如何在本地帐户的自定义登录策略中忘记密码 link？

Question

使用 AAD B2C 身份体验框架，我正在尝试创建一个允许登录到本地 AADB2C 帐户的自定义策略，并包括一个 "Can’t access your account?" link 调用内置的自服务功能。所以基本上我想要内置 "B2C_1_SignIn_Local" 策略的用户 experience/functionality，但作为我的自定义策略套件的一部分。我不希望此 userjourney/experience 允许用户选择不同的 IdP。

我已经能够创建调用本地登录的 userjourney，但是 UI 不包括 "Can’t access your account?" link。到目前为止，我的用户旅程如下所示：

 <UserJourney Id="SignInB2CLocal">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection TargetClaimsExchangeId="SignInWithLogonNameExchange" />
          </ClaimsProviderSelections>
        </OrchestrationStep>

       <OrchestrationStep Order="2" Type="ClaimsExchange">
        <ClaimsExchanges>
          <ClaimsExchange Id="SignInWithLogonNameExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
        </ClaimsExchanges>
       </OrchestrationStep>


        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>socialIdpAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>


        <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
    </UserJourney>

以上内容结合了我在内置策略 B2C_1_SignIn_Local（下载的文件）中找到的内容以及我用于 AAD 等其他 IdP 的内容。我还尝试从我的 MVC ASP.NET 应用程序直接调用内置 B2C_1_SignIn_Local，但出现令牌验证错误。

我想要的结果可能吗？

谢谢！

马丁

Answer 1

您可以：

(i) 从 ClaimsProviderSelection 和 ClaimsExchange 编排步骤更改为具有 api.signuporsignin 内容定义的 CombinedSignInAndSignUp 编排步骤，或

(ii) 从 api.selfasserted 内容定义更改为 api.signuporsignin SelfAsserted-LocalAccountSignin-Email 技术简介。

重要的是内容定义的 <DataUri /> 值设置为：

urn:com:microsoft:aad:b2c:elements:unifiedssp:1.0.0

呈现 "Forgot your password" 和 "Sign up now" 链接。

i) CombinedSignInAndSignUp编排步骤

<OrchestrationSteps>
  <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signupsignin">
    <ClaimsProviderSelections>
      <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
    </ClaimsProviderSelections>
    <ClaimsExchanges>
      <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
    </ClaimsExchanges>
  </OrchestrationStep>
  <OrchestrationStep Order="2" Type="ClaimsExchange">
    <Preconditions>
      <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
        <Value>objectId</Value>
        <Action>SkipThisOrchestrationStep</Action>
      </Precondition>
    </Preconditions>
    <ClaimsExchanges>
      <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
    </ClaimsExchanges>
  </OrchestrationStep>
  <OrchestrationStep Order="3" Type="ClaimsExchange">
    <ClaimsExchanges>
      <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
    </ClaimsExchanges>
  </OrchestrationStep>
  <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
</OrchestrationSteps>

ii) LocalAccountSigninEmailExchange 技术简介

<TechnicalProfiles>
  <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
    <Metadata>
      <Item Key="ContentDefinitionReferenceId">api.signuporsignin</Item>
    </Metadata>
  </TechnicalProfile>
</TechnicalProfiles>

<OrchestrationSteps>
  <OrchestrationStep Order="1" Type="ClaimsExchange">
    <ClaimsExchanges>
      <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
    </ClaimsExchanges>
  </OrchestrationStep>
  <OrchestrationStep Order="2" Type="ClaimsExchange">
    <Preconditions>
      <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
        <Value>objectId</Value>
        <Action>SkipThisOrchestrationStep</Action>
      </Precondition>
    </Preconditions>
    <ClaimsExchanges>
      <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
    </ClaimsExchanges>
  </OrchestrationStep>
  <OrchestrationStep Order="3" Type="ClaimsExchange">
    <ClaimsExchanges>
      <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
    </ClaimsExchanges>
  </OrchestrationStep>
  <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
</OrchestrationSteps>

Answer 2

这是未经测试的，但我很确定你会更改：

ContentDefinitionReferenceId="api.idpselections"

收件人：

ContentDefinition Id="api.localaccountsignin"

这应该只显示没有注册和密码重置的本地帐户登录页面。

如何在本地帐户的自定义登录策略中忘记密码 link？

How can I get a forgot password link on a custom Sign In policy for local accounts?

azure-ad-b2c

identity-experience-framework