在 Azure B2C 的自定义策略中找不到声明 - Saml

Question

我已经从我的 Azure AD B2C 中的 SocialAndLocalAccounts 模板上传了我的自定义策略。我已更改策略以使用 SAML 协议进行身份验证，如 MS Documentation

中所述

这是在TrustFrameworkExtensions.xml文件

中添加的声明提供者

<ClaimsProvider>
  <DisplayName>Token Issuer</DisplayName>
  <TechnicalProfiles>

  <!-- SAML Token Issuer technical profile -->
  <TechnicalProfile Id="Saml2AssertionIssuer">
    <DisplayName>Token Issuer</DisplayName>
    <Protocol Name="SAML2"/>
    <OutputTokenFormat>SAML2</OutputTokenFormat>
    <Metadata>
      <Item Key="IssuerUri">http://localhost:8080/spring-security-saml2-sample</Item>
    </Metadata>
    <CryptographicKeys>
      <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
    </CryptographicKeys>
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="subject" />
    </InputClaims>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="issuerUserId" />
      <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="first_name" />
      <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="last_name" />
      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
      <OutputClaim ClaimTypeReferenceId="email"  />
      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="myIDPName" />
      <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
    </OutputClaims>
    <OutputClaimsTransformations>
      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
      <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
    </OutputClaimsTransformations>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer"/>
  </TechnicalProfile>

  <!-- Session management technical profile for SAML-based tokens -->
  <TechnicalProfile Id="SM-Saml-issuer">
    <DisplayName>Session Management Provider</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
  </TechnicalProfile>

  </TechnicalProfiles>
</ClaimsProvider>

这是我的 B2C_1A_signup_signin_saml 政策中的依赖方。

<RelyingParty>
<DefaultUserJourney ReferenceId="SignUpOrSignIn" />
<TechnicalProfile Id="PolicyProfile">
  <DisplayName>PolicyProfile</DisplayName>
  <Protocol Name="SAML2"/>
  <Metadata>
    <Item Key="PartnerEntity">https://mydomainurl.url/spring_saml_metadata.xml</Item>
  </Metadata> 
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="displayName" />
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="surname" />
    <OutputClaim ClaimTypeReferenceId="email"/>
    <OutputClaim ClaimTypeReferenceId="identityProvider"/>
    <OutputClaim ClaimTypeReferenceId="objectId"/>
    <OutputClaim ClaimTypeReferenceId="issuerUserId"/>
  </OutputClaims>
  <SubjectNamingInfo ClaimType="objectId" ExcludeAsClaim="true"/>
</TechnicalProfile>

当我尝试使用用于测试的 spring-saml application 登录时，我遇到了这个错误：

Caused by: org.opensaml.common.SAMLException: Response has invalid status code urn:oasis:names:tc:SAML:2.0:status:Responder, status message is Id:d5cae994-9df6-44a2-9044-ed1c108152dc ; Message: A claim with id 'issuerUserId' was not found, which is required by ClaimsTransformation 'CreateAlternativeSecurityId' with id 'CreateAlternativeSecurityId' in policy 'B2C_1A_signup_signin_saml' of tenant 'supplauthtestcom.onmicrosoft.com'. at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:113) at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:82) ... 31 more

我认为问题出在 issuerUserId 映射上，但当我添加设置后，一切都没有改变。

关于如何解决这个错误有什么建议吗？

Answer 1

将Saml2AssertionIssuer技术资料更改为

    <TechnicalProfile Id="Saml2AssertionIssuer">
      <DisplayName>Token Issuer</DisplayName>
      <Protocol Name="SAML2"/>
      <OutputTokenFormat>SAML2</OutputTokenFormat>
      <Metadata>
        <Item Key="IssuerUri">http://localhost:8080/spring-security-saml2-sample</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
        <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      </CryptographicKeys>
      <InputClaims/>
      <OutputClaims/>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer"/>
    </TechnicalProfile>

从 <RelyingParty> 部分删除：

<OutputClaim ClaimTypeReferenceId="issuerUserId"/>

将此添加到 <RelyingParty> 部分之前，如果还没有的话：

<UserJourneys>
  <UserJourney Id="SignUpOrSignIn">
    <OrchestrationSteps>
      <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer"/>
    </OrchestrationSteps>
  </UserJourney>
</UserJourneys>

Answer 2

经过几次尝试后，我在自定义策略用于连接到外部 IDP 以获取身份验证的另一个 ClaimProvider 配置的错误配置中找到了解决方案。将 issuerUserId 映射更改为该 ClaimProvider 后，我的应用开始正常运行。

我认为问题在于 Saml2AssertionIssuer 获取的 issuerUserId 值不正确

在 Azure B2C 的自定义策略中找不到声明 - Saml

Claim not found in custom policy for Azure B2C - Saml

azure

spring-saml

azure-ad-b2c

azure-ad-b2c-custom-policy