资源所有者密码凭据流-修改声明

Question

资源所有者密码凭据流现在在Azure B2C的预览中可用：

https://docs.microsoft.com/en-us/azure/active-directory-b2c/configure-ropc

然而，我想修改一下声明（具体来说：将用户名作为“email”声明）。我试着用文档中的流在IEF中调用我现有的自定义策略，但他们不喜欢这样（令人惊讶）

AADB2C：发生异常。

有没有办法影响这个流程中的索赔？

实现Chris的答案时更新我遇到了以下错误：

无法上载策略。原因：验证失败：在租户“xxx.onmicrosoft.com”的策略“B2C\u 1A\u ROPC”中发现1个验证错误。索赔类型“email”是依赖方技术配置文件的输出索赔，但它不是用户旅程“SignIn ROPC”的任何步骤中的输出索赔。

我发布了一个实验解决方案作为单独的答案。

Answer 1

这是我使用Chris有用的答案制定的完整政策。我认为它是实验性的，因为我不完全理解索赔流程，但它运行得很好。

<ClaimsProviders>
    <ClaimsProvider>
        <DisplayName>Override some profiles</DisplayName>
        <TechnicalProfiles>
            <TechnicalProfile Id="login-NonInteractive">
                <DisplayName>Local Account SignIn</DisplayName>
                <Protocol Name="OpenIdConnect" />
                <InputClaims>
                    <InputClaim ClaimTypeReferenceId="signInName" 
                        PartnerClaimType="username" 
                        Required="true" 
                        DefaultValue="{OIDC:Username}" />
                    <InputClaim ClaimTypeReferenceId="password" 
                        Required="true" 
                        DefaultValue="{OIDC:Password}" />
                </InputClaims>
            </TechnicalProfile>
            <TechnicalProfile Id="AAD-UserReadUsingObjectId">
                <OutputClaims>
                    <!-- This user journey does not have any other step that provides this -->
                    <OutputClaim ClaimTypeReferenceId="signInName" />
                </OutputClaims>
            </TechnicalProfile>
        </TechnicalProfiles>
    </ClaimsProvider>
</ClaimsProviders>
<UserJourneys>
    <UserJourney Id="SignIn-ROPC">
        <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
        <OrchestrationSteps>
            <OrchestrationStep Order="1" 
                Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="LoginNonInteractiveExchange" 
                        TechnicalProfileReferenceId="login-NonInteractive" />
                </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" 
                Type="ClaimsExchange">
                <ClaimsExchanges>
                    <ClaimsExchange Id="AADUserReadWithObjectId" 
                        TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
                </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" 
                Type="SendClaims" 
                CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
        </OrchestrationSteps>
    </UserJourney>
</UserJourneys>
<RelyingParty>
    <DefaultUserJourney ReferenceId="SignIn-ROPC" />
    <TechnicalProfile Id="PolicyProfile">
        <DisplayName>PolicyProfile</DisplayName>
        <Protocol Name="OpenIdConnect" />
        <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" 
                PartnerClaimType="sub"/>
            <!-- This works for accounts that were created via the azure portal -->
            <OutputClaim ClaimTypeReferenceId="signInName" 
                PartnerClaimType="email" />
            <!-- This works for accounts that signed up themselves -->
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" 
                PartnerClaimType="email" />
        </OutputClaims>
        <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
</RelyingParty>

Answer 2

您必须在自定义策略中实现ROPC流，以便在ID令牌中发出“电子邮件”声明。

要在自定义策略中实现ROPC流，请执行以下操作：

1： 将DefaultValue属性添加到每个“signInName”和“password”

<TechnicalProfile Id="login-NonInteractive">
  <DisplayName>Local Account SignIn</DisplayName>
  <Protocol Name="OpenIdConnect" />
  ...
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" DefaultValue="{OIDC:Username}" />
    <InputClaim ClaimTypeReferenceId="password" Required="true" DefaultValue="{OIDC:Password}" />
    ...
  </InputClaims>
  ...
</TechnicalProfile>

2： 创建“ROPC”用户旅程：

<UserJourney Id="SignIn-ROPC">
  <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
  <OrchestrationSteps>
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="LoginNonInteractiveExchange" TechnicalProfileReferenceId="login-NonInteractive" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
</UserJourney>

3： 创建“ROPC”依赖方技术档案：

<RelyingParty>
  <DefaultUserJourney ReferenceId="SignIn-ROPC" />
  <TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="OpenIdConnect" />
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
      <OutputClaim ClaimTypeReferenceId="email" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
  </TechnicalProfile>
</RelyingParty>