also be used to configure just Authentication.

As you edit these files, pay attention to the following:

  • Note that some attributes appear multiple times. You MUST ensure they are all consistent.

  • The values are case sensitive.

  • The policy names within each template file (PolicyId attribute) must match the naming of the corresponding file. In the templates, the syntax for the filenames is <upload order number> _<tenant name-domain>—<filename>.xml.

  1. Download the sample policy templates.

  2. Unzip the package and either use the samples as a guide to customize your own policy files or customize these for upload.

  3. Rename all the files to use the Azure AD B2C Primary Domain you copied to your worksheet, replacing stellarpmb2c.onmicrosoft.com with your primary domain.

Make Global Edits to the Files

StepsClosed

Make the following global edits in every file.

  1. Use the Azure AD B2C Primary Domain you copied to your worksheet and replace the TenantId value and the domain portion of the PublicPolicyUri="http://<domain>/<filename> value.

  2. Use the Azure AD B2C Tenant ID you copied to your worksheet) and replace the TenantObjectId value.

Edit TrustFrameworkBase.xml

StepsClosed

  1. Some of the edits for this file were completed with the Global edits you made above. Edit the file ending with TrustFrameworkBase.xml and ensure the highlighted values were made.

    <TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkBase" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkBase" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">

  2. Make the additional changes, as needed, to ensure the highlighted values below are consistent with the values you recorded on your worksheet.

    <Item Key="IssuerUri">https://stellarpmb2c.b2clogin.com/stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_SAML</Item>

    <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />

    <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />

    <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />

    <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />

    <Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" />

    Your standard authentication file will look similar to this:

    Copy
    TrustFrameworkBase.xml
    <TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkBase" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkBase" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
      <BuildingBlocks>
        <ClaimsSchema>
          <!-- The ClaimsSchema is divided into three sections:
               1. Section I lists the minimum claims that are required for the user journeys to work properly.
               2. Section II lists the claims required for query string parameters and other special parameters 
                  to be passed to other claims providers, esp. login.microsoftonline.com for authentication. 
                  Please do not modify these claims.
               3. Section III lists any additional (optional) claims that can be collected from the user, stored 
                  in the directory and sent in tokens during sign in. Add new claims to be collected from the user 
                  and/or sent in the token in Section III. -->
          <!-- NOTE: The claims schema contains restrictions on certain claims such as passwords and usernames. 
               The trust framework policy treats Azure AD as any other claims provider and all its restrictions 
               are modelled in the policy. A policy could be modified to add more restrictions, or use another 
               claims provider for credential storage which will have its own restrictions. -->
          <!-- SECTION I: Claims required for user journeys to work properly -->
          <ClaimType Id="socialIdpUserId">
            <DisplayName>Username</DisplayName>
            <DataType>string</DataType>
            <UserHelpText />
            <UserInputType>TextBox</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^[a-zA-Z0-9]+[a-zA-Z0-9_-]*$" HelpText="The username you provided is not valid. It must begin with an alphabet or number and can contain alphabets, numbers and the following symbols: _ -" />
            </Restriction>
          </ClaimType>
          <ClaimType Id="tenantId">
            <DisplayName>User's Object's Tenant ID</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="tid" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="tid" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/tenantid" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Tenant identifier (ID) of the user object in Azure AD.</UserHelpText>
          </ClaimType>
          <ClaimType Id="objectId">
            <DisplayName>User's Object ID</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="oid" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="oid" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/objectidentifier" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Object identifier (ID) of the user object in Azure AD.</UserHelpText>
          </ClaimType>
          <!-- Claims needed for local accounts. -->
          <ClaimType Id="signInName">
            <DisplayName>Sign in name</DisplayName>
            <DataType>string</DataType>
            <UserHelpText />
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="signInNames.emailAddress">
            <DisplayName>Email Address</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Email address to use for signing in.</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="accountEnabled">
            <DisplayName>Account Enabled</DisplayName>
            <DataType>boolean</DataType>
            <AdminHelpText>Specifies whether the user's account is enabled.</AdminHelpText>
            <UserHelpText>Specifies whether your account is enabled.</UserHelpText>
          </ClaimType>
          <ClaimType Id="password">
            <DisplayName>Password</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Enter password</UserHelpText>
            <UserInputType>Password</UserInputType>
          </ClaimType>
          <!-- The claim types newPassword and reenterPassword are considered special, please do not change the names. 
               The UI validates that the user correctly re-entered their password during account creation based on these 
               claim types.      -->
          <ClaimType Id="newPassword">
            <DisplayName>New Password</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Enter new password</UserHelpText>
            <UserInputType>Password</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^((?=.*[a-z])(?=.*[A-Z])(?=.*\d)|(?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9])|(?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9])|(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]))([A-Za-z\d@#$%^&amp;*\-_+=[\]{}|\\:',?/`~&quot;();!]|\.(?!@)){8,16}$" HelpText="8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ &quot; ( ) ; ." />
            </Restriction>
          </ClaimType>
          <!-- The password regular expression above is constructed for AAD passwords based on restrictions at https://msdn.microsoft.com/en-us/library/azure/jj943764.aspx

            ^( # one of the following four combinations must appear in the password
             (?=.*[a-z])(?=.*[A-Z])(?=.*\d) |            # matches lower case, upper case or digit
             (?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9]) |  # matches lower case, upper case or special character (i.e. non-alpha or digit)
             (?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9]) |     # matches lower case, digit, or special character
             (?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9])       # matches upper case, digit, or special character
            )
            ( # The password must match the following restrictions
             [A-Za-z\d@#$%^&*\-_+=[\]{}|\\:',?/`~"();!] |   # The list of all acceptable characters (without .)
             \.(?!@)                                        # or . can appear as long as not followed by @
            ) {8,16}$                                       # the length must be between 8 and 16 chars inclusive

