asp.net - 如何在 Azure B2C 用户流中添加更多范围？

Question

我在 Azure B2C 中配置了用户流。

当我检查 .well-known/openid-configuration 时，scopes_supported 中只有“openid”。

我可以添加其他范围，例如配置文件或offline_access吗？

{
  "issuer": "https://***.b2clogin.com/tfp/********-ad73-4362-a92f-302dc508e063/b2c_1_***/v2.0/",
  "authorization_endpoint": "https://***.b2clogin.com/***.onmicrosoft.com/b2c_1_***/oauth2/v2.0/authorize",
  "token_endpoint": "https://***.b2clogin.com/***.onmicrosoft.com/b2c_1_***/oauth2/v2.0/token",
  "end_session_endpoint": "https://***.b2clogin.com/***.onmicrosoft.com/b2c_1_***/oauth2/v2.0/logout",
  "jwks_uri": "https://***.b2clogin.com/***.onmicrosoft.com/b2c_1_***/discovery/v2.0/keys",
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "response_types_supported": [
    "code",
    "code id_token",
    "code token",
    "code id_token token",
    "id_token",
    "id_token token",
    "token",
    "token id_token"
  ],
  "scopes_supported": [
    "openid"
  ],
  "subject_types_supported": [
    "pairwise"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "claims_supported": [
    "idp",
    "oid",
    "sub",
    "emails",
    "name",
    "newUser",
    "idp_access_token",
    "tfp",
    "iss",
    "iat",
    "exp",
    "aud",
    "acr",
    "nonce",
    "auth_time"
  ]
}

我的主要问题是无法获取用户信息。不确定这是否与缺少配置文件范围有关。

Answer 1

Note that: Azure AD B2C Application only supports openid and offline_access delegated permissions only. Hence, it's not possible to add extra scopes to the Application.

我创建了一个 Azure AD B2C 应用程序并添加了 API 权限，如下所示:

我创建了一个注册并登录用户流程并添加了应用程序声明:

Based on the requirement, you can select the Application claims.

我运行用户流程并登录，如下所示:

使用用户信息成功生成 ID token :