尽管在 SAML 断言中发送了声明，但未找到声明答案

【问题标题】：Claim not found despite being sent in the SAML assertion尽管在 SAML 断言中发送了声明，但未找到声明
【发布时间】：2022-11-03 02:19:15
【问题描述】：

根据 Application Insights 中的跟踪，我错过了 givenName 声明。异常消息是：

""Message"": ""A Claim of ClaimType with id \""givenName\"" was not found, which is required by the ClaimsTransformationImpl of Type \""Microsoft.Cpim.Data.Transformations.StringReplaceTransformation\"" for TransformationMethod \""StringReplace\"" referenced by the ClaimsTransformation with id \""NormalizeGivenNameMeijburg\"" in policy \""B2C_1A_MeijburgExtension\"" of tenant \""isideb2cdev.onmicrosoft.com\""."",

真正令人困惑的是，在跟踪的早期，我可以看到 SAML 断言，它肯定有这个声明。请参阅下面的 sn-p（我不确定它是否包含敏感信息，所以我在这里留下了很多断言）：

<saml:Attribute Name=\""givenname\""><saml:AttributeValue>Redmar</saml:AttributeValue></saml:Attribute><saml:Attribute Name=\""surname\""><saml:AttributeValue>de Vries</saml:AttributeValue></saml:Attribute>

在我的 RP 文件中，TechnicalProfile 标记中有以下内容：

<TechnicalProfile Id="Policy Profile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="OpenIdConnect" />
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="givenName" />
        <OutputClaim ClaimTypeReferenceId="surname" />
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="Meijburg.com" />
        <OutputClaim ClaimTypeReferenceId="issuerUserId" />
        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
</TechnicalProfile>

在扩展文件中，OutputClaims 标记中有以下内容：

<OutputClaims>
    <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="assertionSubjectName" />
    <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
    <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
    <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
    <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="Meijburg.com" />
</OutputClaims>

客户端的元数据在ClaimTypesOffered 标记中具有以下内容：

<fed:ClaimTypesOffered>
    <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Name</auth:DisplayName>
        <auth:Description>The mutable display name of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Subject</auth:DisplayName>
        <auth:Description>An immutable, globally unique, non-reusable identifier of the user that is unique to the application for which a token is issued.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Given Name</auth:DisplayName>
        <auth:Description>First name of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Surname</auth:DisplayName>
        <auth:Description>Last name of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/displayname" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Display Name</auth:DisplayName>
        <auth:Description>Display name of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/nickname" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Nick Name</auth:DisplayName>
        <auth:Description>Nick name of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Authentication Instant</auth:DisplayName>
        <auth:Description>The time (UTC) when the user is authenticated to Windows Azure Active Directory.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Authentication Method</auth:DisplayName>
        <auth:Description>The method that Windows Azure Active Directory uses to authenticate users.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/objectidentifier" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>ObjectIdentifier</auth:DisplayName>
        <auth:Description>Primary identifier for the user in the directory. Immutable, globally unique, non-reusable.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/tenantid" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>TenantId</auth:DisplayName>
        <auth:Description>Identifier for the user's tenant.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/identityprovider" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>IdentityProvider</auth:DisplayName>
        <auth:Description>Identity provider for the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Email</auth:DisplayName>
        <auth:Description>Email address of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Groups</auth:DisplayName>
        <auth:Description>Groups of the user.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/accesstoken" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>External Access Token</auth:DisplayName>
        <auth:Description>Access token issued by external identity provider</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/expiration" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>External Access Token Expiration</auth:DisplayName>
        <auth:Description>UTC expiration time of access token issued by external identity provider.</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/identity/claims/openid2_id" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>External OpenID 2.0 Identifier</auth:DisplayName>
        <auth:Description>OpenID 2.0 identifier issued by external identity provider</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/claims/groups.link" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>GroupsOverageClaim</auth:DisplayName>
        <auth:Description>Issued when number of user's group claims exceeds return limit</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>Role Claim</auth:DisplayName>
        <auth:Description>Roles that the user or Service Principal is attached to</auth:Description>
    </auth:ClaimType>
    <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/wids" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
        <auth:DisplayName>RoleTemplate Id Claim</auth:DisplayName>
        <auth:Description>Role template id of the Built-in Directory Roles that the user is a member of</auth:Description>
    </auth:ClaimType>
</fed:ClaimTypesOffered>

我没有看到我要去哪里错了。一个有趣的花絮......目前第一个运行在给定名称上的 ClaimsTransformation。但是，如果我将第一个更改为以姓氏运行，则声明说声明转换缺少声明 surname。我怎样才能让索赔像他们应该的那样通过？

【问题讨论】：

标签： azure-ad-b2c azure-application-insights

【解决方案1】：

该映射已在声明中定义：

<ClaimType Id="displayName">
                <DisplayName>Display Name</DisplayName>
                <DataType>string</DataType>
                <DefaultPartnerClaimTypes>
                    <Protocol Name="OAuth2" PartnerClaimType="unique_name"/>
                    <Protocol Name="OpenIdConnect" PartnerClaimType="name"/>
                    <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"/>
                </DefaultPartnerClaimTypes>
                <UserHelpText>Your display name.</UserHelpText>
                <UserInputType>TextBox</UserInputType>
            </ClaimType>

我没有任何类型的映射：

<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />

此外，在 RP 中：

<Protocol Name="SAML2"/>

在用户旅程中：

<!-- SAML issuer technical profile -->
                <OrchestrationStep Order="12" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer"/>

【讨论】：

好的，有几件事。更改 RP 协议并在基本策略中添加用户旅程不会解决此问题，因为即使 IdP 使用 SAML2，我们发送数据的应用程序也使用 OpenIdConnect。值得一提的是，我们也有针对不同租户的确切方案。关于前 2 个 cmets，基本策略中有 100% 的 ClaimType，Id 为 givenName，在客户端的元数据中有相应的映射，所以我不确定你说没有的时候是什么意思givenName 的映射。

【解决方案2】：

这需要 Microsoft 支持，但他们的解决方法是更改 OutputClaims 以使用 PartnerClaimType 的简写版本。因此该部分应如下所示：

<OutputClaims>
    <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="assertionSubjectName" />
    <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="givenname" />
    <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="surname" />
    <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="emailaddress" />
    <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="Meijburg.com" />
</OutputClaims>

他们声称，一般来说，您可以用简写替换 PartnerClaimType 中的完整 uri，但这在其他实现中不起作用，所以我认为这是一次性修复。

【讨论】：