          -->
          <ClaimType Id="reenterPassword">
            <DisplayName>Confirm New Password</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Confirm new password</UserHelpText>
            <UserInputType>Password</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^((?=.*[a-z])(?=.*[A-Z])(?=.*\d)|(?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9])|(?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9])|(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]))([A-Za-z\d@#$%^&amp;*\-_+=[\]{}|\\:',?/`~&quot;();!]|\.(?!@)){8,16}$" HelpText=" " />
            </Restriction>
          </ClaimType>
          <ClaimType Id="passwordPolicies">
            <DisplayName>Password Policies</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Password policies used by Azure AD to determine password strength, expiry etc.</UserHelpText>
          </ClaimType>
          <ClaimType Id="client_id">
            <DisplayName>client_id</DisplayName>
            <DataType>string</DataType>
            <AdminHelpText>Special parameter passed to EvoSTS.</AdminHelpText>
            <UserHelpText>Special parameter passed to EvoSTS.</UserHelpText>
          </ClaimType>
          <ClaimType Id="resource_id">
            <DisplayName>resource_id</DisplayName>
            <DataType>string</DataType>
            <AdminHelpText>Special parameter passed to EvoSTS.</AdminHelpText>
            <UserHelpText>Special parameter passed to EvoSTS.</UserHelpText>
          </ClaimType>
          <ClaimType Id="sub">
            <DisplayName>Subject</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OpenIdConnect" PartnerClaimType="sub" />
            </DefaultPartnerClaimTypes>
            <UserHelpText />
          </ClaimType>
          <ClaimType Id="identityProvider">
            <DisplayName>Identity Provider</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="idp" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="idp" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/identityprovider" />
            </DefaultPartnerClaimTypes>
            <UserHelpText />
          </ClaimType>
          <ClaimType Id="displayName">
            <DisplayName>Display Name</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="unique_name" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="name" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your display name.</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="email">
            <DisplayName>Email Address</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OpenIdConnect" PartnerClaimType="email" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Email address that can be used to contact you.</UserHelpText>
            <UserInputType>TextBox</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^[a-zA-Z0-9.!#$%&amp;'^_`{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." />
            </Restriction>
          </ClaimType>
          <ClaimType Id="otherMails">
            <DisplayName>Alternate Email Addresses</DisplayName>
            <DataType>stringCollection</DataType>
            <UserHelpText>Email addresses that can be used to contact the user.</UserHelpText>
          </ClaimType>
          <ClaimType Id="userPrincipalName">
            <DisplayName>UserPrincipalName</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="upn" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="upn" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/userprincipalname" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your user name as stored in the Azure Active Directory.</UserHelpText>
          </ClaimType>
          <ClaimType Id="upnUserName">
            <DisplayName>UPN User Name</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>The user name for creating user principal name.</UserHelpText>
          </ClaimType>
          <ClaimType Id="newUser">
            <DisplayName>User is new</DisplayName>
            <DataType>boolean</DataType>
            <UserHelpText />
          </ClaimType>
          <ClaimType Id="executed-SelfAsserted-Input">
            <DisplayName>Executed-SelfAsserted-Input</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>A claim that specifies whether attributes were collected from the user.</UserHelpText>
          </ClaimType>
          <ClaimType Id="authenticationSource">
            <DisplayName>AuthenticationSource</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Specifies whether the user was authenticated at Social IDP or local account.</UserHelpText>
          </ClaimType>
          <!-- SECTION II: Claims required to pass on special parameters (including some query string parameters) to other claims providers -->
          <ClaimType Id="nca">
            <DisplayName>nca</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
          </ClaimType>
          <ClaimType Id="grant_type">
            <DisplayName>grant_type</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
          </ClaimType>
          <ClaimType Id="scope">
            <DisplayName>scope</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
          </ClaimType>
          <ClaimType Id="objectIdFromSession">
            <DisplayName>objectIdFromSession</DisplayName>
            <DataType>boolean</DataType>
            <UserHelpText>Parameter provided by the default session management provider to indicate that the object id has been retrieved from an SSO session.</UserHelpText>
          </ClaimType>
          <ClaimType Id="isActiveMFASession">
            <DisplayName>isActiveMFASession</DisplayName>
            <DataType>boolean</DataType>
            <UserHelpText>Parameter provided by the MFA session management to indicate that the user has an active MFA session.</UserHelpText>
          </ClaimType>
          <!-- SECTION III: Additional claims that can be collected from the users, stored in the directory, and sent in the token. Add additional claims here. -->
          <ClaimType Id="givenName">
            <DisplayName>Given Name</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="given_name" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="given_name" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your given name (also known as first name).</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="surname">
            <DisplayName>Surname</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="family_name" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="family_name" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your surname (also known as family name or last name).</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="mail">
            <DisplayName>mail</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mail" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>mail</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_privilege">
            <DisplayName>stellar_privilege</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_privilege" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_privilege</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_scope">
            <DisplayName>stellar_scope</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_scope" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_scope</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_tenant">
            <DisplayName>stellar_tenant</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_tenant" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_tenant</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_tenant_group">
            <DisplayName>stellar_tenant_group</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_tenant_group" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_tenant_group</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
        </ClaimsSchema>
        <ClaimsTransformations>
          <ClaimsTransformation Id="CreateOtherMailsFromEmail" TransformationMethod="AddItemToStringCollection">
            <InputClaims>
              <InputClaim ClaimTypeReferenceId="email" TransformationClaimType="item" />
              <InputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" />
            </InputClaims>
            <OutputClaims>
              <OutputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" />
            </OutputClaims>
          </ClaimsTransformation>
          <ClaimsTransformation Id="AssertAccountEnabledIsTrue" TransformationMethod="AssertBooleanClaimIsEqualToValue">
            <InputClaims>
              <InputClaim ClaimTypeReferenceId="accountEnabled" TransformationClaimType="inputClaim" />
            </InputClaims>
            <InputParameters>
              <InputParameter Id="valueToCompareTo" DataType="boolean" Value="true" />
            </InputParameters>
          </ClaimsTransformation>
        </ClaimsTransformations>
        <ClientDefinitions>
          <ClientDefinition Id="DefaultWeb">
            <ClientUIFilterFlags>LineMarkers, MetaRefresh</ClientUIFilterFlags>
          </ClientDefinition>
        </ClientDefinitions>
        <ContentDefinitions>
          <!-- This content definition is to render an error page that displays unhandled errors. -->
          <ContentDefinition Id="api.error">
            <LoadUri>~/tenant/templates/AzureBlue/exception.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:globalexception:1.2.1</DataUri>
            <Metadata>
              <Item Key="DisplayName">Error page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.idpselections">
            <LoadUri>~/tenant/templates/AzureBlue/idpSelector.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:providerselection:1.2.1</DataUri>
            <Metadata>
              <Item Key="DisplayName">Idp selection page</Item>
              <Item Key="language.intro">Sign in</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.idpselections.signup">
            <LoadUri>~/tenant/templates/AzureBlue/idpSelector.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:providerselection:1.2.1</DataUri>
            <Metadata>
              <Item Key="DisplayName">Idp selection page</Item>
              <Item Key="language.intro">Sign up</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.signuporsignin">
            <LoadUri>~/tenant/templates/AzureBlue/unified.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:unifiedssp:2.1.5</DataUri>
            <Metadata>
              <Item Key="DisplayName">Signin and Signup</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.selfasserted">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Collect information from user page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.selfasserted.profileupdate">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Collect information from user page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.localaccountsignup">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Local account sign up page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.localaccountpasswordreset">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Local account change password page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.localaccountsignin">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Collect information from user page</Item>
            </Metadata>
          </ContentDefinition>
        </ContentDefinitions>
      </BuildingBlocks>
      <!--
            A list of all the claim providers that can be used in the technical policies. If a claims provider is not listed 
            in this section, then it cannot be used in a technical policy.
        -->
      <ClaimsProviders>
        <ClaimsProvider>
          <DisplayName>Local Account SignIn</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="login-NonInteractive">
              <DisplayName>Local Account SignIn</DisplayName>
              <Protocol Name="OpenIdConnect" />
              <Metadata>
                <Item Key="ProviderName">https://sts.windows.net/</Item>
                <Item Key="METADATA">https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration</Item>
                <Item Key="authorization_endpoint">https://login.microsoftonline.com/{tenant}/oauth2/token</Item>
                <Item Key="response_types">id_token</Item>
                <Item Key="response_mode">query</Item>
                <Item Key="scope">email openid</Item>
                <!-- <Item Key="grant_type">password</Item> -->
                <!-- Policy Engine Clients -->
                <Item Key="UsePolicyInRedirectUri">false</Item>
                <Item Key="HttpBinding">POST</Item>
                <Item Key="client_id">ProxyIdentityExperienceFrameworkAppId</Item>
                <Item Key="IdTokenAudience">IdentityExperienceFrameworkAppId</Item>
              </Metadata>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" />
                <InputClaim ClaimTypeReferenceId="password" Required="true" />
                <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="password" AlwaysUseDefaultValue="true" />
                <InputClaim ClaimTypeReferenceId="scope" DefaultValue="openid" AlwaysUseDefaultValue="true" />
                <InputClaim ClaimTypeReferenceId="nca" PartnerClaimType="nca" DefaultValue="1" />
                <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="ProxyIdentityExperienceFrameworkAppID" />
                <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="IdentityExperienceFrameworkAppID" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" />
                <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
                <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
                <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
                <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
              </OutputClaims>
            </TechnicalProfile>
            <TechnicalProfile Id="Saml2AssertionIssuer">
              <DisplayName>Token Issuer</DisplayName>
              <Protocol Name="SAML2" />
              <OutputTokenFormat>SAML2</OutputTokenFormat>
              <Metadata>
                <Item Key="IssuerUri">https://stellarpmb2c.b2clogin.com/stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_SAML</Item>
                <Item Key="TokenNotBeforeSkewInSeconds">600</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
                <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
                <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
              </CryptographicKeys>
              <InputClaims />
              <OutputClaims />
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer" />
            </TechnicalProfile>
            <TechnicalProfile Id="SM-Saml-issuer">
              <DisplayName>Session Management Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Azure Active Directory</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="AAD-Common">
              <DisplayName>Azure Active Directory</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureActiveDirectoryProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <!-- We need this here to suppress the SelfAsserted provider from invoking SSO on validation profiles. -->
              <IncludeInSso>false</IncludeInSso>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
            </TechnicalProfile>
            <!-- Technical profiles for local accounts -->
            <TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
              <Metadata>
                <Item Key="Operation">Write</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
              </InputClaims>
              <PersistedClaims>
                <!-- Required claims -->
                <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
                <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
                <PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" />
                <PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" />
                <!-- Optional claims. -->
                <PersistedClaim ClaimTypeReferenceId="givenName" />
                <PersistedClaim ClaimTypeReferenceId="surname" />
                <PersistedClaim ClaimTypeReferenceId="userPrincipalName" />
                <PersistedClaim ClaimTypeReferenceId="mail" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </PersistedClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
              </OutputClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
            </TechnicalProfile>
            <TechnicalProfile Id="AAD-UserReadUsingEmailAddress">
              <Metadata>
                <Item Key="Operation">Read</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
              </InputClaims>
              <OutputClaims>
                <!-- Required claims -->
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
                <!-- Optional claims -->
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="displayName" />
                <OutputClaim ClaimTypeReferenceId="accountEnabled" />
                <OutputClaim ClaimTypeReferenceId="otherMails" />
                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
              </OutputClaims>
              <OutputClaimsTransformations>
                <OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
              </OutputClaimsTransformations>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
            <TechnicalProfile Id="AAD-UserWritePasswordUsingObjectId">
              <Metadata>
                <Item Key="Operation">Write</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
              </InputClaims>
              <PersistedClaims>
                <PersistedClaim ClaimTypeReferenceId="objectId" />
                <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
              </PersistedClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
            <!-- Technical profiles for updating user record using objectId -->
            <TechnicalProfile Id="AAD-UserWriteProfileUsingObjectId">
              <Metadata>
                <Item Key="Operation">Write</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">false</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
              </InputClaims>
              <PersistedClaims>
                <!-- Required claims -->
                <PersistedClaim ClaimTypeReferenceId="objectId" />
                <!-- Optional claims -->
                <PersistedClaim ClaimTypeReferenceId="givenName" />
                <PersistedClaim ClaimTypeReferenceId="surname" />
                <PersistedClaim ClaimTypeReferenceId="userPrincipalName" />
                <PersistedClaim ClaimTypeReferenceId="mail" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </PersistedClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
            <!-- The following technical profile is used to read data after user authenticates. -->
            <TechnicalProfile Id="AAD-UserReadUsingObjectId">
              <Metadata>
                <Item Key="Operation">Read</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
              </InputClaims>
              <OutputClaims>
                <!-- Optional claims -->
                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
                <OutputClaim ClaimTypeReferenceId="displayName" />
                <OutputClaim ClaimTypeReferenceId="otherMails" />
                <OutputClaim ClaimTypeReferenceId="givenName" />
                <OutputClaim ClaimTypeReferenceId="surname" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="mail" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </OutputClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Self Asserted</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="SelfAsserted-ProfileUpdate">
              <DisplayName>User ID signup</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="ContentDefinitionReferenceId">api.selfasserted.profileupdate</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="userPrincipalName" />
                <!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                     ValidationTechnicalProfile referenced below so it can be written to directory after being updated by the user, i.e. AAD-UserWriteProfileUsingObjectId. -->
                <InputClaim ClaimTypeReferenceId="givenName" />
                <InputClaim ClaimTypeReferenceId="surname" />
                <InputClaim ClaimTypeReferenceId="userPrincipalName" />
                <InputClaim ClaimTypeReferenceId="mail" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </InputClaims>
              <OutputClaims>
                <!-- Required claims -->
                <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
                <!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                     ValidationTechnicalProfile referenced below so it can be written to directory after being updated by the user, i.e. AAD-UserWriteProfileUsingObjectId. -->
                <OutputClaim ClaimTypeReferenceId="givenName" />
                <OutputClaim ClaimTypeReferenceId="surname" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="mail" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserWriteProfileUsingObjectId" />
              </ValidationTechnicalProfiles>
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Local Account</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
              <DisplayName>Email signup</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
                <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="email" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
                <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
                <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
                <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" />
                <OutputClaim ClaimTypeReferenceId="newUser" />
                <!-- Optional claims, to be collected from the user -->
                <OutputClaim ClaimTypeReferenceId="displayName" />
                <OutputClaim ClaimTypeReferenceId="givenName" />
                <OutputClaim ClaimTypeReferenceId="surName" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
              </ValidationTechnicalProfiles>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
            </TechnicalProfile>
            <!-- This technical profile uses a validation technical profile to authenticate the user. -->
            <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
              <DisplayName>Local Account Signin</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="SignUpTarget">SignUpWithLogonEmailExchange</Item>
                <Item Key="setting.operatingMode">Email</Item>
                <Item Key="ContentDefinitionReferenceId">api.localaccountsignin</Item>
                <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="signInName" DefaultValue="{OIDC:LoginHint}" AlwaysUseDefaultValue="true" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
                <OutputClaim ClaimTypeReferenceId="password" Required="true" />
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
              </ValidationTechnicalProfiles>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
            </TechnicalProfile>
            <!-- This technical profile forces the user to verify the email address that they provide on the UI. Only after email is verified, the user account is
            read from the directory. -->
            <TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddress">
              <DisplayName>Reset password using email address</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
                <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <IncludeInSso>false</IncludeInSso>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />
              </ValidationTechnicalProfiles>
            </TechnicalProfile>
            <TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
              <DisplayName>Change password (username)</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
                <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" />
              </ValidationTechnicalProfiles>
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Session Management</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="SM-Noop">
              <DisplayName>Noop Session Management Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.NoopSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
            </TechnicalProfile>
            <TechnicalProfile Id="SM-AAD">
              <DisplayName>Session Mananagement Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <PersistedClaims>
                <PersistedClaim ClaimTypeReferenceId="objectId" />
                <PersistedClaim ClaimTypeReferenceId="signInName" />
                <PersistedClaim ClaimTypeReferenceId="authenticationSource" />
                <PersistedClaim ClaimTypeReferenceId="identityProvider" />
                <PersistedClaim ClaimTypeReferenceId="newUser" />
                <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" />
              </PersistedClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true" />
              </OutputClaims>
            </TechnicalProfile>
            <!-- Session management technical profile for OIDC based tokens -->
            <TechnicalProfile Id="SM-jwt-issuer">
              <DisplayName>Session Management Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.OAuthSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Trustframework Policy Engine TechnicalProfiles</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="TpEngine_c3bd4fe2-1775-4013-b91d-35f16d377d13">
              <DisplayName>Trustframework Policy Engine Default Technical Profile</DisplayName>
              <Protocol Name="None" />
              <Metadata>
                <Item Key="url">{service:te}</Item>
              </Metadata>
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Token Issuer</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="JwtIssuer">
              <DisplayName>JWT Issuer</DisplayName>
              <Protocol Name="OpenIdConnect" />
              <OutputTokenFormat>JWT</OutputTokenFormat>
              <Metadata>
                <Item Key="client_id">{service:te}</Item>
                <Item Key="issuer_refresh_token_user_identity_claim_type">objectId</Item>
                <Item Key="SendTokenResponseBodyWithJsonNumbers">true</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
                <Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" />
              </CryptographicKeys>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-jwt-issuer" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
      </ClaimsProviders>
      <UserJourneys>
        <UserJourney Id="SignUpOrSignIn">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
              <ClaimsProviderSelections>
                <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
              </ClaimsProviderSelections>
              <ClaimsExchanges>
                <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <Preconditions>
                <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                  <Value>objectId</Value>
                  <Action>SkipThisOrchestrationStep</Action>
                </Precondition>
              </Preconditions>
              <ClaimsExchanges>
                <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <!-- This step reads any user attributes that we may not have received when in the token. -->
            <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
          </OrchestrationSteps>
          <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>
        <UserJourney Id="ProfileEdit">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
              <ClaimsProviderSelections>
                <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
              </ClaimsProviderSelections>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="B2CUserProfileUpdateExchange" TechnicalProfileReferenceId="SelfAsserted-ProfileUpdate" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
          </OrchestrationSteps>
          <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>
        <UserJourney Id="PasswordReset">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
          </OrchestrationSteps>
          <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>
      </UserJourneys>
    </TrustFrameworkPolicy>

