azure - 资源所有者密码凭据流程 - 修改声明

Question

资源所有者密码凭据流程现已在 Azure B2C 预览版中推出:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-ropc

但是，我想修改这些声明(具体来说:将用户名获取为“电子邮件”声明)。我尝试使用文档中的流程调用 IEF 中现有的自定义策略，但他们不喜欢这样(毫不奇怪)

AADB2C: An exception has occurred.

有没有办法影响此流程中的声明？

更新在实现克里斯的回答时，我收到此错误:

Unable to upload policy. Reason : Validation failed: 1 validation error(s) found in policy "B2C_1A_ROPC" of tenant "xxx.onmicrosoft.com".Claim type "email" is the output claim of the relying party's technical profile, but it is not an output claim in any of the steps of user journey "SignIn-ROPC".

我发布了一个实验性解决方案作为单独的答案。

Answer 1

您必须在自定义策略中实现 ROPC 流程，才能在 ID token 中发出“电子邮件”声明。

要在自定义策略中实现 ROPC 流程:

1:添加DefaultValue每个“signInName”和“password”的属性<InputClaim /> login-NonInteractive 技术配置文件中的元素:

<TechnicalProfile Id="login-NonInteractive">
  <DisplayName>Local Account SignIn</DisplayName>
  <Protocol Name="OpenIdConnect" />
  ...
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" DefaultValue="{OIDC:Username}" />
    <InputClaim ClaimTypeReferenceId="password" Required="true" DefaultValue="{OIDC:Password}" />
    ...
  </InputClaims>
  ...
</TechnicalProfile>

2:创建“ROPC”用户旅程:

<UserJourney Id="SignIn-ROPC">
  <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
  <OrchestrationSteps>
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="LoginNonInteractiveExchange" TechnicalProfileReferenceId="login-NonInteractive" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
</UserJourney>

3:创建“ROPC”依赖方技术配置文件:

<RelyingParty>
  <DefaultUserJourney ReferenceId="SignIn-ROPC" />
  <TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="OpenIdConnect" />
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
      <OutputClaim ClaimTypeReferenceId="email" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
  </TechnicalProfile>
</RelyingParty>