求含REST API修改的TrustFrameworkExtension代码：验证原IDP账户并创建Azure账户

核心逻辑 #

该示例实现用户完成原身份提供商（IDP）验证后，触发REST API调用，将用户信息同步到Azure AD目录并创建账户。

TrustFrameworkExtension 代码片段 #

<?xml version="1.0" encoding="utf-8"?>
<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="yourtenant.onmicrosoft.com" PolicyId="B2C_1A_TrustFrameworkExtensions" PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions">

  <BasePolicy>
    <TenantId>yourtenant.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkBase</PolicyId>
  </BasePolicy>

  <ClaimsProviders>
    <!-- 原身份提供商（示例为Google IDP） -->
    <ClaimsProvider>
      <Domain>google.com</Domain>
      <DisplayName>Google</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="Google-OAUTH">
          <DisplayName>Google</DisplayName>
          <Protocol Name="OAuth2" />
          <Metadata>
            <Item Key="ProviderName">google</Item>
            <Item Key="authorization_endpoint">https://accounts.google.com/o/oauth2/v2/auth</Item>
            <Item Key="AccessTokenEndpoint">https://www.googleapis.com/oauth2/v4/token</Item>
            <Item Key="ClaimsEndpoint">https://www.googleapis.com/oauth2/v3/userinfo</Item>
            <Item Key="scope">email profile openid</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="UsePolicyInRedirectUri">false</Item>
            <Item Key="client_id">your-google-client-id</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_GoogleClientSecret" />
          </CryptographicKeys>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
            <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
            <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="google.com" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
            <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
            <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
            <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
          </OutputClaimsTransformations>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

    <!-- REST API 集成：创建Azure AD账户 -->
    <ClaimsProvider>
      <DisplayName>REST API Providers</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="REST-CreateAzureADUser">
          <DisplayName>Create Azure AD User via REST API</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">https://your-api-endpoint.azurewebsites.net/api/createuser</Item>
            <Item Key="AuthenticationType">None</Item>
            <Item Key="SendClaimsIn">Body</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" />
            <InputClaim ClaimTypeReferenceId="givenName" />
            <InputClaim ClaimTypeReferenceId="surName" />
            <InputClaim ClaimTypeReferenceId="issuerUserId" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="azureAdObjectId" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>

  <UserJourneys>
    <UserJourney Id="SignUpOrSignIn">
      <OrchestrationSteps>
        <!-- 步骤1：选择身份提供商 -->
        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
          </ClaimsProviderSelections>
        </OrchestrationStep>

        <!-- 步骤2：执行原IDP验证 -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- 步骤3：调用REST API创建Azure AD账户 -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="REST-CreateUser" TechnicalProfileReferenceId="REST-CreateAzureADUser" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- 后续步骤：生成并返回令牌 -->
        <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
  </UserJourneys>
</TrustFrameworkPolicy>

关键修复点（解决REST API未触发原IDP调用问题） #

• 流程顺序强制验证：确保原IDP验证步骤（示例中Order=2）在REST API调用步骤（Order=3）之前，只有原IDP验证通过后才会触发API调用
• 声明映射检查：确认原IDP返回的核心声明（如email、issuerUserId）已正确配置为REST API的输入声明，保证用户信息能正确传递
• API端点有效性：验证REST API端点可正常接收POST请求，且内部逻辑能完成Azure AD账户创建操作
• 策略调试：使用Azure AD B2C内置调试工具，检查原IDP验证步骤是否成功返回声明，以及REST API调用的触发条件是否满足

内容的提问来源于stack exchange，提问作者mikey