    If you are configuring Azure native multi-factor authentication, your file will look similar to this:

    Copy
    TrustFrameworkBase (MFA)
    <TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkBase" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkBase" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
      <BuildingBlocks>
        <ClaimsSchema>
          <!-- The ClaimsSchema is divided into three sections:
               1. Section I lists the minimum claims that are required for the user journeys to work properly.
               2. Section II lists the claims required for query string parameters and other special parameters 
                  to be passed to other claims providers, esp. login.microsoftonline.com for authentication. 
                  Please do not modify these claims.
               3. Section III lists any additional (optional) claims that can be collected from the user, stored 
                  in the directory and sent in tokens during sign in. Add new claims to be collected from the user 
                  and/or sent in the token in Section III. -->
          <!-- NOTE: The claims schema contains restrictions on certain claims such as passwords and usernames. 
               The trust framework policy treats Azure AD as any other claims provider and all its restrictions 
               are modelled in the policy. A policy could be modified to add more restrictions, or use another 
               claims provider for credential storage which will have its own restrictions. -->
          <!-- SECTION I: Claims required for user journeys to work properly -->
          <ClaimType Id="socialIdpUserId">
            <DisplayName>Username</DisplayName>
            <DataType>string</DataType>
            <UserHelpText />
            <UserInputType>TextBox</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^[a-zA-Z0-9]+[a-zA-Z0-9_-]*$" HelpText="The username you provided is not valid. It must begin with an alphabet or number and can contain alphabets, numbers and the following symbols: _ -" />
            </Restriction>
          </ClaimType>
          <ClaimType Id="tenantId">
            <DisplayName>User's Object's Tenant ID</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="tid" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="tid" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/tenantid" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Tenant identifier (ID) of the user object in Azure AD.</UserHelpText>
          </ClaimType>
          <ClaimType Id="objectId">
            <DisplayName>User's Object ID</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="oid" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="oid" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/objectidentifier" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Object identifier (ID) of the user object in Azure AD.</UserHelpText>
          </ClaimType>
          <!-- Claims needed for local accounts. -->
          <ClaimType Id="signInName">
            <DisplayName>Sign in name</DisplayName>
            <DataType>string</DataType>
            <UserHelpText />
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="signInNames.emailAddress">
            <DisplayName>Email Address</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Email address to use for signing in.</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="accountEnabled">
            <DisplayName>Account Enabled</DisplayName>
            <DataType>boolean</DataType>
            <AdminHelpText>Specifies whether the user's account is enabled.</AdminHelpText>
            <UserHelpText>Specifies whether your account is enabled.</UserHelpText>
          </ClaimType>
          <ClaimType Id="password">
            <DisplayName>Password</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Enter password</UserHelpText>
            <UserInputType>Password</UserInputType>
          </ClaimType>
          <!-- The claim types newPassword and reenterPassword are considered special, please do not change the names. 
               The UI validates that the user correctly re-entered their password during account creation based on these 
               claim types.      -->
          <ClaimType Id="newPassword">
            <DisplayName>New Password</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Enter new password</UserHelpText>
            <UserInputType>Password</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^((?=.*[a-z])(?=.*[A-Z])(?=.*\d)|(?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9])|(?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9])|(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]))([A-Za-z\d@#$%^&amp;*\-_+=[\]{}|\\:',?/`~&quot;();!]|\.(?!@)){8,16}$" HelpText="8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ &quot; ( ) ; ." />
            </Restriction>
          </ClaimType>
          <!-- The password regular expression above is constructed for AAD passwords based on restrictions at https://msdn.microsoft.com/en-us/library/azure/jj943764.aspx

            ^( # one of the following four combinations must appear in the password
             (?=.*[a-z])(?=.*[A-Z])(?=.*\d) |            # matches lower case, upper case or digit
             (?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9]) |  # matches lower case, upper case or special character (i.e. non-alpha or digit)
             (?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9]) |     # matches lower case, digit, or special character
             (?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9])       # matches upper case, digit, or special character
            )
            ( # The password must match the following restrictions
             [A-Za-z\d@#$%^&*\-_+=[\]{}|\\:',?/`~"();!] |   # The list of all acceptable characters (without .)
             \.(?!@)                                        # or . can appear as long as not followed by @
            ) {8,16}$                                       # the length must be between 8 and 16 chars inclusive

