密码重置子旅程后 Azure B2C 强制登录

Question

我们正在使用此处所述的密码重置子旅程 (https://docs.microsoft.com/en-us/azure/active-directory-b2c/add-password-reset-policy?pivots=b2c-custom-policy#self-service-password-reset-recommended)。

使用此功能时，用户会在密码重置流程成功后自动登录。我们希望在密码重置成功后停止并重定向用户到登录页面。

我们怎样才能做到这一点，这是主要旅程的样子：

    <UserJourney Id="SignIn">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signin">
              <ClaimsProviderSelections>
                <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
                <ClaimsProviderSelection TargetClaimsExchangeId="ForgotPasswordExchange" />
              </ClaimsProviderSelections>
              <ClaimsExchanges>
                <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <Preconditions>
                <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                  <Value>objectId</Value>
                  <Action>SkipThisOrchestrationStep</Action>
                </Precondition>
              </Preconditions>
              <ClaimsExchanges>
                <ClaimsExchange Id="ForgotPasswordExchange" TechnicalProfileReferenceId="ForgotPassword" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="InvokeSubJourney">
              <Preconditions>
                <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
                  <Value>isForgotPassword</Value>
                  <Action>SkipThisOrchestrationStep</Action>
                </Precondition>
              </Preconditions>
              <JourneyList>
                <Candidate SubJourneyReferenceId="PasswordReset" />
              </JourneyList>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>.....
------------------------------------------------------
    <SubJourney Id="PasswordReset" Type="Call">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingLogonName" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <!-- This step reads any user attributes that we may not have received when in the token. -->
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="VerifyEmail" TechnicalProfileReferenceId="VerifyEmail" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
          </OrchestrationSteps>

Answer 1

选项 1

一个简单的解决方案（可能不理想）是阻止用户使用没有取消/继续按钮的自我断言页面作为密码重置子旅程的最后一步。这样用户永远不会获得 jwt 令牌。
您可以在自我断言页面中包含一些文本，例如 'Your password has been reset successfully. Please login again.' 您还可以在同一页面中提供登录名 url，以便用户可以导航到它或在使用 javascript 延迟后重定向.

示例：

 <TechnicalProfile Id="SelfAsserted-PasswordResetBlockPage">
    <DisplayName>Show Block message</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
        <Item Key="AllowGenerationOfClaimsWithNullValues">true</Item>
        <Item Key="setting.showContinueButton">false</Item>
        <Item Key="setting.showCancelButton">false</Item>
    </Metadata>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="responseMsg" DefaultValue="Your password has been reset successfully. Please login again with your new credentials." AlwaysUseDefaultValue="true"/>
    </InputClaims>
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="responseMsg" />
    </OutputClaims>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

<ClaimType Id="responseMsg">
    <DisplayName>Information</DisplayName>
    <DataType>string</DataType>
    <AdminHelpText>A claim responsible for holding response messages to send to the relying party</AdminHelpText>
    <UserHelpText>A claim responsible for holding response messages to send to the relying party</UserHelpText>
    <UserInputType>Paragraph</UserInputType>
</ClaimType>

选项 2
具有密码重置后再次登录的编排步骤。如果密码重置还没有完成，请跳过它。

注意：确保进行广泛测试，尤其是使用 SSO 流程以确保一切按预期进行。

密码重置子旅程后 Azure B2C 强制登录

Azure B2C force login after password reset sub journey

azure-ad-b2c

azure-ad-b2c-custom-policy

azure-b2c