我有一些关于AAD B2C自定义策略的问题。这就是我的问题,我想获得newUser
属性,但我不确定我做错了什么。
这是我的第一个解决方案,这个技术配置文件的目的是注册部分,我试着把newUser
作为Output
声明在这里。但我意识到它不工作,因为它是在SM-Noop
。
<TechnicalProfile Id="NewUserAccountUpdatePrimaryDetails">
<DisplayName>Profile creation using read only email</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<Item Key="IpAddressClaimReferenceId">IpAddress</Item>
<Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
<Item Key="language.button_continue">Next</Item>
<!-- Sample: Remove sign-up email verification -->
<Item Key="EnforceEmailVerification">False</Item>
</Metadata>
<InputClaimsTransformations>
<InputClaimsTransformation ReferenceId="CreateReadonlyEmailClaim" />
</InputClaimsTransformations>
<InputClaims>
<!--Sample: Set input the ReadOnlyEmail claim type to prefilled the email address-->
<InputClaim ClaimTypeReferenceId="readOnlyEmail" />
<InputClaim ClaimTypeReferenceId="country" />
<!-- Optional claims, to be collected from the user -->
<InputClaim ClaimTypeReferenceId="displayName" />
<InputClaim ClaimTypeReferenceId="givenName" />
<InputClaim ClaimTypeReferenceId="surName" />
<InputClaim ClaimTypeReferenceId="streetAddress" />
<InputClaim ClaimTypeReferenceId="city" />
<InputClaim ClaimTypeReferenceId="state" />
<InputClaim ClaimTypeReferenceId="postalCode" />
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="readOnlyEmail" Required="true" />
<OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
<OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
<OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
<OutputClaim ClaimTypeReferenceId="authenticationSource" />
<OutputClaim ClaimTypeReferenceId="country" Required="true" />
<OutputClaim ClaimTypeReferenceId="displayName" Required="true"/>
<OutputClaim ClaimTypeReferenceId="givenName" Required="true"/>
<OutputClaim ClaimTypeReferenceId="surName" Required="true"/>
<OutputClaim ClaimTypeReferenceId="newUser" />
<!-- Optional claims, to be collected from the user -->
<OutputClaim ClaimTypeReferenceId="streetAddress" />
<OutputClaim ClaimTypeReferenceId="city" />
<OutputClaim ClaimTypeReferenceId="state" />
<OutputClaim ClaimTypeReferenceId="postalCode" />
</OutputClaims>
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail-ProfileUpdate" />
</ValidationTechnicalProfiles>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>
现在,我尝试的第二个解决方案是将newUser
声明为RelyingParty
中的Output
声明。
<RelyingParty>
<DefaultUserJourney ReferenceId="CheckPassReset" />
<UserJourneyBehaviors>
<SingleSignOn Scope="Tenant" />
<JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="4b408c9c-6ef1-43db-82e7-6368e1fc1536"
DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
<ScriptExecution>Allow</ScriptExecution>
</UserJourneyBehaviors>
<TechnicalProfile Id="PolicyProfile">
<DisplayName>PolicyProfile</DisplayName>
<Protocol Name="OpenIdConnect" />
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="email" />
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
<OutputClaim ClaimTypeReferenceId="displayName" />
<OutputClaim ClaimTypeReferenceId="givenName" />
<OutputClaim ClaimTypeReferenceId="surname" />
<OutputClaim ClaimTypeReferenceId="newUser" />
<OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
</OutputClaims>
<SubjectNamingInfo ClaimType="sub" />
</TechnicalProfile>
</RelyingParty>
我哪里做错了?我在Google和StackOverflow中看到的大多数解决方案都与User Flow
相关。我可能错过了什么,但我不知道是什么。
谢谢你的帮助!如果你需要更多的信息,请告诉我。
1条答案
按热度按时间j8yoct9x1#
在自定义策略入门包中,
newUser
声明由创建用户(AAD-UserWriteUsingLogonEmail
)的技术配置文件生成:它正在对Graph API运行写操作,如果这创建了一个新用户,则
newClaimsPrincipalCreated
返回true。然后,上面的输出声明将其Map到newUser
声明,然后在下面的步骤中使用该声明。在您的示例中,
AAD-UserWriteUsingLogonEmail-ProfileUpdate
听起来像是在更新用户配置文件时完成的写入。如果在这种情况下用户已经存在,newUser
声明将始终返回false。如果不是这种情况,则需要将newUser
声明添加为输出声明。这看起来确实是一个密码重置流程,其中用户将始终存在。所以newUser
总是为false。