Azure AD B2C 登录自定义策略 returns "Invalid username or password."

Question

使用 SignInAndSignUp 自定义策略，我可以成功注册并重设密码，我在注册后登录，但由于某种原因我无法登录。

我在 TrustFrameworkExtensions.xml

中设置了 ApplicationId

这是我从 AzureAD B2C VS Code Application Insights Extension 获得的一些数据：

异常：用户名或密码无效。 验证技术配置文件：login-NonInteractive

{
  "Key": "Exception",
  "Value": {
    "Kind": "Handled",
    "HResult": "80131500",
    "Message": "Invalid username or password.",
    "Data": {
      "IsPolicySpecificError": false
    }
  }
}

TrustFrameworkBase.xml 中的登录-非交互：

<ClaimsProvider>
  <DisplayName>Local Account SignIn</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="login-NonInteractive">
      <DisplayName>Local Account SignIn</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <Metadata>
        <Item Key="ProviderName">https://sts.windows.net/</Item>
        <Item Key="METADATA">https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration</Item>
        <Item Key="authorization_endpoint">https://login.microsoftonline.com/{tenant}/oauth2/token</Item>
        <Item Key="response_types">id_token</Item>
        <Item Key="response_mode">query</Item>
        <Item Key="scope">email openid</Item>
        <!-- <Item Key="grant_type">password</Item> -->

        <!-- Policy Engine Clients -->
        <Item Key="UsePolicyInRedirectUri">false</Item>
        <Item Key="HttpBinding">POST</Item>
      </Metadata>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" />
        <InputClaim ClaimTypeReferenceId="password" Required="true" />
        <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="password" />
        <InputClaim ClaimTypeReferenceId="scope" DefaultValue="openid" />
        <InputClaim ClaimTypeReferenceId="nca" PartnerClaimType="nca" DefaultValue="1" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" />
        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
      </OutputClaims>
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

TrustFrameworkExtensions.xml 中的登录-非交互：

<ClaimsProvider>
  <DisplayName>Local Account SignIn</DisplayName>
  <TechnicalProfiles>
     <TechnicalProfile Id="login-NonInteractive">
      <Metadata>
        <Item Key="client_id">I have it set, but removed for question</Item>
        <Item Key="IdTokenAudience">I have it set, but removed for question</Item>
      </Metadata>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="I have it set, but removed for question" />
        <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="I have it set, but removed for question" />
      </InputClaims>
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

有什么帮助吗？

Answer 1

这总是因为你没有准确地遵循这个过程。

https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows?pivots=b2c-custom-policy#register-identity-experience-framework-applications

还有 https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows?pivots=b2c-custom-policy#add-application-ids-to-the-custom-policy

您可以改用我的设置工具来自动执行该过程。只需先删除两个应用程序注册（proxyief 和ief）即可。 https://aka.ms/iefsetup.

Azure AD B2C 登录自定义策略 returns "Invalid username or password."

AzureAD B2C Sign In Custom Policy returns "Invalid username or password."

azure-ad-b2c

azure-ad-b2c-custom-policy