          -->
          <ClaimType Id="reenterPassword">
            <DisplayName>Confirm New Password</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Confirm new password</UserHelpText>
            <UserInputType>Password</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^((?=.*[a-z])(?=.*[A-Z])(?=.*\d)|(?=.*[a-z])(?=.*[A-Z])(?=.*[^A-Za-z0-9])|(?=.*[a-z])(?=.*\d)(?=.*[^A-Za-z0-9])|(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]))([A-Za-z\d@#$%^&amp;*\-_+=[\]{}|\\:',?/`~&quot;();!]|\.(?!@)){8,16}$" HelpText=" " />
            </Restriction>
          </ClaimType>
          <ClaimType Id="passwordPolicies">
            <DisplayName>Password Policies</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Password policies used by Azure AD to determine password strength, expiry etc.</UserHelpText>
          </ClaimType>
          <ClaimType Id="client_id">
            <DisplayName>client_id</DisplayName>
            <DataType>string</DataType>
            <AdminHelpText>Special parameter passed to EvoSTS.</AdminHelpText>
            <UserHelpText>Special parameter passed to EvoSTS.</UserHelpText>
          </ClaimType>
          <ClaimType Id="resource_id">
            <DisplayName>resource_id</DisplayName>
            <DataType>string</DataType>
            <AdminHelpText>Special parameter passed to EvoSTS.</AdminHelpText>
            <UserHelpText>Special parameter passed to EvoSTS.</UserHelpText>
          </ClaimType>
          <ClaimType Id="sub">
            <DisplayName>Subject</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OpenIdConnect" PartnerClaimType="sub" />
            </DefaultPartnerClaimTypes>
            <UserHelpText />
          </ClaimType>
          <ClaimType Id="identityProvider">
            <DisplayName>Identity Provider</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="idp" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="idp" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/identityprovider" />
            </DefaultPartnerClaimTypes>
            <UserHelpText />
          </ClaimType>
          <ClaimType Id="displayName">
            <DisplayName>Display Name</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="unique_name" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="name" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your display name.</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="email">
            <DisplayName>Email Address</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OpenIdConnect" PartnerClaimType="email" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Email address that can be used to contact you.</UserHelpText>
            <UserInputType>TextBox</UserInputType>
            <Restriction>
              <Pattern RegularExpression="^[a-zA-Z0-9.!#$%&amp;'^_`{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." />
            </Restriction>
          </ClaimType>
          <ClaimType Id="otherMails">
            <DisplayName>Alternate Email Addresses</DisplayName>
            <DataType>stringCollection</DataType>
            <UserHelpText>Email addresses that can be used to contact the user.</UserHelpText>
          </ClaimType>
          <ClaimType Id="userPrincipalName">
            <DisplayName>UserPrincipalName</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="upn" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="upn" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/identity/claims/userprincipalname" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your user name as stored in the Azure Active Directory.</UserHelpText>
          </ClaimType>
          <ClaimType Id="upnUserName">
            <DisplayName>UPN User Name</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>The user name for creating user principal name.</UserHelpText>
          </ClaimType>
          <ClaimType Id="newUser">
            <DisplayName>User is new</DisplayName>
            <DataType>boolean</DataType>
            <UserHelpText />
          </ClaimType>
          <ClaimType Id="executed-SelfAsserted-Input">
            <DisplayName>Executed-SelfAsserted-Input</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>A claim that specifies whether attributes were collected from the user.</UserHelpText>
          </ClaimType>
          <ClaimType Id="authenticationSource">
            <DisplayName>AuthenticationSource</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Specifies whether the user was authenticated at Social IDP or local account.</UserHelpText>
          </ClaimType>
          <!-- SECTION II: Claims required to pass on special parameters (including some query string parameters) to other claims providers -->
          <ClaimType Id="nca">
            <DisplayName>nca</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
          </ClaimType>
          <ClaimType Id="grant_type">
            <DisplayName>grant_type</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
          </ClaimType>
          <ClaimType Id="scope">
            <DisplayName>scope</DisplayName>
            <DataType>string</DataType>
            <UserHelpText>Special parameter passed for local account authentication to login.microsoftonline.com.</UserHelpText>
          </ClaimType>
          <ClaimType Id="objectIdFromSession">
            <DisplayName>objectIdFromSession</DisplayName>
            <DataType>boolean</DataType>
            <UserHelpText>Parameter provided by the default session management provider to indicate that the object id has been retrieved from an SSO session.</UserHelpText>
          </ClaimType>
          <ClaimType Id="isActiveMFASession">
            <DisplayName>isActiveMFASession</DisplayName>
            <DataType>boolean</DataType>
            <UserHelpText>Parameter provided by the MFA session management to indicate that the user has an active MFA session.</UserHelpText>
          </ClaimType>
          <!-- SECTION III: Additional claims that can be collected from the users, stored in the directory, and sent in the token. Add additional claims here. -->
          <ClaimType Id="givenName">
            <DisplayName>Given Name</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="given_name" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="given_name" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your given name (also known as first name).</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="surname">
            <DisplayName>Surname</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="family_name" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="family_name" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>Your surname (also known as family name or last name).</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="mail">
            <DisplayName>mail</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mail" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>mail</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_privilege">
            <DisplayName>stellar_privilege</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_privilege" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_privilege</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_scope">
            <DisplayName>stellar_scope</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_scope" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_scope</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_tenant">
            <DisplayName>stellar_tenant</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_tenant" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_tenant</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
          <ClaimType Id="extension_stellar_tenant_group">
            <DisplayName>stellar_tenant_group</DisplayName>
            <DataType>string</DataType>
            <DefaultPartnerClaimTypes>
              <Protocol Name="OAuth2" PartnerClaimType="mail" />
              <Protocol Name="OpenIdConnect" PartnerClaimType="mail" />
              <Protocol Name="SAML2" PartnerClaimType="stellar_tenant_group" />
            </DefaultPartnerClaimTypes>
            <UserHelpText>stellar_tenant_group</UserHelpText>
            <UserInputType>TextBox</UserInputType>
          </ClaimType>
        </ClaimsSchema>
        <ClaimsTransformations>
          <ClaimsTransformation Id="CreateOtherMailsFromEmail" TransformationMethod="AddItemToStringCollection">
            <InputClaims>
              <InputClaim ClaimTypeReferenceId="email" TransformationClaimType="item" />
              <InputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" />
            </InputClaims>
            <OutputClaims>
              <OutputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" />
            </OutputClaims>
          </ClaimsTransformation>
          <ClaimsTransformation Id="AssertAccountEnabledIsTrue" TransformationMethod="AssertBooleanClaimIsEqualToValue">
            <InputClaims>
              <InputClaim ClaimTypeReferenceId="accountEnabled" TransformationClaimType="inputClaim" />
            </InputClaims>
            <InputParameters>
              <InputParameter Id="valueToCompareTo" DataType="boolean" Value="true" />
            </InputParameters>
          </ClaimsTransformation>
        </ClaimsTransformations>
        <ClientDefinitions>
          <ClientDefinition Id="DefaultWeb">
            <ClientUIFilterFlags>LineMarkers, MetaRefresh</ClientUIFilterFlags>
          </ClientDefinition>
        </ClientDefinitions>
        <ContentDefinitions>
          <!-- This content definition is to render an error page that displays unhandled errors. -->
          <ContentDefinition Id="api.error">
            <LoadUri>~/tenant/templates/AzureBlue/exception.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:globalexception:1.2.1</DataUri>
            <Metadata>
              <Item Key="DisplayName">Error page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.idpselections">
            <LoadUri>~/tenant/templates/AzureBlue/idpSelector.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:providerselection:1.2.1</DataUri>
            <Metadata>
              <Item Key="DisplayName">Idp selection page</Item>
              <Item Key="language.intro">Sign in</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.idpselections.signup">
            <LoadUri>~/tenant/templates/AzureBlue/idpSelector.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:providerselection:1.2.1</DataUri>
            <Metadata>
              <Item Key="DisplayName">Idp selection page</Item>
              <Item Key="language.intro">Sign up</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.signuporsignin">
            <LoadUri>~/tenant/templates/AzureBlue/unified.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:unifiedssp:2.1.5</DataUri>
            <Metadata>
              <Item Key="DisplayName">Signin and Signup</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.selfasserted">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Collect information from user page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.selfasserted.profileupdate">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Collect information from user page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.localaccountsignup">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Local account sign up page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.localaccountpasswordreset">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Local account change password page</Item>
            </Metadata>
          </ContentDefinition>
          <ContentDefinition Id="api.localaccountsignin">
            <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
            <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
            <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
            <Metadata>
              <Item Key="DisplayName">Collect information from user page</Item>
            </Metadata>
          </ContentDefinition>
        </ContentDefinitions>
      </BuildingBlocks>
      <!--
            A list of all the claim providers that can be used in the technical policies. If a claims provider is not listed 
            in this section, then it cannot be used in a technical policy.
        -->
      <ClaimsProviders>
        <ClaimsProvider>
          <DisplayName>Local Account SignIn</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="login-NonInteractive">
              <DisplayName>Local Account SignIn</DisplayName>
              <Protocol Name="OpenIdConnect" />
              <Metadata>
                <Item Key="ProviderName">https://sts.windows.net/</Item>
                <Item Key="METADATA">https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration</Item>
                <Item Key="authorization_endpoint">https://login.microsoftonline.com/{tenant}/oauth2/token</Item>
                <Item Key="response_types">id_token</Item>
                <Item Key="response_mode">query</Item>
                <Item Key="scope">email openid</Item>
                <!-- <Item Key="grant_type">password</Item> -->
                <!-- Policy Engine Clients -->
                <Item Key="UsePolicyInRedirectUri">false</Item>
                <Item Key="HttpBinding">POST</Item>
                <Item Key="client_id">ProxyIdentityExperienceFrameworkAppId</Item>
                <Item Key="IdTokenAudience">IdentityExperienceFrameworkAppId</Item>
              </Metadata>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" />
                <InputClaim ClaimTypeReferenceId="password" Required="true" />
                <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="password" AlwaysUseDefaultValue="true" />
                <InputClaim ClaimTypeReferenceId="scope" DefaultValue="openid" AlwaysUseDefaultValue="true" />
                <InputClaim ClaimTypeReferenceId="nca" PartnerClaimType="nca" DefaultValue="1" />
                <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="ProxyIdentityExperienceFrameworkAppID" />
                <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="IdentityExperienceFrameworkAppID" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" />
                <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
                <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
                <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
                <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
              </OutputClaims>
            </TechnicalProfile>
            <TechnicalProfile Id="Saml2AssertionIssuer">
              <DisplayName>Token Issuer</DisplayName>
              <Protocol Name="SAML2" />
              <OutputTokenFormat>SAML2</OutputTokenFormat>
              <Metadata>
                <Item Key="IssuerUri">https://stellarpmb2c.b2clogin.com/stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_SAML</Item>
                <Item Key="TokenNotBeforeSkewInSeconds">600</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
                <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
                <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
              </CryptographicKeys>
              <InputClaims />
              <OutputClaims />
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer" />
            </TechnicalProfile>
            <TechnicalProfile Id="SM-Saml-issuer">
              <DisplayName>Session Management Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Azure Active Directory</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="AAD-Common">
              <DisplayName>Azure Active Directory</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureActiveDirectoryProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <!-- We need this here to suppress the SelfAsserted provider from invoking SSO on validation profiles. -->
              <IncludeInSso>false</IncludeInSso>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
            </TechnicalProfile>
            <!-- Technical profiles for local accounts -->
            <TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
              <Metadata>
                <Item Key="Operation">Write</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
              </InputClaims>
              <PersistedClaims>
                <!-- Required claims -->
                <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
                <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
                <PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" />
                <PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" />
                <!-- Optional claims. -->
                <PersistedClaim ClaimTypeReferenceId="givenName" />
                <PersistedClaim ClaimTypeReferenceId="surname" />
                <PersistedClaim ClaimTypeReferenceId="userPrincipalName" />
                <PersistedClaim ClaimTypeReferenceId="mail" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </PersistedClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
              </OutputClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
            </TechnicalProfile>
            <TechnicalProfile Id="AAD-UserReadUsingEmailAddress">
              <Metadata>
                <Item Key="Operation">Read</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
              </InputClaims>
              <OutputClaims>
                <!-- Required claims -->
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
                <!-- Optional claims -->
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="displayName" />
                <OutputClaim ClaimTypeReferenceId="accountEnabled" />
                <OutputClaim ClaimTypeReferenceId="otherMails" />
                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
              </OutputClaims>
              <OutputClaimsTransformations>
                <OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
              </OutputClaimsTransformations>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
            <TechnicalProfile Id="AAD-UserWritePasswordUsingObjectId">
              <Metadata>
                <Item Key="Operation">Write</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
              </InputClaims>
              <PersistedClaims>
                <PersistedClaim ClaimTypeReferenceId="objectId" />
                <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
              </PersistedClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
            <!-- Technical profiles for updating user record using objectId -->
            <TechnicalProfile Id="AAD-UserWriteProfileUsingObjectId">
              <Metadata>
                <Item Key="Operation">Write</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">false</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
              </InputClaims>
              <PersistedClaims>
                <!-- Required claims -->
                <PersistedClaim ClaimTypeReferenceId="objectId" />
                <!-- Optional claims -->
                <PersistedClaim ClaimTypeReferenceId="givenName" />
                <PersistedClaim ClaimTypeReferenceId="surname" />
                <PersistedClaim ClaimTypeReferenceId="userPrincipalName" />
                <PersistedClaim ClaimTypeReferenceId="mail" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <PersistedClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </PersistedClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
            <!-- The following technical profile is used to read data after user authenticates. -->
            <TechnicalProfile Id="AAD-UserReadUsingObjectId">
              <Metadata>
                <Item Key="Operation">Read</Item>
                <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" Required="true" />
              </InputClaims>
              <OutputClaims>
                <!-- Optional claims -->
                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
                <OutputClaim ClaimTypeReferenceId="displayName" />
                <OutputClaim ClaimTypeReferenceId="otherMails" />
                <OutputClaim ClaimTypeReferenceId="givenName" />
                <OutputClaim ClaimTypeReferenceId="surname" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="mail" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </OutputClaims>
              <IncludeTechnicalProfile ReferenceId="AAD-Common" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Self Asserted</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="SelfAsserted-ProfileUpdate">
              <DisplayName>User ID signup</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="ContentDefinitionReferenceId">api.selfasserted.profileupdate</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="userPrincipalName" />
                <!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                     ValidationTechnicalProfile referenced below so it can be written to directory after being updated by the user, i.e. AAD-UserWriteProfileUsingObjectId. -->
                <InputClaim ClaimTypeReferenceId="givenName" />
                <InputClaim ClaimTypeReferenceId="surname" />
                <InputClaim ClaimTypeReferenceId="userPrincipalName" />
                <InputClaim ClaimTypeReferenceId="mail" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <InputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </InputClaims>
              <OutputClaims>
                <!-- Required claims -->
                <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
                <!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                     ValidationTechnicalProfile referenced below so it can be written to directory after being updated by the user, i.e. AAD-UserWriteProfileUsingObjectId. -->
                <OutputClaim ClaimTypeReferenceId="givenName" />
                <OutputClaim ClaimTypeReferenceId="surname" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="mail" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserWriteProfileUsingObjectId" />
              </ValidationTechnicalProfiles>
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Local Account</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
              <DisplayName>Email signup</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
                <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="email" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
                <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
                <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
                <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" />
                <OutputClaim ClaimTypeReferenceId="newUser" />
                <!-- Optional claims, to be collected from the user -->
                <OutputClaim ClaimTypeReferenceId="displayName" />
                <OutputClaim ClaimTypeReferenceId="givenName" />
                <OutputClaim ClaimTypeReferenceId="surName" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
              </ValidationTechnicalProfiles>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
            </TechnicalProfile>
            <!-- This technical profile uses a validation technical profile to authenticate the user. -->
            <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
              <DisplayName>Local Account Signin</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="SignUpTarget">SignUpWithLogonEmailExchange</Item>
                <Item Key="setting.operatingMode">Email</Item>
                <Item Key="ContentDefinitionReferenceId">api.localaccountsignin</Item>
                <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
              </Metadata>
              <IncludeInSso>false</IncludeInSso>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="signInName" DefaultValue="{OIDC:LoginHint}" AlwaysUseDefaultValue="true" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
                <OutputClaim ClaimTypeReferenceId="password" Required="true" />
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
              </ValidationTechnicalProfiles>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
            </TechnicalProfile>
            <!-- This technical profile forces the user to verify the email address that they provide on the UI. Only after email is verified, the user account is
            read from the directory. -->
            <TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddress">
              <DisplayName>Reset password using email address</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
                <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <IncludeInSso>false</IncludeInSso>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
                <OutputClaim ClaimTypeReferenceId="objectId" />
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                <OutputClaim ClaimTypeReferenceId="authenticationSource" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />
              </ValidationTechnicalProfiles>
            </TechnicalProfile>
            <TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
              <DisplayName>Change password (username)</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
              </Metadata>
              <CryptographicKeys>
                <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
              </CryptographicKeys>
              <InputClaims>
                <InputClaim ClaimTypeReferenceId="objectId" />
              </InputClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
                <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
              </OutputClaims>
              <ValidationTechnicalProfiles>
                <ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" />
              </ValidationTechnicalProfiles>
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Session Management</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="SM-Noop">
              <DisplayName>Noop Session Management Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.NoopSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
            </TechnicalProfile>
            <TechnicalProfile Id="SM-AAD">
              <DisplayName>Session Mananagement Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <PersistedClaims>
                <PersistedClaim ClaimTypeReferenceId="objectId" />
                <PersistedClaim ClaimTypeReferenceId="signInName" />
                <PersistedClaim ClaimTypeReferenceId="authenticationSource" />
                <PersistedClaim ClaimTypeReferenceId="identityProvider" />
                <PersistedClaim ClaimTypeReferenceId="newUser" />
                <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" />
              </PersistedClaims>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true" />
              </OutputClaims>
            </TechnicalProfile>
            <!-- Session management technical profile for OIDC based tokens -->
            <TechnicalProfile Id="SM-jwt-issuer">
              <DisplayName>Session Management Provider</DisplayName>
              <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
              <Metadata>
                <Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata</Item>
              </Metadata>
              <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
                <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
              </OutputClaims>
              <SubjectNamingInfo ClaimType="upn" ExcludeAsClaim="true" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Trustframework Policy Engine TechnicalProfiles</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="TpEngine_c3bd4fe2-1775-4013-b91d-35f16d377d13">
              <DisplayName>Trustframework Policy Engine Default Technical Profile</DisplayName>
              <Protocol Name="None" />
              <Metadata>
                <Item Key="url">{service:te}</Item>
              </Metadata>
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
        <ClaimsProvider>
          <DisplayName>Token Issuer</DisplayName>
          <TechnicalProfiles>
            <TechnicalProfile Id="JwtIssuer">
              <DisplayName>JWT Issuer</DisplayName>
              <Protocol Name="OpenIdConnect" />
              <!--Protocol Name="SAML2" /-->
              <OutputTokenFormat>JWT</OutputTokenFormat>
              <Metadata>
                <!--Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata</Item-->
                <Item Key="client_id">{service:te}</Item>
                <Item Key="issuer_refresh_token_user_identity_claim_type">objectId</Item>
                <Item Key="SendTokenResponseBodyWithJsonNumbers">true</Item>
              </Metadata>
              <CryptographicKeys>
                <!--Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
                <Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" /-->
                <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
                <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
                <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
              </CryptographicKeys>
              <UseTechnicalProfileForSessionManagement ReferenceId="SM-jwt-issuer" />
            </TechnicalProfile>
          </TechnicalProfiles>
        </ClaimsProvider>
      </ClaimsProviders>
      <UserJourneys>
        <UserJourney Id="SignUpOrSignIn1">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
              <ClaimsProviderSelections>
                <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
              </ClaimsProviderSelections>
              <ClaimsExchanges>
                <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <Preconditions>
                <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                  <Value>objectId</Value>
                  <Action>SkipThisOrchestrationStep</Action>
                </Precondition>
              </Preconditions>
              <ClaimsExchanges>
                <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <!-- This step reads any user attributes that we may not have received when in the token. -->
            <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
          </OrchestrationSteps>
          <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>
        <UserJourney Id="ProfileEdit">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
              <ClaimsProviderSelections>
                <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
              </ClaimsProviderSelections>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="B2CUserProfileUpdateExchange" TechnicalProfileReferenceId="SelfAsserted-ProfileUpdate" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
          </OrchestrationSteps>
          <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>
        <UserJourney Id="PasswordReset">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
          </OrchestrationSteps>
          <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>
      </UserJourneys>
    </TrustFrameworkPolicy>

