Entra External ID (EEID) AADSTS1100001 error with token issuance custom authentication extensions

American merchant token coin via Wikimedia

The actual error is:

AADSTS1100001: Non-retryable error has occurred. Underlying error code: 
  1003002

I was testing logging in from EEID to a guest account in an Entra ID tenant when I encountered this error.

In EEID, you don’t have to configure any federation configuration parameters. It is done by default.

The user was invited and had accepted the invitation.

If you research the error, you will see:

Error AADSTS1100001 (Underlying 1003002)indicates a non-retryable failure in 
a Microsoft Entra custom authentication extension, likely when using Azure 
Functions as a claim provider. The extension failed to receive a valid JSON 
response from the Azure Function, often due to improper payload format, 
missing permissions, or incorrect configuration.

But if you look at the user flow, you see:

There are no custom authentication extensions configured?

Which puzzled me for a while, so I looked at all the extensions.

And then I realised that I have a “Token Issuance Start” extension as well, and that endpoint no longer exists!

OK, that explained the error, but I can log in to other user flows, and they work?

Get Rory Braybrook’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Time to break out Graph Explorer!

# Get All User Flows with Full Details (Expanded)
GET https://graph.microsoft.com/v1.0/identity/authenticationEventsFlows?
  $expand=*

This gives you a lot of information, but search for your user flow name in the response.

"@odata.type": "#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow",
"id": "aa2...d84",
"displayName": "B2C",

We want the ID. Then run:

https://graph.microsoft.com/v1.0/identity/authenticationEventsFlows/aa2...d84

That gives the info. for that user flow only.

Look for these properties:

• onAuthenticationMethodLoadStart
• onAttributeCollectionStart
• onAttributeCollectionSubmit
• onInteractiveAuthFlowStart

I see

 "onAttributeCollectionStart": null,
 "onAttributeCollectionSubmit": null,

But the other two have entries.

I then see:

"conditions": {
        "applications": {
            "includeApplications@odata.context": 
            "https://graph.microsoft.com/v1.0/$metadata#identity/
            authenticationEventsFlows('aa2...d84')/
            microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/
            conditions/applications/includeApplications",
            "includeApplications": [
                {
                    "appId": "302...3cc"
                }
            ]
        }
    },

and I see a condition for that appId.

It is the ID of the application attached to the user flow that gets the error.

That’s why only this user flow has issues 😃

All good!