I'm trying to create a custom policy to support a migration scenario in which an app uses ROPC as authentication flow.
The journey should work as following:

我正在尝试创建一个自定义策略来支持应用程序使用ROPC作为身份验证流的迁移场景。该旅程应按如下方式工作：

• Get the username from the ROPC request


• Check if the user has to be migrated


• If no
  
  
  
  • Validate the password against the local B2C
  
  
  
  


• If yes
  
  
  
  • Validate the user on the remote B2C
  
  
  • Copy the password in the local B2C
  
  
  • Flag the user as migrated
  
  
  
  

The flow works as expected if I use a standard Sign-in flow. When I try to adapt it for the ROPC Oauth flow (converting all the validationTechnicalProfiles in a user journey, as stated in Azure AD B2C Custom Policy with Username Logon), the flow simply refuses to start if the first orchestration step does not refer to the "ResourceOwnerPasswordCredentials-OAUTH2" (which is not what I want, since before authenticating the user I need to check if it has to be migrated). From the appinsights log, the flow fails with the message:

如果我使用标准登录流程，流程将按预期工作。当我尝试使其适应ROPC OAuth流(如Azure AD B2C Custom Policy with Username Logon中所述，转换用户旅程中的所有validationTechnicalProfiles)时，如果第一个编排步骤不引用“ResourceOwnerPasswordCredentials-OAuth2”(这不是我想要的，因为在对用户进行身份验证之前，我需要检查它是否必须迁移)，流程就会拒绝启动。在appinsights日志中，流失败，并显示以下消息：

{
  "Kind": "Action",
  "Content": "Web.TPEngine.StateMachineHandlers.MoveFirstOrchestrationStepHandler"
},
{
  "Kind": "HandlerResult",
  "Content": {
    "Result": true,
    "Statebag": {
      "ORCH_CS": {
        "c": "2023-09-10T10:16:25.7263383Z",
        "k": "ORCH_CS",
        "v": "1",
        "p": true
      }
    }
  }
},
{
  "Kind": "Action",
  "Content": "Web.TPEngine.StateMachineHandlers.InvokeValidationProfileDirectHandler"
},
{
  "Kind": "FatalException",
  "Content": {
    "Time": "10:16 AM",
    "Exception": {
      "Kind": "Handled",
      "HResult": "80004001",
      "Message": "The method or operation is not implemented.",
      "Data": {}
    }
  }
}

I've defined a test Claim provider that is:

我已经定义了一个测试索赔提供程序，它是：

<ClaimsProvider>
  <DisplayName>Claim Transformation</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="ClaimTransformation-ExtractUsername">
      <DisplayName>Extract user name</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
      </Metadata>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="extension_Dev_ToBeMigrated" DefaultValue="true" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="extension_Dev_SourceB2CTenant" DefaultValue="{OIDC:Username}" AlwaysUseDefaultValue="true" />
      </OutputClaims>
    </TechnicalProfile>
  </TechnicalProfiles>  
</ClaimsProvider>

this user journey fails with the previous error:

此用户旅程失败，并显示前面的错误：

<UserJourney Id="ResourceOwnerPasswordCredentials">
  <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
  <OrchestrationSteps>

    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="CheckUserToBeMigrated" TechnicalProfileReferenceId="ClaimTransformation-ExtractUsername" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="ResourceOwnerFlow" TechnicalProfileReferenceId="ResourceOwnerPasswordCredentials-OAUTH2" />
      </ClaimsExchanges>
    </OrchestrationStep> 
    
    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
</UserJourney>

this one returns a token instead

此命令返回一个令牌

<UserJourney Id="ResourceOwnerPasswordCredentials">
  <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
  <OrchestrationSteps>


    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="ResourceOwnerFlow" TechnicalProfileReferenceId="ResourceOwnerPasswordCredentials-OAUTH2" />
      </ClaimsExchanges>
    </OrchestrationStep> 
    
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="CheckUserToBeMigrated" TechnicalProfileReferenceId="ClaimTransformation-ExtractUsername" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
</UserJourney>

Do you have any working example of an ROPC policy that do some prechecks before authenticating against the local B2C? Or do you know how to solve the error I'm facing right now?

您有没有ROPC策略在针对本地B2C进行身份验证之前执行一些预检查的有效示例？或者你知道如何解决我现在面临的错误吗？