电子邮件地址自动填充在 Azure B2C 自定义策略中不起作用并禁用更改电子邮件选项答案

【问题标题】：Email Address Auto Populate not working in Azure B2C Custom Policy and disable change email option电子邮件地址自动填充在 Azure B2C 自定义策略中不起作用并禁用更改电子邮件选项
【发布时间】：2019-02-28 11:35:31
【问题描述】：

从Populate the email address text box in Azure AD B2C Orchestration 继续，出了点问题。邮箱没有填充，我遗漏了一些东西。想法是使用电子邮件 OTP 验证登录，然后让 MFA 更改/添加手机号码

用户旅程

            <UserJourney Id="TestEmailOTP">
        <OrchestrationSteps>   
            <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
                <ClaimsProviderSelections>
                    <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
                </ClaimsProviderSelections>
            </OrchestrationStep>   
            <OrchestrationStep Order="2" Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
                </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
                </ClaimsExchanges>
            </OrchestrationStep>    
            <OrchestrationStep Order="4" Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="VerifyWithEmailOTP" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddressEmailOTP" />
                </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="5" Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="NewPhoneFactor" TechnicalProfileReferenceId="PhoneFactor-EditAndVerify" />
                </ClaimsExchanges>
            </OrchestrationStep>   
            <OrchestrationStep Order="6" Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="AADUserWriteWithObjectId" TechnicalProfileReferenceId="AAD-UserWritePhoneNumberUsingObjectId" />
                </ClaimsExchanges>
            </OrchestrationStep>   
            <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
        </OrchestrationSteps>
        <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>

技术简介

    <TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddressEmailOTP">
      <DisplayName>Reset password using email address</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
        <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
      </CryptographicKeys>
      <IncludeInSso>false</IncludeInSso>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="readonlyEmail" />
        <OutputClaim ClaimTypeReferenceId="objectId" />
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" />
      </OutputClaims>
      <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />
        <ValidationTechnicalProfile ReferenceId="SelfAsserted-LocalAccount-EmailVerification" />
      </ValidationTechnicalProfiles>
    </TechnicalProfile>

AAD-UserReadUsingEmailAddress

        <TechnicalProfile Id="AAD-UserReadUsingEmailAddress">
          <Metadata>
            <Item Key="Operation">Read</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
            <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An account could not be found for the provided user ID.</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames" Required="true" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
             <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="displayName" />
            <OutputClaim ClaimTypeReferenceId="otherMails" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />

          </OutputClaims>
           <IncludeTechnicalProfile ReferenceId="AAD-Common" />
        </TechnicalProfile>

“SelfAsserted-LocalAccount-EmailVerification”的其余部分与之前的帖子和声明等相同。

<TechnicalProfile Id="SelfAsserted-LocalAccount-EmailVerification">
  <DisplayName>Local Account Email Address Verification</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ContentDefinitionReferenceId">api.localaccount.emailverification</Item>
    <Item Key="EnforceEmailVerification">true</Item>
  </Metadata>
  <InputClaimsTransformations>
    <InputClaimsTransformation ReferenceId="CreateReadonlyEmailClaim" />
  </InputClaimsTransformations>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="readonlyEmail" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="readonlyEmail" PartnerClaimType="verified.email" Required="true" />
  </OutputClaims>
</TechnicalProfile>

CreateReadonlyEmailClaim 声明转换定义为：

<ClaimsTransformation Id="CreateReadonlyEmailClaim" TransformationMethod="FormatStringClaim">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" TransformationClaimType="inputClaim" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="stringFormat" DataType="string" Value="{0}" />
  </InputParameters>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="readonlyEmail" TransformationClaimType="outputClaim" />
  </OutputClaims>
</ClaimsTransformation>

readonlyEmail 声明类型声明为：

<ClaimType Id="readonlyEmail">
  <DisplayName>E-mail Address</DisplayName>
  <DataType>string</DataType>
  <UserInputType>Readonly</UserInputType>
</ClaimType>

我在这里错过了什么？

我也试过了，但登录后出现 500 错误

<TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddressEmailOTP">
    <DisplayName>Reset password using email address</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
        <Item Key="ContentDefinitionReferenceId">api.localaccountpasswordreset</Item>
    </Metadata>
    <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
    </CryptographicKeys>
    <IncludeInSso>false</IncludeInSso>
    <InputClaimsTransformations>
        <InputClaimsTransformation ReferenceId="CreateReadonlyEmailClaim" />
    </InputClaimsTransformations>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="readonlyEmail" />
    </InputClaims>
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="readonlyEmail" PartnerClaimType="verified.email" Required="true" />
        <OutputClaim ClaimTypeReferenceId="objectId" />
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" />
    </OutputClaims>
    <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddressEmailOTP" />
    </ValidationTechnicalProfiles>
</TechnicalProfile>

此外，一旦验证了电子邮件，就会有一个更改电子邮件选项 - 我们希望禁用或更好 - 将其删除，以便他们在验证后无法执行此操作并移至下一步

【问题讨论】：

我知道这应该是一个输入声明，但如果我将 SelfAsserted-LocalAccount-EmailVerification 与 IncludeTechnicalProfile 中的一样放入 LocalAccountDiscoveryUsingEmailAddressEmailOTP - 会给出 500 错误。所以不知道如何在那里调用该技术配置文件，然后我想我们将 readonlyEmail 作为 inputprofile ??
您好 @Chris T。对于 LocalAccountDiscoveryUsingEmailAddressEmailOTP 技术配置文件，您必须同时包含 <InputClaimsTransformations /> 和 <InputClaims />。也可以复制粘贴上面问题中的readonlyEmail声明类型声明吗？
@ChrisPadgett 我已经用所有 xml 代码更新了问题。在 LocalAccountDiscoveryUsingEmailAddressEmailOTP 中我到底需要做什么以及在上面的代码中需要改变什么？？
@ChrisPadgett 尝试了各种组合，但显然这里缺少我没有看到的链接...
嗨@Chris T。这可能是由缺少email 声明引起的。 AAD-UserReadUsingObjectId TP 返回signInNames.emailAddress 的输出声明，而不是email，因此CreateReadonlyEmailClaim 声明转换应该引用signInNames.emailAddress 的输入声明，而不是email。

标签： azure-ad-b2c

【解决方案1】：

根据@ChrisPadgett 评论 - AAD-UserReadUsingObjectId TP 返回 signInNames.emailAddress 的输出声明，而不是电子邮件，因此 CreateReadonlyEmailClaim 声明转换应引用 signInNames.emailAddress 的输入声明，而不是电子邮件。

通过更改转换来修复。

【讨论】：