基于用户名的本地帐户的自定义B2C政策

Question

如何在custom policy starter pack中更改我的登录/单行政策username based not email based？

Answer 1

加入此技术配置文件TrustFrameworkExtensions.xml写用户Azure的AD

<TechnicalProfile Id="AAD-UserWriteUsingLogonName"> 
    <Metadata> 
     <Item Key="Operation">Write</Item> 
     <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item> 
    </Metadata> 
    <InputClaims> 
     <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.userName" Required="true" /> 
    </InputClaims> 
    <PersistedClaims> 
     <PersistedClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.userName" /> 
     <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="strongAuthenticationEmailAddress" /> 
     <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" /> 
     <PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="SomeDefaultDisplayNameValue" /> 
    </PersistedClaims> 
    <OutputClaims> 
     <OutputClaim ClaimTypeReferenceId="objectId" /> 
     <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" /> 
     <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" /> 
     <OutputClaim ClaimTypeReferenceId="userPrincipalName" /> 
    </OutputClaims> 
    <IncludeTechnicalProfile ReferenceId="AAD-Common" /> 
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" /> 
</TechnicalProfile> 

---

这种技术简介加入TrustFrameworkExtensions.xml由用户出行调用。这里的关键变化是<Item Key="LocalAccountType">Username</Item>和<Item Key="LocalAccountProfile">true</Item>

<TechnicalProfile Id="LocalAccountSignUpWithLogonName"> 
    <DisplayName>User ID signup</DisplayName> 
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /> 
    <Metadata> 
     <Item Key="IpAddressClaimReferenceId">IpAddress</Item> 
     <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item> 
     <Item Key="LocalAccountType">Username</Item> 
     <Item Key="LocalAccountProfile">true</Item> 
     <Item Key="language.button_continue">Create</Item> 
    </Metadata> 
    <CryptographicKeys> 
     <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /> 
    </CryptographicKeys> 
    <InputClaims> 
     <InputClaim ClaimTypeReferenceId="signInName" /> 
    </InputClaims> 
    <OutputClaims> 
     <OutputClaim ClaimTypeReferenceId="objectId" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="signInName" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="email" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" /> 
     <OutputClaim ClaimTypeReferenceId="newUser" /> 
     <OutputClaim ClaimTypeReferenceId="authenticationSource" /> 
     <OutputClaim ClaimTypeReferenceId="userPrincipalName" /> 
    </OutputClaims> 
    <ValidationTechnicalProfiles> 
     <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonName" /> 
    </ValidationTechnicalProfiles> 
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" /> 
</TechnicalProfile> 

SIGIN技术档案参考

<TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Username"> 
    <DisplayName>Local Account Signin</DisplayName> 
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /> 
    <Metadata> 
     <Item Key="SignUpTarget">SignUpWithLogonUsernameExchange</Item> 
     <Item Key="setting.operatingMode">Username</Item> 
     <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item> 
    </Metadata> 
    <IncludeInSso>false</IncludeInSso> 
    <InputClaims> 
     <InputClaim ClaimTypeReferenceId="signInName" /> 
    </InputClaims> 
    <OutputClaims> 
     <OutputClaim ClaimTypeReferenceId="signInName" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="password" Required="true" /> 
     <OutputClaim ClaimTypeReferenceId="objectId" /> 
     <OutputClaim ClaimTypeReferenceId="authenticationSource" /> 
    </OutputClaims> 
    <ValidationTechnicalProfiles> 
     <ValidationTechnicalProfile ReferenceId="login-NonInteractive" /> 
    </ValidationTechnicalProfiles> 
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" /> 
</TechnicalProfile> 

---

该用户的旅程添加到TrustFrameworkExtensions.xml

<UserJourney Id="SignUpOrSignIn"> 
    <OrchestrationSteps> 
     <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin"> 
      <ClaimsProviderSelections> 
       <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" /> 
      </ClaimsProviderSelections> 
      <ClaimsExchanges> 
       <ClaimsExchange Id="LocalAccountSigninUsernameExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Username" /> 
      </ClaimsExchanges> 
     </OrchestrationStep> 
     <OrchestrationStep Order="2" Type="ClaimsExchange"> 
      <Preconditions> 
       <Precondition Type="ClaimsExist" ExecuteActionsIf="true"> 
        <Value>objectId</Value> 
        <Action>SkipThisOrchestrationStep</Action> 
       </Precondition> 
      </Preconditions> 
      <ClaimsExchanges> 
       <ClaimsExchange Id="SignUpWithLogonUsernameExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonName" /> 
      </ClaimsExchanges> 
     </OrchestrationStep> 
     <!-- This step reads any user attributes that we may not have received when in the token. --> 
     <OrchestrationStep Order="3" Type="ClaimsExchange"> 
      <ClaimsExchanges> 
       <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" /> 
      </ClaimsExchanges> 
     </OrchestrationStep> 
     <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" /> 
    </OrchestrationSteps> 
    <ClientDefinition ReferenceId="DefaultWeb" /> 
</UserJourney> 

---

感谢Omer的帮助！