Issue with Session Provider in SelfAsserted-ForcePasswordReset-ExpiredPassword

[shmiyaza-MSKK]

Description

I noticed an issue in the sample custom policy located at: force-password-reset

On line 136, the session provider for SelfAsserted-ForcePasswordReset-ExpiredPassword is set to SM-Noop. This means claims like ObjectId are not persisted in the session. When executing the UserJourney with an active session, the following error occurs:

AADB2C90304: User journey went into a bad state. Claims exchange with id 'LocalAccountSigninEmailExchange' could not be found in orchestration step '2'.

Suggested Fix

To resolve this, the session provider should be changed to SM-AAD to ensure claims are persisted.

<UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
 

[hamzaanjum]

This is correct. I was also facing the same issue, and was able to fix by changing it to SM-AAD