Azure Active Directory B2C 自定义邀请策略 - 在步骤之间传递自定义声明

Question

我已通过此示例实施了邀请策略（通过向用户发送电子邮件 link 来邀请他们访问网站）https://github.com/azure-ad-b2c/samples/tree/master/policies/invite

我有这个用户旅程

<UserJourney Id="SignUpInvitation">
      <OrchestrationSteps>

        <OrchestrationStep Order="1" Type="GetClaims" CpimIssuerTechnicalProfileReferenceId="IdTokenHint_ExtractClaims" />

        <OrchestrationStep Order="2" Type="ClaimsExchange">
         <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>        
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAsserted-Unsolicited" TechnicalProfileReferenceId="SelfAsserted-Unsolicited"/>
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSignUpWithReadOnlyEmail" TechnicalProfileReferenceId="LocalAccountSignUpWithReadOnlyEmail"/>
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer"/>

      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb"/>
    </UserJourney>

第一步，我从 JWT 中提取声明。电子邮件和自定义声明，

<TechnicalProfiles>
        <TechnicalProfile Id="IdTokenHint_ExtractClaims">
          <DisplayName> My ID Token Hint TechnicalProfile</DisplayName>
          <Protocol Name="None" />
          <Metadata>

            <Item Key="METADATA">https://mywebsite.com/internal/v1/invitation/.well-known/openid-configuration</Item>

          </Metadata>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" />  
            <OutputClaim ClaimTypeReferenceId="extension_DBId" DefaultValue="1" />
          </OutputClaims>

        </TechnicalProfile>
      </TechnicalProfiles>

（请注意，我为我的自定义声明设置了默认值 1）

然后，我有将用户写入目录的技术配置文件

<TechnicalProfile Id="LocalAccountSignUpWithReadOnlyEmail">
          <DisplayName>Email signup</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
            <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
            <Item Key="language.button_continue">Create</Item>
            <!-- Sample: Remove sign-up email verification -->
            <Item Key="EnforceEmailVerification">False</Item>
          </Metadata>
          <InputClaimsTransformations>
            <InputClaimsTransformation ReferenceId="CopyEmailAddress" />
          </InputClaimsTransformations>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="ReadOnlyEmail" />
            <InputClaim ClaimTypeReferenceId="extension_DBId" DefaultValue="2" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="ReadOnlyEmail" Required="true" />
            <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />
            <OutputClaim ClaimTypeReferenceId="newUser" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
          <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail-Custom" />

          </ValidationTechnicalProfiles>
           <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" /> 
        </TechnicalProfile>

（请注意，这里我为我的自定义声明设置了默认值 2）

AAD-UserWriteUsingLogonEmail-Custom 是对内置（在 TrustFrameworkBase.xml 内）AAD-UserWriteUsingLogonEmail 配置文件的修改，我修改了它以包含我的自定义声明 extension_DBId 作为坚持主张：

<PersistedClaim ClaimTypeReferenceId="extension_DBId" DefaultValue="3" />

问题来了，

我生成了一个带有任意 extension_DBId（不是 1,2 或 3）
的 JWT 但是当我运行使用它的政策时，在输出声明中，我得到 extension_DBId=2

这表明第三个编排步骤 (LocalAccountSignUpWithReadOnlyEmail) 没有收到来自第一个编排步骤 (IdTokenHint_ExtractClaims) 的 extension_DBId 声明。

为什么 IdTokenHint_ExtractClaims 个人资料不将 extension_DBId 声明转移到 LocalAccountSignUpWithReadOnlyEmail 个人资料？

我试过去掉第二步(SelfAsserted-Unsolicited)，还是不行。

它会是什么？

Answer 1

@ChrisPadgett 指出我必须将我的自定义声明 (extension_DBId) 添加到依赖方策略中的 InputClaims

<RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpInvitation" />

    <UserJourneyBehaviors>
        <ContentDefinitionParameters>
        <Parameter Name="ui_locales">{Culture:RFC5646}</Parameter>
      </ContentDefinitionParameters>
      <ScriptExecution>Allow</ScriptExecution>
    </UserJourneyBehaviors>

    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />

      <InputClaims>
        <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
        <InputClaim ClaimTypeReferenceId="DBId" /> <!-- This was added -->
      </InputClaims>

      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="emails" />
        <OutputClaim ClaimTypeReferenceId="objectId" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
        <OutputClaim ClaimTypeReferenceId="extension_DBId" />
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>

（然后我有一个声明转换，将 DBId 转换为 extension_DBId）

Answer 2

对于从输入 JWT 接收传入声明的用户旅程，您必须向依赖方添加 <InputClaim /> <TechnicalProfile />:

<RelyingParty>
  <TechnicalProfile Id="PolicyProfile">
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="email" />
      <InputClaim ClaimTypeReferenceId="extension_DBId" />
    </InputClaims>
  </TechnicalProfile>
</RelyingParty>

如果内部声明的声明类型（例如extension_DBId）与输入 JWT 的声明类型（例如DBId）不同，那么您可以添加 PartnerClaimType 属性到 InputClaim 元素：

<InputClaim ClaimTypeReferenceId="extension_DBId" PartnerClaimType="DBId" />

Azure Active Directory B2C 自定义邀请策略 - 在步骤之间传递自定义声明

Azure Active Directory B2C Custom Invite Policy - Passing Custom Claims Between Steps

azure

azure-active-directory

azure-ad-b2c

identity-experience-framework