Edit TrustFrameworkLocalization.xml

StepsClosed

The edits for this file should have been completed with the Global edits, above.  Edit the file ending with TrustFrameworkLocalization.xml and ensure the highlighted values are consistent with the values you recorded on your worksheet.

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkLocalization" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkLocalization" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">

Your file will look similar to this:

Copy

TrustFrameworkLocalization.xml

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkLocalization" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkLocalization" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1"> 
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkBase</PolicyId>
  </BasePolicy>
  <BuildingBlocks>
    <ContentDefinitions>
      <ContentDefinition Id="api.signuporsignin">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.signuporsignin.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
      <ContentDefinition Id="api.localaccountsignup">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.localaccountsignup.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
      <ContentDefinition Id="api.selfasserted">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.selfasserted.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
      <ContentDefinition Id="api.localaccountpasswordreset">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.localaccountpasswordreset.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
      <ContentDefinition Id="api.idpselections">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.idpselections.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
      <ContentDefinition Id="api.localaccountsignin">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.localaccountsignin.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
      <ContentDefinition Id="api.selfasserted.profileupdate">
        <LocalizedResourcesReferences MergeBehavior="Prepend">
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.selfasserted.profileupdate.en" />
          <!-- Add more languages here -->
        </LocalizedResourcesReferences>
      </ContentDefinition>
    </ContentDefinitions>
    <Localization Enabled="true">
      <SupportedLanguages DefaultLanguage="en" MergeBehavior="Append">
        <SupportedLanguage>en</SupportedLanguage>
      </SupportedLanguages>
      <LocalizedResources Id="api.signuporsignin.en">
        <LocalizedStrings>
          <LocalizedString ElementType="ClaimType" ElementId="signInName" StringId="DisplayName">Email Address</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="heading">Sign in</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="local_intro_generic">Sign in with your {0}</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="password" StringId="DisplayName">Password</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="requiredField_password">Please enter your password</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="requiredField_generic">Please enter your {0}</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="invalid_generic">Please enter a valid {0}</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="createaccount_one_link">Sign up now</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="createaccount_two_links">Sign up with {0} or {1}</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="createaccount_three_links">Sign up with {0}, {1}, or {2}</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="forgotpassword_link">Forgot your password?</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_signin">Sign in</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="createaccount_intro">Don't have an account?</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="unknown_error">We are having trouble signing you in. Please try again later.</LocalizedString>
          <!-- Uncomment the remember_me only if the keep me signed in is activated. 
          <LocalizedString ElementType="UxElement" StringId="remember_me">Keep me signed in</LocalizedString> -->
          <LocalizedString ElementType="ClaimsProvider" StringId="FacebookExchange">Facebook</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="ResourceOwnerFlowInvalidCredentials">Your password is incorrect.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfInvalidPassword">Your password is incorrect.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfPasswordExpired">Your password has expired.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsPrincipalDoesNotExist">We can't seem to find your account.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfOldPasswordUsed">Looks like you used an old password.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="DefaultMessage">Invalid username or password.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfUserAccountDisabled">Your account has been locked. Contact your support person to unlock it, then try again.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfUserAccountLocked">Your account is temporarily locked to prevent unauthorized use. Try again later.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="AADRequestsThrottled">There are too many requests at this moment. Please wait for some time and try again.</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!--Local account sign-up page English-->
      <LocalizedResources Id="api.localaccountsignup.en">
        <LocalizedStrings>
          <LocalizedString ElementType="ClaimType" ElementId="email" StringId="DisplayName">Email Address</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="email" StringId="UserHelpText">Email address that can be used to contact you.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="email" StringId="PatternHelpText">Please enter a valid email address.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="newPassword" StringId="DisplayName">New Password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="newPassword" StringId="UserHelpText">Enter new password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="newPassword" StringId="PatternHelpText">8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ " ( ) ; .</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="reenterPassword" StringId="DisplayName">Confirm New Password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="reenterPassword" StringId="UserHelpText">Confirm new password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="reenterPassword" StringId="PatternHelpText">8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ " ( ) ; .</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="displayName" StringId="DisplayName">Display Name</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="displayName" StringId="UserHelpText">Your display name.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="surname" StringId="DisplayName">Surname</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="surname" StringId="UserHelpText">Your surname (also known as family name or last name).</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="givenName" StringId="DisplayName">Given Name</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="givenName" StringId="UserHelpText">Your given name (also known as first name).</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_continue">Create</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="error_fieldIncorrect">One or more fields are filled out incorrectly. Please check your entries and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="error_passwordEntryMismatch">The password entry fields do not match. Please enter the same password in both fields and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="error_requiredFieldMissing">A required field is missing. Please fill out all required fields and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="helplink_text">What is this?</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="initial_intro">Please provide the following details.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="preloader_alt">Please wait</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="required_field">This information is required.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_cancel">Cancel</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_edit">Change e-mail</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_resend">Send new code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_send">Send verification code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_verify">Verify code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_code_expired">That code is expired. Please request a new code.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_no_retry">You've made too many incorrect attempts. Please try again later.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_retry">That code is incorrect. Please try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_server">We are having trouble verifying your email address. Please enter a valid email address and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_throttled">There have been too many requests to verify this email address. Please wait a while, then try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_info_msg">Verification code has been sent to your inbox. Please copy it to the input box below.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_input">Verification code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_intro_msg">Verification is necessary. Please click Send button.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_success_msg">E-mail address verified. You can now continue.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="ServiceThrottled">There are too many requests at this moment. Please wait for some time and try again.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimNotVerified">Claim not verified: {0}</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsPrincipalAlreadyExists">A user with the specified ID already exists. Please choose a different one.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfIncorrectPattern">Incorrect pattern for: {0}</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfInvalidInput">{0} has invalid input.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfMissingRequiredElement">Missing required element: {0}</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfValidationError">Error in validation by: {0}</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!-- Self-asserted page English-->
      <LocalizedResources Id="api.selfasserted.en">
        <LocalizedStrings>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsPrincipalAlreadyExists">You are already registered, please press the back button and sign in instead.</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!-- Password reset page English-->
      <LocalizedResources Id="api.localaccountpasswordreset.en">
        <LocalizedStrings>
          <LocalizedString ElementType="ClaimType" ElementId="email" StringId="DisplayName">Email Address</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="email" StringId="UserHelpText">Email address that can be used to contact you.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="email" StringId="PatternHelpText">Please enter a valid email address.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="newPassword" StringId="DisplayName">New Password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="newPassword" StringId="UserHelpText">Enter new password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="newPassword" StringId="PatternHelpText">8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ " ( ) ; .</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="reenterPassword" StringId="DisplayName">Confirm New Password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="reenterPassword" StringId="UserHelpText">Confirm new password</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="reenterPassword" StringId="PatternHelpText">8-16 characters, containing 3 out of 4 of the following: Lowercase characters, uppercase characters, digits (0-9), and one or more of the following symbols: @ # $ % ^ &amp; * - _ + = [ ] { } | \ : ' , ? / ` ~ " ( ) ; .</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="error_passwordEntryMismatch">The password entry fields do not match. Please enter the same password in both fields and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="error_fieldIncorrect">One or more fields are filled out incorrectly. Please check your entries and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_continue">Continue</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_cancel">Cancel</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsPrincipalDoesNotExist">An account could not be found for the provided user ID.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">Your account has been locked. Contact your support person to unlock it, then try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="required_field">This information is required.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_edit">Change e-mail</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_resend">Send new code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_send">Send verification code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_but_verify">Verify code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_code_expired">That code is expired. Please request a new code.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_no_retry">You've made too many incorrect attempts. Please try again later.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_retry">That code is incorrect. Please try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_server">We are having trouble verifying your email address. Please enter a valid email address and try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_fail_throttled">There have been too many requests to verify this email address. Please wait a while, then try again.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_info_msg">Verification code has been sent to your inbox. Please copy it to the input box below.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_input">Verification code</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_intro_msg">Verification is necessary. Please click Send button.</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="ver_success_msg">E-mail address verified. You can now continue.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="ServiceThrottled">There are too many requests at this moment. Please wait for some time and try again.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimNotVerified">Claim not verified: {0}</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsPrincipalAlreadyExists">A user with the specified ID already exists. Please choose a different one.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfIncorrectPattern">Incorrect pattern for: {0}</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfInvalidInput">{0} has invalid input.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfMissingRequiredElement">Missing required element: {0}</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfValidationError">Error in validation by: {0}</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!-- Edit profile sign-in page English-->
      <LocalizedResources Id="api.idpselections.en">
        <LocalizedStrings>
          <LocalizedString ElementType="UxElement" StringId="intro">Sign in</LocalizedString>
          <LocalizedString ElementType="ClaimsProvider" StringId="LocalAccountSigninEmailExchange">Local Account Signin</LocalizedString>
          <LocalizedString ElementType="ClaimsProvider" StringId="FacebookExchange">Facebook</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!-- Edit profile sign-in with local account English-->
      <LocalizedResources Id="api.localaccountsignin.en">
        <LocalizedStrings>
          <LocalizedString ElementType="ClaimType" ElementId="signInName" StringId="DisplayName">Email Address</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="password" StringId="DisplayName">Password</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_continue">Continue</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_cancel">Cancel</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="ResourceOwnerFlowInvalidCredentials">Your password is incorrect.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfInvalidPassword">Your password is incorrect.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfPasswordExpired">Your password has expired.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfClaimsPrincipalDoesNotExist">We can't seem to find your account.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfOldPasswordUsed">Looks like you used an old password.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="DefaultMessage">Invalid username or password.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfUserAccountDisabled">Your account has been locked. Contact your support person to unlock it, then try again.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="UserMessageIfUserAccountLocked">Your account is temporarily locked to prevent unauthorized use. Try again later.</LocalizedString>
          <LocalizedString ElementType="ErrorMessage" StringId="AADRequestsThrottled">There are too many requests at this moment. Please wait for some time and try again.</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!-- Edit profile page English-->
      <LocalizedResources Id="api.selfasserted.profileupdate.en">
        <LocalizedStrings>
          <LocalizedString ElementType="ClaimType" ElementId="displayName" StringId="DisplayName">Display Name</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="displayName" StringId="UserHelpText">Your display name.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="surname" StringId="DisplayName">Surname</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="surname" StringId="UserHelpText">Your surname (also known as family name or last name).</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="givenName" StringId="DisplayName">Given Name</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="givenName" StringId="UserHelpText">Your given name (also known as first name).</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_continue">Continue</LocalizedString>
          <LocalizedString ElementType="UxElement" StringId="button_cancel">Cancel</LocalizedString>
        </LocalizedStrings>
      </LocalizedResources>
      <!-- Add more languages here -->
    </Localization>
  </BuildingBlocks>
</TrustFrameworkPolicy>

