如何使用自定义策略基于扩展声明类型防止在 AD B2C 中登录

Question

我有一个扩展声明类型 extension_isEmailVerified。我想根据此声明类型的值阻止用户登录。如果它是 true 那么用户可以登录，如果 false 那么需要在登录页面显示一条错误消息，表明您的电子邮件未被验证。

        <TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
          <DisplayName>Local Account Signin</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="SignUpTarget">SignUpWithLogonEmailExchange</Item>
            <Item Key="setting.operatingMode">Username</Item>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="signInName" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
            <OutputClaim ClaimTypeReferenceId="password" Required="true" />
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
          </ValidationTechnicalProfiles>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>

以上是我的签到技术简介

Answer 1

您可以添加额外的验证技术配置文件来验证自定义属性，并在未将其设置为预期值时显示错误消息，如下所示：

（请注意，如果 login-NonInteractive 验证技术配置文件不成功，则不会执行其他验证技术配置文件。）

<TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
  ...
  <Metadata>
    <Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">Oops, your email hasn't been verified.</Item>
  </Metadata>
  ...
  <ValidationTechnicalProfiles>
    <ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
    <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingObjectId" />
    <ValidationTechnicalProfile ReferenceId="ClaimsTransformation-AssertEmailVerified" />
  </ValidationTechnicalProfiles>
</TechnicalProfile>

ClaimsTransformation-AssertEmailVerified 技术配置文件（有关声明转换技术配置文件的更多信息，请参阅 Define a claims transformation technical profile）定义为：

<ClaimsProvider>
  <DisplayName>Claims Transformation</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="ClaimsTransformation-AssertEmailVerified">
      <DisplayName>Assert Email Verified Claims Transformation</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="extension_EmailVerified" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="AssertEmailVerified" />
      </OutputClaimsTransformations>
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

AssertEmailVerified 声明转换定义为：

<ClaimsTransformation Id="AssertEmailVerified" TransformationMethod="AssertBooleanClaimIsEqualToValue">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="extension_EmailVerified" TransformationClaimType="inputClaim" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="valueToCompareTo" DataType="boolean" Value="true" />
  </InputParameters>
</ClaimsTransformation>

如何使用自定义策略基于扩展声明类型防止在 AD B2C 中登录

How to prevent Login in AD B2C based on an extension claim type using custom policies

azure-ad-b2c

identity-experience-framework