使用社交登录进行身份验证后，Azure AD B2C 跳过登录页面

Question

我已使用支持两个身份提供商的自定义策略设置了 Azure AD B2C:

1. 本地帐户(电子邮件登录名)
2. Azure AD

这意味着在登录页面中，用户可以选择使用本地帐户登录或单击 Azure AD 登录按钮。

假设我有 2 个使用此 B2C 登录的门户，门户 A 和门户 B。我现在遇到的问题是，当用户转到门户 A 并选择 Azure AD 登录时，他们将能够正常登录。但是，当用户转到门户 B 时，他们不会立即登录到门户，而是会看到 B2C 登录页面，并且必须再次单击 Azure AD 登录按钮。我在这里错过了什么吗？用户是否可以跳过登录页面，因为他之前选择了 Azure AD 登录( token / session 超时前几分钟)？

我所做的是根据入门包示例配置自定义策略。如果有帮助，请参阅此登录用户旅程的摘录:

<UserJourney Id="SignInOrSignUp">
  <OrchestrationSteps>   
    <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
      <ClaimsProviderSelections>
        <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
        <ClaimsProviderSelection TargetClaimsExchangeId="AzureAdTenantExchange" />
      </ClaimsProviderSelections>
      <ClaimsExchanges>
        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
        <ClaimsExchange Id="AzureAdTenantExchange" TechnicalProfileReferenceId="login-AzureAD" />
      </ClaimsExchanges>
    </OrchestrationStep>
     <OrchestrationStep Order="3" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>authenticationSource</Value>
          <Value>localAccountAuthentication</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <!--<ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />-->
        <ClaimsExchange Id="SelfAsserted-Social-NoInput" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="5" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>authenticationSource</Value>
          <Value>AzureADAuthentication</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />    
  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

-- 2018 年 7 月 22 日更新 --这是login-AzureAD包含敏感信息的技术简介<renamed> :

<TechnicalProfile Id="login-AzureAD">
      <DisplayName>Azure AD Login</DisplayName>
      <Description>Login with your <renamed></Description>
      <Protocol Name="OpenIdConnect"/>
      <OutputTokenFormat>JWT</OutputTokenFormat>
      <Metadata>
        <Item Key="METADATA">https://login.windows.net/<renamed>.onmicrosoft.com/.well-known/openid-configuration</Item>
        <Item Key="ProviderName">https://sts.windows.net/<renamed>/</Item>
        <Item Key="client_id">c5ca1fc8-05ad-4be4-b7b1-77de430e1099</Item>
        <Item Key="IdTokenAudience">c5ca1fc8-05ad-4be4-b7b1-77de430e1099</Item>
        <Item Key="response_types">id_token</Item>
        <Item Key="UsePolicyInRedirectUri">false</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_<renamed>"/>
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="oid"/>
        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
        <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="AzureADAuthentication" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="<renamed>" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email"/>
        <OutputClaim ClaimTypeReferenceId="groups" PartnerClaimType="groups"/>
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/>
    </TechnicalProfile>

感谢 @Chris Padgett 的更新请求，我注意到了错误，即引用的 session 技术配置文件 SM-Noop 。当我更改为 SM-SocialLogin 后(基于其他人的样本)，它现在似乎正在工作。仅供引用，技术配置文件是按照 Microsoft here 的指南创建的。 .

@Chris Padgett，这是您要找的吗？如果这是正确的并接受它作为答案，我将不胜感激。也可能对其他人有帮助。

Answer 1

login-AzureAD 技术配置文件的 UseTechnicalProfileForSessionManagement 元素必须引用 SM-SocialLogin SSO session 提供程序才能抑制身份提供商选择步骤:

<TechnicalProfile Id="login-AzureAD">
  ...
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin"/>
</TechnicalProfile>

这不会绕过经过身份验证的用户与外部身份提供商可能保持的 SSO session 。它只记住该用户可能与该身份提供商举行 SSO session 。

参见the "Azure AD B2C: Single sign-on (SSO) session management" article有关 SSO session 提供程序的信息。