Edit TrustFrameworkExtensions.xml

StepsClosed

  1. Some of the edits for this file were completed with the Global edits you made above. Edit the file ending with TrustFrameworkExtensions.xml and ensure the highlighted values were made.

    <TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkExtensions" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1>

  2. Make the following additional edits, referring to the values you copied to your worksheet.

    • Replace the values below with the Application (client) ID you saved for the ProxyIdentityExperienceFramework app.

      <Item Key="client_id">0c54849b-121f-496e-b1c3-406976bec48b</Item>

      <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="0c54849b-121f-496e-b1c3-406976bec48b" />

    • Replace the values below with the Application (client) ID you saved for the IdentityExperienceFramework app.

      <Item Key="IdTokenAudience">01590824-a092-4271-99a3-f3e37b9f22cc</Item>

      <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="01590824-a092-4271-99a3-f3e37b9f22cc" />

    • Replace the value for ClientId with the Application (client) ID you saved for the b2c-extensions-app.

      <Item Key="ClientId">0c0abe38-79ab-45d3-99fe-9378eec7b16f</Item>

    • Replace the value for ApplicationObjectId with the Object ID you saved for the b2c-extensions-app.

      <Item Key="ApplicationObjectId">3c34826e-3bd5-47a2-b44d-08c09034cef2</Item>

If you are configuring standard authentication, your file will look similar to this:

Copy

TrustFrameworkExtensions.xml

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkExtensions" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkLocalization</PolicyId>
  </BasePolicy>
  <BuildingBlocks></BuildingBlocks>
  <ClaimsProviders>
    <ClaimsProvider>
      <DisplayName>Local Account SignIn</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="login-NonInteractive">
          <Metadata>
            <Item Key="client_id">01590824-a092-4271-99a3-f3e37b9f22cc</Item>
            <Item Key="IdTokenAudience">0c54849b-121f-496e-b1c3-406976bec48b</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="01590824-a092-4271-99a3-f3e37b9f22cc" />
            <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="0c54849b-121f-496e-b1c3-406976bec48b" />
          </InputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Azure Active Directory</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AAD-Common">
          <Metadata>
            <!--Insert b2c-extensions-app application ID here, for example: 11111111-1111-1111-1111-111111111111-->
            <Item Key="ClientId">0c0abe38-79ab-45d3-99fe-9378eec7b16f</Item>
            <!--Insert b2c-extensions-app application ObjectId here, for example: 22222222-2222-2222-2222-222222222222-->
            <Item Key="ApplicationObjectId">3c34826e-3bd5-47a2-b44d-08c09034cef2</Item>
          </Metadata>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>
  <!--UserJourneys>

    </UserJourneys-->
</TrustFrameworkPolicy>

If you are configuring Azure native multi-factor authentication, your file will look similar to this:

