Question

我目前正在使用具有LinkedIn集成的Azure AD B2C登录我的应用程序。登录过程正在正常进行，我找回了有关用户的一些声明，例如名称和电子邮件地址。

我想获取LinkedIn的个人资料图片，以便在我的应用中使用默认的个人资料图片。我尝试使用自定义策略，但无法使其正常工作。我尝试编辑 TrustFrameworkBase.xml 和 TrustFrameworkExtensions.xml ，但到目前为止没有任何结果。我在我的TrustFrameworkExtensions.xml中添加了linkedIn作为声明提供者

 <ClaimsProvider>
  <Domain>linkedin.com</Domain>
  <DisplayName>LinkedIn</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="LinkedIn-OAUTH">
      <DisplayName>LinkedIn</DisplayName>
      <Protocol Name="OAuth2" />
      <Metadata>
        <Item Key="ProviderName">linkedin</Item>
        <Item Key="authorization_endpoint">https://www.linkedin.com/oauth/v2/authorization</Item>
        <Item Key="AccessTokenEndpoint">https://www.linkedin.com/oauth/v2/accessToken</Item>
        <Item Key="ClaimsEndpoint">https://api.linkedin.com/v1/people/~:(id,first-name,last-name,email-address,headline, picture-url)</Item>
        <Item Key="SendClaimsIn">Body</Item>
        <Item Key="ClaimsEndpointAccessTokenName">oauth2_access_token</Item>
        <Item Key="ClaimsEndpointFormatName">format</Item>
        <Item Key="ClaimsEndpointFormat">json</Item>
        <Item Key="scope">r_emailaddress r_basicprofile</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="UsePolicyInRedirectUri">0</Item>
        <Item Key="client_id"><CLIENT ID OF LINKEDIN APP></Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="id" />
        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName" />
        <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailAddress" />
        <!--<OutputClaim ClaimTypeReferenceId="jobTitle" PartnerClaimType="headline" />-->
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
        <OutputClaim ClaimTypeReferenceId="extension_Picture" PartnerClaimType="pictureUrl" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

我还在我的TrustFrameworkBase.xml中添加了这个Claimtype

  <ClaimType Id="extension_Picture">
    <DisplayName>Picture</DisplayName>
    <DataType>string</DataType>
    <DefaultPartnerClaimTypes>
      <Protocol Name="OAuth2" PartnerClaimType="picture" />
      <Protocol Name="OpenIdConnect" PartnerClaimType="picture" />
      <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/extension_Picture" />
    </DefaultPartnerClaimTypes>
    <UserHelpText>Your picture.</UserHelpText>
    <UserInputType>TextBox</UserInputType>
  </ClaimType>

有人知道如何在Azure上正确执行声明，以便我可以从linkedIn获取个人资料图片吗？

Answer 1

这是我为LinkedIn用户检索图片网址字段，然后在ID令牌中发出图片声明的方式。

1：使用诸如the Azure Active Directory B2C: Get started with custom policies steps之类的社交帐户政策之一完成the SocialAndLocalAccounts one。

2：在the extensions file中声明图片声明：

<ClaimType Id="picture">
  <DisplayName>Picture</DisplayName>
  <DataType>string</DataType>
  <DefaultPartnerClaimTypes>
    <Protocol Name="OAuth2" PartnerClaimType="picture" />
    <Protocol Name="OpenIdConnect" PartnerClaimType="picture" />
  </DefaultPartnerClaimTypes>
</ClaimType>

3：将图片网址字段添加到 ClaimsEndpoint 元数据项，并将图片输出声明添加到 LinkedIn- the extensions file中的OAUTH 技术简介：

<ClaimsProvider>
  <Domain>linkedin.com</Domain>
  <DisplayName>LinkedIn</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="LinkedIn-OAUTH">
      <DisplayName>LinkedIn</DisplayName>
      <Protocol Name="OAuth2" />
      <Metadata>
        <Item Key="ProviderName">linkedin</Item>
        <Item Key="authorization_endpoint">https://www.linkedin.com/oauth/v2/authorization</Item>
        <Item Key="AccessTokenEndpoint">https://www.linkedin.com/oauth/v2/accessToken</Item>
        <Item Key="ClaimsEndpoint">https://api.linkedin.com/v1/people/~:(id,formatted-name,email-address,picture-url)</Item>
        <Item Key="ClaimsEndpointAccessTokenName">oauth2_access_token</Item>
        <Item Key="ClaimsEndpointFormatName">format</Item>
        <Item Key="ClaimsEndpointFormat">json</Item>
        <Item Key="scope">r_emailaddress r_basicprofile</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="UsePolicyInRedirectUri">0</Item>
        <Item Key="client_id">Your LinkedIn application client ID</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_LinkedInSecret" />
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="id" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="formattedName" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailAddress" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="linkedin.com" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
        <OutputClaim ClaimTypeReferenceId="picture" PartnerClaimType="pictureUrl" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

4：在the sign-up or sign-in relying party file中发出图片声明：

<RelyingParty>
  <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
  <TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="OpenIdConnect" />
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="displayName" />
      <OutputClaim ClaimTypeReferenceId="email" />
      <OutputClaim ClaimTypeReferenceId="picture" />
      <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
      <OutputClaim ClaimTypeReferenceId="identityProvider" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
  </TechnicalProfile>
</RelyingParty>

然后向ID令牌发出图片声明，例如：

"picture": "https://media.licdn.com/dms/image/C5603AQGuMHK965UNqA/profile-displayphoto-shrink_100_100/0?e=1537401600&v=beta&t=e0yFYCn0QTn-dY7FJH_YOjIUY8cumr1llEnAMUVq38g"

Azure AD B2C LinkedIn个人资料图片

1 个答案: