Question

我有一个密码重置策略，如果帐户存在，我将在此处向要求密码重置的用户发送OTP。这是我的用户历程：

<UserJourney Id="PasswordReset">
             <OrchestrationSteps>
                <OrchestrationStep Order="1" Type="ClaimsExchange">
                    <ClaimsExchanges>
                        <ClaimsExchange Id="PasswordResetUsingUserNameExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingUserName" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <OrchestrationStep Order="2" Type="ClaimsExchange">
                    <ClaimsExchanges>
                        <ClaimsExchange Id="PasswordReset-EmailVerification-Exchange" TechnicalProfileReferenceId="SelfAsserted-PasswordReset-CustomEmailVerification" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <OrchestrationStep Order="3" Type="ClaimsExchange">
                    <ClaimsExchanges>
                        <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
                    </ClaimsExchanges>
                </OrchestrationStep>
                <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
             </OrchestrationSteps>
             <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>

首先读取配置文件，如果存在，则将OTP发送到电子邮件或电话。很好。

<TechnicalProfile Id="LocalAccountDiscoveryUsingUserName">
                    <DisplayName>Reset password using username</DisplayName>
                    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
                    <Metadata>
                        <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
                        <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
                        <Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">Your account has been locked. Contact your support person to unlock it, then try again.</Item>
                    </Metadata>
                    <CryptographicKeys>
                        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
                    </CryptographicKeys>
                    <IncludeInSso>false</IncludeInSso>
                    <OutputClaims>                        
                        <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
                        <OutputClaim ClaimTypeReferenceId="objectId" />
                        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                        <OutputClaim ClaimTypeReferenceId="authenticationSource" />            
                    </OutputClaims>
                    <ValidationTechnicalProfiles>
                        <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingSignInUserName" />
                        <ValidationTechnicalProfile ReferenceId="FuncREST-WithPhoneUserName-OTP">
                            <Preconditions>                        
                                <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                                    <Value>signInNames.emailAddress</Value>
                                    <Action>SkipThisValidationTechnicalProfile</Action>
                                </Precondition>
                            </Preconditions>
                        </ValidationTechnicalProfile>

                        <ValidationTechnicalProfile ReferenceId="FuncREST-WithEmailUserName-OTP">
                            <Preconditions>                        
                                <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
                                    <Value>signInNames.emailAddress</Value>
                                    <Action>SkipThisValidationTechnicalProfile</Action>
                                </Precondition>
                            </Preconditions>
                        </ValidationTechnicalProfile>

                    </ValidationTechnicalProfiles>
                </TechnicalProfile>

在“用户阅读”配置文件中，我添加了一个 OutputClaimsTransformation ，它将创建一个只读电子邮件。

<TechnicalProfile Id="AAD-UserReadUsingSignInUserName">
                    <Metadata>
                        <Item Key="Operation">Read</Item>
                        <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
                        <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An account could not be found for the provided user ID.</Item>
                    </Metadata>
                    <IncludeInSso>false</IncludeInSso>
                    <InputClaims>                       
                        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.emailAddress" />
                        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.phoneNumber" />
                    </InputClaims>
                    <OutputClaims>
                        <!-- Required claims -->
                        <OutputClaim ClaimTypeReferenceId="objectId" />
                        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
                        <!-- Optional claims -->
                        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
                        <OutputClaim ClaimTypeReferenceId="displayName" />
                        <OutputClaim ClaimTypeReferenceId="accountEnabled" />
                        <OutputClaim ClaimTypeReferenceId="otherMails" />
                        <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress"/>
                        <OutputClaim ClaimTypeReferenceId="signInNames.phoneNumber"/>
                        <OutputClaim ClaimTypeReferenceId="givenName" />
                        <OutputClaim ClaimTypeReferenceId="surname" />
                    </OutputClaims>
                    <OutputClaimsTransformations>
                        <OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
                        <OutputClaimsTransformation ReferenceId="CreateReadonlyEmailClaimPasswordReset" />
                    </OutputClaimsTransformations>
                    <IncludeTechnicalProfile ReferenceId="AAD-Common" />
                </TechnicalProfile>

然后在下一步中尝试访问先前创建的“ readonlyEmail”，但显示为空白。

<TechnicalProfile Id="SelfAsserted-PasswordReset-CustomEmailVerification">
                    <DisplayName>Local Account E-mail Address Verification</DisplayName>
                    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
                    <Metadata>
                        <Item Key="ContentDefinitionReferenceId">api.localaccountsignup.verify</Item>
                        <!-- <Item Key="EnforceEmailVerification">true</Item> -->
                        <Item Key="language.button_continue">Next</Item>
                        <Item Key="setting.showCancelButton">false</Item>
                    </Metadata>
                    <InputClaims>
                        <InputClaim ClaimTypeReferenceId="readonlyEmail" />
                    </InputClaims>
                    <OutputClaims>
                        <OutputClaim ClaimTypeReferenceId="readonlyEmail" Required="true" />
                        <OutputClaim ClaimTypeReferenceId="otp" Required="true" />
                    </OutputClaims>

                    <ValidationTechnicalProfiles>
                        <ValidationTechnicalProfile ReferenceId="FuncREST-Email-OTP" />
                    </ValidationTechnicalProfiles>
                </TechnicalProfile>

Answer 1

添加

<OutputClaim ClaimTypeReferenceId="readonlyEmail" />
到LocalAccountDiscoveryUsingUserName。因为来自VTP的声明只有通过其父TP冒泡才暴露给下一个编排步骤。

在B2C自定义策略中将一种声明类型从一个步骤转移到另一步骤

1 个答案: