title: Azure AD B2C Local Account Password stops working after a few hours
body: <p>I have created custom policies for social and local accounts based on the example from the <a href="https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/SocialAndLocalAccounts" rel="nofollow noreferrer">Active Directory B2C custom policy starter pack for social and local accounts</a>. I have enabled the login with Microsoft and Google and tested that both work, I have also enabled logging in with a local account.  </p>
  
  <p>The problem I am seeing is the local account.  I can create one and the password works fine for a few hours (not sure exactly how long), then starts giving a generic "Invalid username or password." error.  When I type in the wrong password for the same user I get a different message "Your password is incorrect" (this corresponds to a relevant log entry). </p>
  
  <p>I have enabled application insights and can only find the following exceptions.  </p>
  
  <p>Any help on how to clear up these 2 errors would be great. </p>
  
  <p><code>""Statebag"": {
      ""Complex-CLMS"": {},
      ""ValidationRequest"": {
        ""ContentType"": ""Unspecified"",
        ""Created"": ""2017-10-04T19:17:49.2510644Z"",
        ""Key"": ""ValidationRequest"",
        ""Persistent"": true,
        ""Value"": ""client_id=307&amp;resource=cf87&amp;username=user%domain.com&amp;password=fakep@ss!123&amp;grant_type=password&amp;scope=openid&amp;nca=1;1;login-NonInteractive;False""
      },
      ""ValidationResponse"": {
        ""ContentType"": ""Json"",
        ""Created"": ""2017-10-04T19:17:49.2510644Z"",
        ""Key"": ""ValidationResponse"",
        ""Persistent"": true,
        ""Value"": ""{\""error\"":\""invalid_grant\"",\""error_description\"":\""AADSTS65001: The user or administrator has not consented to use the application with ID '307' named 'IdentityExperienceFramework'. Send an interactive authorization request for this user and resource.\\r\\nTrace ID: 7c4\\r\\nCorrelation ID: 3cc\\r\\nTimestamp: 2017-10-04 19:17:49Z\"",\""error_codes\"":[65001],\""timestamp\"":\""2017-10-04 19:17:49Z\"",\""trace_id\"":\""7c4\"",\""correlation_id\"":\""3cc\""};1;login-NonInteractive;False""
      },
      ""ComplexItems"": ""_MachineEventQ, REPRM, TCTX, M_EXCP""
    }
  </code>
  Here is the 2nd exception</p>
  
  <p><code>""Key"": ""Exception"",
              ""Value"": {
                ""Kind"": ""Handled"",
                ""HResult"": ""80131500"",
                ""Message"": ""The technical Profile with id \""AAD-UserWriteUsingLogonEmail\"" in Policy id \""B2C_1A_signup_signin of Tenant id \""xxx.onmicrosoft.com\"" requires that an error be raised if a claims principal record already exists for storing claims. A claims principal of type \""User\"" with identifier claim type id \""signInNames.emailAddress\"" does already exist."",
                ""Data"": {
                  ""IsPolicySpecificError"": true,
                  ""TenantId"": ""xxx.onmicrosoft.com"",
                  ""PolicyId"": ""B2C_1A_signup_signin"",
                  ""TechnicalProfile.Id"": ""AAD-UserWriteUsingLogonEmail"",
                  ""ClaimsPrincipal.IdentifierClaim.ClaimTypeId"": ""signInNames.emailAddress"",
                  ""ClaimsPrincipal.PrincipalType"": ""User"",
                  ""CreateClaimsPrincipalIfItDoesNotExist"": ""True"",
                  ""RaiseErrorIfClaimsPrincipalAlreadyExists"": ""True"",
                  ""RaiseErrorIfClaimsPrincipalDoesNotExist"": ""False""
                }
              }
  </code></p>
  
  <p>Here is the content of the TrustFrameworkExtensions.xml file.  The only difference between it and the example is that I am using 2 providers instead of 1. </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;TrustFrameworkPolicy 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
    xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" 
    PolicySchemaVersion="0.3.0.0" 
    TenantId="xxx.onmicrosoft.com" 
    PolicyId="B2C_1A_TrustFrameworkExtensions" 
    PublicPolicyUri="http://xxx.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions"&gt;
  
    &lt;BasePolicy&gt;
      &lt;TenantId&gt;xxx.onmicrosoft.com&lt;/TenantId&gt;
      &lt;PolicyId&gt;B2C_1A_TrustFrameworkBase&lt;/PolicyId&gt;
    &lt;/BasePolicy&gt;
    &lt;BuildingBlocks&gt;
  
    &lt;/BuildingBlocks&gt;
  
    &lt;ClaimsProviders&gt;
  
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Local Account SignIn&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="login-NonInteractive"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="client_id"&gt;307&lt;/Item&gt;
              &lt;Item Key="IdTokenAudience"&gt;cf8&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="client_id" DefaultValue="307" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="cf8" /&gt;
            &lt;/InputClaims&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
  
      &lt;ClaimsProvider&gt;
          &lt;Domain&gt;Employee SignIn with Azure AD&lt;/Domain&gt;
          &lt;DisplayName&gt;Employee Login&lt;/DisplayName&gt;
          &lt;TechnicalProfiles&gt;
              &lt;TechnicalProfile Id="AzureADProfile"&gt;
                  &lt;DisplayName&gt;Employee Login&lt;/DisplayName&gt;
                  &lt;Description&gt;Login with your GP account&lt;/Description&gt;
                  &lt;Protocol Name="OpenIdConnect"/&gt;
                  &lt;OutputTokenFormat&gt;JWT&lt;/OutputTokenFormat&gt;
                  &lt;Metadata&gt;
                      &lt;Item Key="METADATA"&gt;https://login.windows.net/yyy.onmicrosoft.com/.well-known/openid-configuration&lt;/Item&gt;
                      &lt;Item Key="ProviderName"&gt;https://sts.windows.net/7de/&lt;/Item&gt;
                      &lt;Item Key="client_id"&gt;f19&lt;/Item&gt;
                      &lt;Item Key="IdTokenAudience"&gt;f19&lt;/Item&gt;
                      &lt;Item Key="response_types"&gt;id_token&lt;/Item&gt;
                      &lt;Item Key="UsePolicyInRedirectUri"&gt;false&lt;/Item&gt;
                  &lt;/Metadata&gt;
                  &lt;CryptographicKeys&gt;
                      &lt;Key Id="client_secret" StorageReferenceId="B2C_1A_AzureADAppSecret"/&gt;
                  &lt;/CryptographicKeys&gt;
                  &lt;OutputClaims&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="oid"/&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" /&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" /&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" /&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="contosoAuthentication" /&gt;
                      &lt;OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="AzureADContoso" /&gt;
                  &lt;/OutputClaims&gt;
                  &lt;OutputClaimsTransformations&gt;
                      &lt;OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/&gt;
                      &lt;OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/&gt;
                      &lt;OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/&gt;
                      &lt;OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/&gt;
                  &lt;/OutputClaimsTransformations&gt;
                  &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/&gt;
              &lt;/TechnicalProfile&gt;
          &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
  
      &lt;ClaimsProvider&gt;
        &lt;Domain&gt;google.com&lt;/Domain&gt;
        &lt;DisplayName&gt;Google&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="Google-OAUTH"&gt;
              &lt;DisplayName&gt;Employee Login&lt;/DisplayName&gt;
              &lt;Protocol Name="OAuth2" /&gt;
              &lt;Metadata&gt;
              &lt;Item Key="ProviderName"&gt;google&lt;/Item&gt;
              &lt;Item Key="authorization_endpoint"&gt;https://accounts.google.com/o/oauth2/auth&lt;/Item&gt;
              &lt;Item Key="AccessTokenEndpoint"&gt;https://accounts.google.com/o/oauth2/token&lt;/Item&gt;
              &lt;Item Key="ClaimsEndpoint"&gt;https://www.googleapis.com/oauth2/v1/userinfo&lt;/Item&gt;
              &lt;Item Key="scope"&gt;email&lt;/Item&gt;
              &lt;Item Key="HttpBinding"&gt;POST&lt;/Item&gt;
              &lt;Item Key="UsePolicyInRedirectUri"&gt;0&lt;/Item&gt;
              &lt;Item Key="client_id"&gt;zzz.apps.googleusercontent.com&lt;/Item&gt;
              &lt;/Metadata&gt;
              &lt;CryptographicKeys&gt;
              &lt;Key Id="client_secret" StorageReferenceId="B2C_1A_GoogleSecret" /&gt;
              &lt;/CryptographicKeys&gt;
              &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="id" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="google.com" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" /&gt;
              &lt;/OutputClaims&gt;
              &lt;OutputClaimsTransformations&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" /&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" /&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" /&gt;
              &lt;OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" /&gt;
              &lt;/OutputClaimsTransformations&gt;
              &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" /&gt;
              &lt;ErrorHandlers&gt;
              &lt;ErrorHandler&gt;
                  &lt;ErrorResponseFormat&gt;json&lt;/ErrorResponseFormat&gt;
                  &lt;ResponseMatch&gt;$[?(@@.error == 'invalid_grant')]&lt;/ResponseMatch&gt;
                  &lt;Action&gt;Reauthenticate&lt;/Action&gt;
                  &lt;!--In case of authorization code used error, we don't want the user to select his account again.--&gt;
                  &lt;!--AdditionalRequestParameters Key="prompt"&gt;select_account&lt;/AdditionalRequestParameters--&gt;
              &lt;/ErrorHandler&gt;
              &lt;/ErrorHandlers&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
  
    &lt;/ClaimsProviders&gt;
  
  
  
    &lt;UserJourneys&gt;
        &lt;UserJourney Id="SignUpOrSignInUsingAzureAD"&gt;
        &lt;OrchestrationSteps&gt;
  