Copy
TrustFrameworkExtensions.xml (MFA)
<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkExtensions" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkLocalization</PolicyId>
  </BasePolicy>
  <!--BuildingBlocks></BuildingBlocks-->
  <BuildingBlocks>
    <ClaimsSchema>
      <!--TOTP claims-->
      <ClaimType Id="emails">
        <DisplayName>Email Addresses</DisplayName>
        <DataType>stringCollection</DataType>
        <AdminHelpText>Email addresses of the user.</AdminHelpText>
        <UserHelpText>Your email addresses.</UserHelpText>
      </ClaimType>
      <ClaimType Id="ReadOnlyEmail">
        <DisplayName>ReadOnlyEmail</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Add help text here</UserHelpText>
        <UserInputType>Readonly</UserInputType>
      </ClaimType>
      <ClaimType Id="totpIdentifier">
        <DisplayName>UserId, Phone number or Email which can present the user's identity</DisplayName>
        <DataType>string</DataType>
        <AdminHelpText>UserId, Phone number or Email which can be used to create QR code identity.</AdminHelpText>
        <UserInputType>Paragraph</UserInputType>
      </ClaimType>
      <ClaimType Id="numberOfAvailableDevices">
        <DisplayName>Number of available devices:</DisplayName>
        <DataType>string</DataType>
        <UserInputType>Paragraph</UserInputType>
      </ClaimType>
      <ClaimType Id="QrCodeScanInstruction">
        <DisplayName>Once you've downloaded the Authenticator app, you can use any of the methods below to continue with enrollment.</DisplayName>
        <DataType>string</DataType>
        <UserInputType>Paragraph</UserInputType>
      </ClaimType>
      <ClaimType Id="QrCodeVerifyInstruction">
        <DisplayName>Enter the verification code from your authenticator app​.</DisplayName>
        <DataType>string</DataType>
        <UserInputType>Paragraph</UserInputType>
      </ClaimType>
      <ClaimType Id="qrCodeContent">
        <DisplayName>QR Code Text</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>QR code text</UserHelpText>
        <UserInputType>Paragraph</UserInputType>
      </ClaimType>
      <ClaimType Id="secretKey">
        <DisplayName>If you cant't scan the image, enter the Secret Key:</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>QR code secret</UserHelpText>
        <UserInputType>Paragraph</UserInputType>
      </ClaimType>
      <ClaimType Id="otpCode">
        <DisplayName>Enter your code</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Enter the 6-digit verification code generated by the the Authenticator app in the box</UserHelpText>
        <UserInputType>TextBox</UserInputType>
        <Restriction>
          <Pattern RegularExpression="^[0-9]{6}$" HelpText="Enter the 6-digit verification code generated by the the Authenticator app in the box" />
        </Restriction>
      </ClaimType>
      <ClaimType Id="uriLabel">
        <DisplayName>Uri Label</DisplayName>
        <DataType>string</DataType>
      </ClaimType>
      <ClaimType Id="issuer">
        <DisplayName>Issuer</DisplayName>
        <DataType>string</DataType>
      </ClaimType>
      <ClaimType Id="UserId">
        <DisplayName>Username</DisplayName>
        <DataType>string</DataType>
        <AdminHelpText />
        <UserHelpText>Your username.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
        <Restriction>
          <Pattern RegularExpression="^[a-zA-Z0-9]+[a-zA-Z0-9_-]*$" HelpText="The username you have provided is not valid. It must begin with an alphabetical character or number, and can only contain alphanumeric characters and the following symbols: _ -" />
        </Restriction>
      </ClaimType>
      <!--End of TOTP Claims-->
    </ClaimsSchema>
    <ClaimsTransformations>
      <!--TOTP Claim Transforms-->
      <ClaimsTransformation Id="GetEmailFromReadOnlyEmail" TransformationMethod="CopyClaim">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="ReadOnlyEmail" TransformationClaimType="inputClaim" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="email" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <ClaimsTransformation Id="GetEmailFromEmails" TransformationMethod="GetSingleItemFromStringCollection">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="emails" TransformationClaimType="collection" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="ReadOnlyEmail" TransformationClaimType="extractedItem" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Create a TOPT secret key-->
      <ClaimsTransformation Id="CreateSecret" TransformationMethod="CreateOtpSecret">
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="secretKey" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Create the TOTP issuer name. The issuer name is your tenant name, such as "Contoso demo" -->
      <ClaimsTransformation Id="CreateIssuer" TransformationMethod="CreateStringClaim">
        <InputParameters>
          <InputParameter Id="value" DataType="string" Value="{AuthenticatorIssuer}" />
        </InputParameters>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="issuer" TransformationClaimType="createdClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Create the TOTP URI label. The label is a combination of the totpIdentifier and the issuer name:
           For example, Contoso demo:emily@fabrikam.com-->
      <ClaimsTransformation Id="CreateUriLabel" TransformationMethod="FormatStringMultipleClaims">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="issuer" TransformationClaimType="inputClaim1" />
          <InputClaim ClaimTypeReferenceId="totpIdentifier" TransformationClaimType="inputClaim2" />
        </InputClaims>
        <InputParameters>
          <InputParameter Id="stringFormat" DataType="string" Value="{0}:{1}" />
        </InputParameters>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="uriLabel" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Create the TOTP URI. The label is a combination of the CreateUriLabel and the secret key:
      For example, otpauth://totp/Contoso%20demo:emily@fabrikam.com?secret=fay2lj7ynpntjgqa&issuer=Contoso+demo
      This URI is later converted into a QR code that is presented to the user-->
      <ClaimsTransformation Id="CreateUriString" TransformationMethod="BuildUri">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="uriLabel" TransformationClaimType="path" />
          <InputClaim ClaimTypeReferenceId="secretKey" TransformationClaimType="query.secret" />
        </InputClaims>
        <InputParameters>
          <InputParameter Id="scheme" DataType="string" Value="otpauth" />
          <InputParameter Id="host" DataType="string" Value="totp" />
          <InputParameter Id="query.issuer" DataType="string" Value="{AuthenticatorIssuer}" />
        </InputParameters>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="qrCodeContent" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Copy the signInName to the totpIdentifier -->
      <ClaimsTransformation Id="SignInNameToTotpIdentifier" TransformationMethod="CopyClaim">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="signInName" TransformationClaimType="inputClaim" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="totpIdentifier" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Copy the email to the totpIdentifier -->
      <ClaimsTransformation Id="EmailToTotpIdentifier" TransformationMethod="CopyClaim">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="email" TransformationClaimType="inputClaim" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="totpIdentifier" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!-- Copy the UserId to the totpIdentifier -->
      <ClaimsTransformation Id="UserIdToLogonIdentifier" TransformationMethod="CopyClaim">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="UserId" TransformationClaimType="inputClaim" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="totpIdentifier" TransformationClaimType="outputClaim" />
        </OutputClaims>
      </ClaimsTransformation>
      <!--Claim if Phone SignIn is used-->
      <!--<ClaimsTransformation Id="PhoneNumberIdToLogonIdentifier" TransformationMethod="CopyClaim">
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="phoneNumber" TransformationClaimType="inputClaim" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="totpIdentifier" TransformationClaimType="outputClaim" />
      </OutputClaims>
    </ClaimsTransformation>-->
      <!-- end of TOTP Claims Transforms-->
    </ClaimsTransformations>
    <ContentDefinitions>
      <ContentDefinition Id="api.selfasserted.totp">
        <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
        <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
        <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.9</DataUri>
        <Metadata>
          <Item Key="DisplayName">Collect information from user page</Item>
        </Metadata>
        <LocalizedResourcesReferences>
          <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.selfasserted.totp.en" />
        </LocalizedResourcesReferences>
      </ContentDefinition>
    </ContentDefinitions>
    <Localization>
      <!-- TOTP localized strings (English) -->
      <LocalizedResources Id="api.selfasserted.totp.en">
        <LocalizedStrings>
          <LocalizedString ElementType="DisplayControl" ElementId="authenticatorAppIconControl" StringId="title_text">Download the Microsoft Authenticator using the download links for iOS and Android or use any other authenticator app of your choice.</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="authenticatorAppIconControl" StringId="instruction_text">Once you've downloaded the Authenticator app, you can use any of the methods below to continue with enrollment.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="QrCodeScanInstruction" StringId="DisplayName">Once you've downloaded the Authenticator app, you can use any of the methods below to continue with enrollment.</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="totpQrCodeControl" StringId="title_text">Scan the QR code</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="totpQrCodeControl" StringId="info_msg">You can download the Microsoft Authenticator app or use any other authenticator app of your choice.</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="totpQrCodeControl" StringId="link_text">Can't scan? Try this</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="authenticatorInfoControl" StringId="title_text">Enter the account details manually</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="authenticatorInfoControl" StringId="account_name">Account Name:</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="authenticatorInfoControl" StringId="display_prefix">Secret</LocalizedString>
          <LocalizedString ElementType="DisplayControl" ElementId="authenticatorInfoControl" StringId="collapse_text">Still having trouble?</LocalizedString>
          <!-- Verification -->
          <LocalizedString ElementType="ClaimType" ElementId="QrCodeVerifyInstruction" StringId="DisplayName">Enter the verification code from your authenticator app​.</LocalizedString>
          <LocalizedString ElementType="ClaimType" ElementId="otpCode" StringId="DisplayName">Enter your code.</LocalizedString>
          <!-- <LocalizedString ElementType="UxElement" StringId="button_continue">Verify</LocalizedString> -->
        </LocalizedStrings>
      </LocalizedResources>
    </Localization>
    <DisplayControls>
      <!-- Render the authenticator apps icon. -->
      <DisplayControl Id="authenticatorAppIconControl" UserInterfaceControlType="AuthenticatorAppIconControl" />
      <!-- Render the QR code. It takes the URI (qrCodeContent) input claim and renders it as a QR code-->
      <DisplayControl Id="totpQrCodeControl" UserInterfaceControlType="QrCodeControl">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="qrCodeContent" />
        </InputClaims>
        <DisplayClaims>
          <DisplayClaim ClaimTypeReferenceId="qrCodeContent" ControlClaimType="QrCodeContent" />
        </DisplayClaims>
      </DisplayControl>
      <!-- Render the TOTP information. It takes the totpIdentifier and the secretKey input claims and renders as a plan text-->
      <DisplayControl Id="authenticatorInfoControl" UserInterfaceControlType="AuthenticatorInfoControl">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="totpIdentifier" />
          <InputClaim ClaimTypeReferenceId="secretKey" />
        </InputClaims>
        <DisplayClaims>
          <DisplayClaim ClaimTypeReferenceId="totpIdentifier" />
          <DisplayClaim ClaimTypeReferenceId="secretKey" />
        </DisplayClaims>
      </DisplayControl>
    </DisplayControls>
    <!--End of TOTP contols-->
  </BuildingBlocks>
  <ClaimsProviders>
    <!--Start TOTP-->
    <ClaimsProvider>
      <DisplayName>TOTP</DisplayName>
      <TechnicalProfiles>
        <!-- Begin the TOTP verification process. 
             This technical profile is called right before the AzureMfa-VerifyOTP technical profile-->
        <TechnicalProfile Id="AzureMfa-BeginVerifyOTP">
          <DisplayName>Create Device</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureMfaProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="Operation">BeginVerifyOTP</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="secretKey" />
            <InputClaim ClaimTypeReferenceId="objectId" />
            <InputClaim ClaimTypeReferenceId="userPrincipalName" />
          </InputClaims>
        </TechnicalProfile>
        <!-- Verify the TOTP verification process. 
             This technical profile is called immediately after the AzureMfa-BeginVerifyOTP technical profile-->
        <TechnicalProfile Id="AzureMfa-VerifyOTP">
          <DisplayName>Verify OTP</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureMfaProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="Operation">VerifyOTP</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="otpCode" />
          </InputClaims>
        </TechnicalProfile>
        <!-- Check the number of devices available for the user. 
             If the number of available devices is zero it indicates the user hasn't enrolled yet -->
        <TechnicalProfile Id="AzureMfa-GetAvailableDevices">
          <DisplayName>Get Available Devices</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureMfaProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="Operation">GetAvailableDevices</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="userPrincipalName" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="numberOfAvailableDevices" />
          </OutputClaims>
        </TechnicalProfile>
        <!-- TOTP session manager-->
        <TechnicalProfile Id="SM-MFA-TOTP">
          <DisplayName>Session Mananagement Provider</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <PersistedClaims>
            <PersistedClaim ClaimTypeReferenceId="totpIdentifier" />
            <PersistedClaim ClaimTypeReferenceId="issuer" />
          </PersistedClaims>
        </TechnicalProfile>
        <!-- Self-asserted technical profile that asks the user to enroll to the TOTP MFA. The technical profile:
              1) Creates the TOTP secret
              2) Sets the issuer name and the URI
              3) Renders the QR code and the authentication URI
             -->
        <TechnicalProfile Id="EnableOTPAuthentication">
          <DisplayName>Sign up with Authenticator app</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted.totp</Item>
            <Item Key="language.button_continue">Continue</Item>
          </Metadata>
          <CryptographicKeys>
            <!--Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /-->
            <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
            <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
            <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
          </CryptographicKeys>
          <InputClaimsTransformations>
            <InputClaimsTransformation ReferenceId="CreateSecret" />
            <InputClaimsTransformation ReferenceId="CreateIssuer" />
            <InputClaimsTransformation ReferenceId="CreateUriLabel" />
            <InputClaimsTransformation ReferenceId="CreateUriString" />
          </InputClaimsTransformations>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="qrCodeContent" />
            <InputClaim ClaimTypeReferenceId="secretKey" />
          </InputClaims>
          <DisplayClaims>
            <DisplayClaim DisplayControlReferenceId="authenticatorAppIconControl" />
            <DisplayClaim ClaimTypeReferenceId="QrCodeScanInstruction" />
            <DisplayClaim DisplayControlReferenceId="totpQrCodeControl" />
            <DisplayClaim DisplayControlReferenceId="authenticatorInfoControl" />
          </DisplayClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="secretKey" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-MFA-TOTP" />
        </TechnicalProfile>
        <!-- Self-asserted technical profile that verifies the TOTP-->
        <TechnicalProfile Id="OTPVerification">
          <DisplayName>Sign in with Authenticator app</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted.totp</Item>
            <Item Key="language.button_continue">Verify</Item>
          </Metadata>
          <CryptographicKeys>
            <!--Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /-->
            <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
            <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
            <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
          </CryptographicKeys>
          <InputClaims></InputClaims>
          <DisplayClaims>
            <DisplayClaim ClaimTypeReferenceId="QrCodeVerifyInstruction" />
            <DisplayClaim ClaimTypeReferenceId="otpCode" Required="true" />
          </DisplayClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="otpCode" Required="true" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="AzureMfa-BeginVerifyOTP" />
            <ValidationTechnicalProfile ReferenceId="AzureMfa-VerifyOTP" />
          </ValidationTechnicalProfiles>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-MFA-TOTP" />
        </TechnicalProfile>
        <!-- Set the number of devices to 0 (default value) -->
        <TechnicalProfile Id="SetTotpDefaultValue">
          <DisplayName>Set Totp Default Values</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="numberOfAvailableDevices" DefaultValue="0" />
          </OutputClaims>
        </TechnicalProfile>
        <!-- Copy the UserId to the totpIdentifier -->
        <TechnicalProfile Id="CreateTotpIdentifier-UserId">
          <DisplayName>Set Totp Default Values</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="totpIdentifier" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="UserIdToLogonIdentifier" />
          </OutputClaimsTransformations>
        </TechnicalProfile>
        <!-- Copy the SignInName to the totpIdentifier -->
        <TechnicalProfile Id="CreateTotpIdentifier-SignInName">
          <DisplayName>Set Totp Default Values</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="totpIdentifier" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="SignInNameToTotpIdentifier" />
          </OutputClaimsTransformations>
        </TechnicalProfile>
        <!-- Copy the Email to the totpIdentifier -->
        <TechnicalProfile Id="CreateTotpIdentifier-Email">
          <DisplayName>Set Totp Default Values</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="totpIdentifier" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="EmailToTotpIdentifier" />
          </OutputClaimsTransformations>
        </TechnicalProfile>
        <TechnicalProfile Id="GetEmailFromReadOnlyEmail">
          <DisplayName>Get Email From ReadOnlyEmail</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="GetEmailFromReadOnlyEmail" />
          </OutputClaimsTransformations>
        </TechnicalProfile>
        <TechnicalProfile Id="GetEmailAddress">
          <DisplayName>Get Email Address</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="ReadOnlyEmail" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="GetEmailFromEmails" />
          </OutputClaimsTransformations>
        </TechnicalProfile>
        <!--end of TOTP-->
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Azure Active Directory</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AAD-UserReadUsingObjectId">
          <OutputClaims>
            <!-- The userPrincipalName is required for the AzureMfaProtocolProvider technical profiles-->
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
          </OutputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Local Account</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
          <OutputClaims>
            <!-- The userPrincipalName is required for the AzureMfaProtocolProvider technical profiles-->
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
          </OutputClaims>
        </TechnicalProfile>
        <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
          <OutputClaims>
            <!-- The userPrincipalName is required for the AzureMfaProtocolProvider technical profiles-->
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
          </OutputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Local Account SignIn</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="login-NonInteractive">
          <Metadata>
            <Item Key="client_id">0c54849b-121f-496e-b1c3-406976bec48b</Item>
            <Item Key="IdTokenAudience">01590824-a092-4271-99a3-f3e37b9f22cc</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="0c54849b-121f-496e-b1c3-406976bec48b" />
            <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="01590824-a092-4271-99a3-f3e37b9f22cc" />
          </InputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Azure Active Directory</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AAD-Common">
          <Metadata>
            <!--Insert b2c-extensions-app application ID here, for example: 11111111-1111-1111-1111-111111111111-->
            <Item Key="ClientId">0c0abe38-79ab-45d3-99fe-9378eec7b16f</Item>
            <!--Insert b2c-extensions-app application ObjectId here, for example: 22222222-2222-2222-2222-222222222222-->
            <Item Key="ApplicationObjectId">3c34826e-3bd5-47a2-b44d-08c09034cef2</Item>
          </Metadata>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>
  <UserJourneys>
    <UserJourney Id="PasswordResetWithTOTP">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey will not ask the user to enroll -->
        <OrchestrationStep Order="2" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Input" />
          </JourneyList>
        </OrchestrationStep>
        <!-- Call the TOTP validation sub journey-->
        <OrchestrationStep Order="3" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Verify" />
          </JourneyList>
        </OrchestrationStep>
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
        <!--OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer" /-->
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
    <UserJourney Id="SignUpOrSignInTOTP">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Call the TOTP enrollment ub journey. If user already enrolled the sub journey will not ask the user to enroll -->
        <OrchestrationStep Order="4" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Input" />
          </JourneyList>
        </OrchestrationStep>
        <!-- Call the TOTP validation sub journey-->
        <OrchestrationStep Order="5" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="TotpFactor-Verify" />
          </JourneyList>
        </OrchestrationStep>
        <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
    </UserJourney>
  </UserJourneys>
  <SubJourneys>
    <!--TOTP subjourneys-->
    <!-- Set the required claims numberOfAvailableDevices and totpIdentifier-->
    <SubJourney Id="SetTotpInitialValue" Type="Call">
      <OrchestrationSteps>
        <!-- If number of available device claim not exists, set the value to 0-->
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>numberOfAvailableDevices</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpDefaultValue" TechnicalProfileReferenceId="SetTotpDefaultValue" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- The following orchestration steps try to get the user identifier for different 
             type of authentication, such as local and social account.-->
        <!-- Try to get the identifier from UserId-->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>UserId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsUserId" TechnicalProfileReferenceId="CreateTotpIdentifier-UserId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Get the identifier from email-->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsEmail" TechnicalProfileReferenceId="CreateTotpIdentifier-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Get the identifier from the user's emails -->
        <OrchestrationStep Order="4" Type="InvokeSubJourney">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>emails</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <JourneyList>
            <Candidate SubJourneyReferenceId="ExtractEmailFromEmailsForTotpIdentifier" />
          </JourneyList>
        </OrchestrationStep>
        <!-- Get the identifier from local account sign-in name-->
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>totpIdentifier</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>signInName</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsSignInName" TechnicalProfileReferenceId="CreateTotpIdentifier-SignInName" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>
    <!-- Get the identifier from the user's emails -->
    <SubJourney Id="ExtractEmailFromEmailsForTotpIdentifier" Type="Call">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>emails</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="GetEmailAddress" TechnicalProfileReferenceId="GetEmailAddress" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>ReadOnlyEmail</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="GetEmailFromReadOnlyEmail" TechnicalProfileReferenceId="GetEmailFromReadOnlyEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsEmail" TechnicalProfileReferenceId="CreateTotpIdentifier-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>signInName</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SetTotpIdentifierAsSignInName" TechnicalProfileReferenceId="CreateTotpIdentifier-SignInName" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>
    <!-- TOTP verification sub journey-->
    <SubJourney Id="TotpFactor-Verify" Type="Call">
      <OrchestrationSteps>
        <!-- Set the required claims numberOfAvailableDevices and totpIdentifier-->
        <OrchestrationStep Order="1" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="SetTotpInitialValue" />
          </JourneyList>
        </OrchestrationStep>
        <!-- If current user is not a new one (this is a sign-in flow, and not sign-up), 
             check the number of available devices. -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>newUser</Value>
              <Value>True</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="CheckAvailableDevices" TechnicalProfileReferenceId="AzureMfa-GetAvailableDevices" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- If the number of available devices isn't zero (user has enrolled before), 
             render the TOTP verification page -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>numberOfAvailableDevices</Value>
              <Value>0</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AuthenticatorForSignIn" TechnicalProfileReferenceId="OTPVerification" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>
    <!-- TOTP enrollment sub journey-->
    <SubJourney Id="TotpFactor-Input" Type="Call">
      <OrchestrationSteps>
        <!-- Set the required claims numberOfAvailableDevices and totpIdentifier-->
        <OrchestrationStep Order="1" Type="InvokeSubJourney">
          <JourneyList>
            <Candidate SubJourneyReferenceId="SetTotpInitialValue" />
          </JourneyList>
        </OrchestrationStep>
        <!-- If current user is not a new one (this is a sign-in flow, and not sign-up), 
             check the number of available devices. -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>newUser</Value>
              <Value>True</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="CheckAvailableDevices" TechnicalProfileReferenceId="AzureMfa-GetAvailableDevices" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- If the number of available devices is zero (user hasn't enrolled before), 
            render the TOTP enrollment page to scan the QR code that starts the enrollment process -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
              <Value>numberOfAvailableDevices</Value>
              <Value>0</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AuthenticatorForSignUp" TechnicalProfileReferenceId="EnableOTPAuthentication" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- If the number of available devices is zero (user hasn't enrolled before), 
             render the TOTP verification page.  -->
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
              <Value>numberOfAvailableDevices</Value>
              <Value>0</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AuthenticatorForSignIn" TechnicalProfileReferenceId="OTPVerification" />
          </ClaimsExchanges>
        </OrchestrationStep>
      </OrchestrationSteps>
    </SubJourney>
  </SubJourneys>
  <!--UserJourneys>
    