          &lt;OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin"&gt;
            &lt;ClaimsProviderSelections&gt;            
              &lt;ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" /&gt;
              &lt;ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" /&gt;
              &lt;ClaimsProviderSelection TargetClaimsExchangeId="AzureADExchange" /&gt;
            &lt;/ClaimsProviderSelections&gt;
            &lt;ClaimsExchanges&gt;
              &lt;ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" /&gt;
            &lt;/ClaimsExchanges&gt;
  
          &lt;/OrchestrationStep&gt;
  
          &lt;!-- Check if the user has selected to sign in using one of the social providers --&gt;
          &lt;OrchestrationStep Order="2" Type="ClaimsExchange"&gt;
            &lt;Preconditions&gt;
              &lt;Precondition Type="ClaimsExist" ExecuteActionsIf="true"&gt;
                &lt;Value&gt;objectId&lt;/Value&gt;
                &lt;Action&gt;SkipThisOrchestrationStep&lt;/Action&gt;
              &lt;/Precondition&gt;
            &lt;/Preconditions&gt;
            &lt;ClaimsExchanges&gt;
              &lt;ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" /&gt;
              &lt;ClaimsExchange Id="AzureADExchange" TechnicalProfileReferenceId="AzureADProfile" /&gt;
              &lt;ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" /&gt;
            &lt;/ClaimsExchanges&gt;
          &lt;/OrchestrationStep&gt;
  
          &lt;!-- For social IDP authentication, attempt to find the user account in the directory. --&gt;
          &lt;OrchestrationStep Order="3" Type="ClaimsExchange"&gt;
            &lt;Preconditions&gt;
              &lt;Precondition Type="ClaimEquals" ExecuteActionsIf="true"&gt;
                &lt;Value&gt;authenticationSource&lt;/Value&gt;
                &lt;Value&gt;localAccountAuthentication&lt;/Value&gt;
                &lt;Action&gt;SkipThisOrchestrationStep&lt;/Action&gt;
              &lt;/Precondition&gt;
            &lt;/Preconditions&gt;
            &lt;ClaimsExchanges&gt;
              &lt;ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" /&gt;
            &lt;/ClaimsExchanges&gt;
          &lt;/OrchestrationStep&gt;
  
          &lt;!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). 
            This can only happen when authentication happened using a social IDP. If local account was created or authentication done
            using ESTS in step 2, then an user account must exist in the directory by this time. --&gt;
          &lt;OrchestrationStep Order="4" Type="ClaimsExchange"&gt;
            &lt;Preconditions&gt;
              &lt;Precondition Type="ClaimsExist" ExecuteActionsIf="true"&gt;
                &lt;Value&gt;objectId&lt;/Value&gt;
                &lt;Action&gt;SkipThisOrchestrationStep&lt;/Action&gt;
              &lt;/Precondition&gt;
            &lt;/Preconditions&gt;
            &lt;ClaimsExchanges&gt;
              &lt;ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" /&gt;
            &lt;/ClaimsExchanges&gt;
          &lt;/OrchestrationStep&gt;
  
          &lt;!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent 
            in the token. --&gt;
          &lt;OrchestrationStep Order="5" Type="ClaimsExchange"&gt;
            &lt;Preconditions&gt;
              &lt;Precondition Type="ClaimEquals" ExecuteActionsIf="true"&gt;
                &lt;Value&gt;authenticationSource&lt;/Value&gt;
                &lt;Value&gt;socialIdpAuthentication&lt;/Value&gt;
                &lt;Action&gt;SkipThisOrchestrationStep&lt;/Action&gt;
              &lt;/Precondition&gt;
            &lt;/Preconditions&gt;
            &lt;ClaimsExchanges&gt;
              &lt;ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" /&gt;
            &lt;/ClaimsExchanges&gt;
          &lt;/OrchestrationStep&gt;
          &lt;!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect 
               from the user. So, in that case, create the user in the directory if one does not already exist 
               (verified using objectId which would be set from the last step if account was created in the directory. --&gt;
          &lt;OrchestrationStep Order="6" Type="ClaimsExchange"&gt;
            &lt;Preconditions&gt;
              &lt;Precondition Type="ClaimsExist" ExecuteActionsIf="true"&gt;
                &lt;Value&gt;objectId&lt;/Value&gt;
                &lt;Action&gt;SkipThisOrchestrationStep&lt;/Action&gt;
              &lt;/Precondition&gt;
            &lt;/Preconditions&gt;
            &lt;ClaimsExchanges&gt;
              &lt;ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" /&gt;
            &lt;/ClaimsExchanges&gt;
          &lt;/OrchestrationStep&gt;
  
          &lt;OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" /&gt;
  
        &lt;/OrchestrationSteps&gt;
        &lt;ClientDefinition ReferenceId="DefaultWeb" /&gt;
      &lt;/UserJourney&gt;
      &lt;/UserJourneys&gt;
  
  &lt;/TrustFrameworkPolicy&gt;
  </code></pre>