    </UserJourneys-->
</TrustFrameworkPolicy>

Edit SignUpOrSignin.xml

StepsClosed

The edits for this file should have been completed with the Global edits you made above. Edit the file ending with SignUpOrSignIn.xml and ensure the highlighted values are consistent with the values you recorded on your worksheet.

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_signup_signin" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1>

and

<TenantId>stellarpmb2c.onmicrosoft.com</TenantId>

Your file will look similar to this:

Copy

SignUpOrSignIn

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_signup_signin" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>
  <RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="givenName" />
        <OutputClaim ClaimTypeReferenceId="surname" />
        <OutputClaim ClaimTypeReferenceId="email" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

Edit ProfileEdit.xml

StepsClosed

The edits for this file should have been completed with the Global edits you made above. Edit the file ending with ProfileEdit.xml and ensure the highlighted values are consistent with the values you recorded on your worksheet.

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_ProfileEdit" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_ProfileEdit" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">

and

<TenantId>stellarpmb2c.onmicrosoft.com</TenantId>

Your file will look similar to this:

Copy

ProfileEdit.xml

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_ProfileEdit" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_ProfileEdit" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>
  <RelyingParty>
    <DefaultUserJourney ReferenceId="ProfileEdit" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

Edit PasswordReset.xml

StepsClosed

The edits for this file should have been completed with the Global edits you made above. Edit the file ending with PasswordReset.xml and ensure the highlighted values are consistent with the values you recorded on your worksheet.

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_PasswordReset" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_PasswordReset" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">

and

<TenantId>stellarpmb2c.onmicrosoft.com</TenantId>

Your file will look similar to this:

Copy

PasswordReset.xml

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_PasswordReset" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_PasswordReset" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>
  <RelyingParty>
    <DefaultUserJourney ReferenceId="PasswordReset" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="email" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

Edit SignUporSigninSAML.xml

StepsClosed

  1. The edits for this file should have been completed with the Global edits you made above. Edit the file ending with SignUpOrSigninSAML.xml and ensure the highlighted values are consistent with the values you recorded on your worksheet.

    <TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_signup_signin_saml" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_saml" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">

    and

    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>

  2. Locate the line containing PartnerEntity, and replace the hostname portion with the URL of your Stellar Cyber DP host.

    <Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata</Item>

  3. If you are configuring Authentication for a specific Stellar Cyber tenant, then additionally modify that line as indicated below, using the Stellar Cyber Tenant ID (not your Azure AD Tenant ID) you noted before you began configuration. The cust_id/tenant ensures that the configuration is applicable to just that specific Stellar Cyber tenant.

    <Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata/cust_id/<Stellar Cyber tenant ID></Item>

    Example:

    You would enter this: <Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata/cust_id/29443942</Item>

If you are configuring standard authentication, your file will look similar to this:

Copy

SignUpOrSignInSAML.xml

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_signup_signin_saml" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_saml" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>
  <UserJourneys>
    <UserJourney Id="SignUpOrSignIn">
      <OrchestrationSteps>
        <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer" />
      </OrchestrationSteps>
    </UserJourney>
  </UserJourneys>
  <RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="SAML2" />
      <Metadata>
    <Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata</Item>
      </Metadata>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="upn" ExcludeAsClaim="true" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

If you are configuring Azure native multi-factor authentication, your file will look similar to this:

Copy
SignUpOrSigninSAML.xml (MFA)
<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="stellarpmb2c.onmicrosoft.com" PolicyId="B2C_1A_signup_signin_saml" PublicPolicyUri="http://stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_saml" TenantObjectId="04fcef19-20fe-4655-9498-3e5050b6dda1">
  <BasePolicy>
    <TenantId>stellarpmb2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>
  <!--UserJourneys>
    <UserJourney Id="SignUpOrSignIn">
      <OrchestrationSteps>
        <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer" />
      </OrchestrationSteps>
    </UserJourney>
  </UserJourneys-->
  <RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignInTOTP" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="SAML2" />
      <Metadata>
        <Item Key="PartnerEntity">https://testdp.stellarcyber.ai/sso/saml/metadata</Item>
      </Metadata>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_privilege" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_scope" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant" />
        <OutputClaim ClaimTypeReferenceId="extension_stellar_tenant_group" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="upn" ExcludeAsClaim="true" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

Upload Custom Policies

StepsClosed

If you stop and return to any of the procedures in this configuration process, ensure that you switch to the correct directory before you continue so that you are working on the correct Azure AD B2C Tenant container.

  1. Access All services from the top-left corner of the Azure portal, and then search for and select Azure AD B2C.

  2. From the Overview page, select Identity Experience Framework.

  3. Click the button for Custom Policies.

  4. Select Upload Custom Policy

  5. Upload each of the policies you modified above. You must upload these in the order shown below. The template files are numbered to help you ensure correct ordering.

    1. TrustFrameworkBase.xml

    2. TrustFrameworkLocalization.xml

    3. TrustFrameworkExtensions.xml

    4. SignUpOrSignin.xml

    5. ProfileEdit.xml

    6. PasswordReset.xml

    7. SignUpOrSigninSAML.xml

  6. After the policy files are uploaded, Azure AD B2C uses the configuration information to generate the metadata URL that Stellar Cyber will use; it contains information such as the sign-in methods and certificates. The Azure AD B2C metadata is available at the following URL, where <tenant-name> is the name of your Azure AD B2C tenant and <policy-name> is the name (ID) of the policy.

    https://<Azure AD B2C tenant-name>.b2clogin.com/<Azure AD B2C tenant-name>.onmicrosoft.com/<policy-name>/samlp/metadata

    Example:

    https://stellarpmb2c.b2clogin.com/stellarpmb2c.onmicrosoft.com/B2C_1A_signup_signin_saml/samlp/metadata

  7. Make note of this Metadata URL in your worksheet for later use configuring in Stellar Cyber.

Proceed to the next step...