Azure AD B2C自定义策略：邀请注册页需同时显示本地及社交账号选项

问题核心 #

合并Account Linkage Unified示例后，本地注册表单消失；添加本地账号选项时提示找不到SignUpFromEmailInviteExchange；需同时展示本地+社交注册选项，且仅允许通过有效邀请令牌完成注册，无登录入口。

具体修复步骤 #

1. 补全本地账号的ClaimsExchange定义 #

在自定义策略的<ClaimsProviders>节点下，确认本地账号的ClaimsProvider包含对应技术配置，并定义SignUpFromEmailInviteExchange：

<ClaimsProvider>
  <DisplayName>Local Account</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="LocalAccountSignUpWithEmailInvite">
      <DisplayName>Email signup</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
        <Item Key="UserMessageIfClaimsPrincipalAlreadyExists">You already have an account, please sign in.</Item>
      </Metadata>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="email" DefaultValue="{OAUTH-KV:invitedEmail}" />
        <InputClaim ClaimTypeReferenceId="inviteToken" DefaultValue="{OAUTH-KV:inviteToken}" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="email" />
        <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
        <OutputClaim ClaimTypeReferenceId="displayName" Required="true" />
        <OutputClaim ClaimTypeReferenceId="inviteToken" />
        <OutputClaim ClaimTypeReferenceId="extension_InviteId" />
      </OutputClaims>
      <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingEmailInvite" />
        <ValidationTechnicalProfile ReferenceId="ValidateInviteToken" />
      </ValidationTechnicalProfiles>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

<!-- 在对应的ClaimsExchanges节点中添加 -->
<ClaimsExchange Id="SignUpFromEmailInviteExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithEmailInvite" />

2. 修改UserJourney，同时加载本地+社交注册选项 #

调整UserJourney的OrchestrationStep，添加本地和社交账号的ClaimsProviderSelection，确保注册页同时展示两种选项：

<UserJourney Id="SignUpWithEmailInvite">
  <OrchestrationSteps>
    <!-- 步骤1：强制验证邀请令牌有效性 -->
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="ValidateInviteTokenExchange" TechnicalProfileReferenceId="ValidateInviteToken" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 步骤2：显示本地+社交注册选项 -->
    <OrchestrationStep Order="2" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
      <ClaimsProviderSelections>
        <ClaimsProviderSelection TargetClaimsExchangeId="SignUpFromEmailInviteExchange" />
        <ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
        <ClaimsProviderSelection TargetClaimsExchangeId="MicrosoftExchange" />
      </ClaimsProviderSelections>
    </OrchestrationStep>
    <!-- 步骤3：处理选中的注册方式 -->
    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="SignUpFromEmailInviteExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithEmailInvite" />
        <ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" />
        <ClaimsExchange Id="MicrosoftExchange" TechnicalProfileReferenceId="MSA-OAUTH" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 步骤4：社交账号用户创建/链接 -->
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserWriteUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 步骤5：颁发注册令牌 -->
    <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

3. 锁定仅邀请注册逻辑 #

• 移除所有登录相关的ClaimsProviderSelection（如LocalAccountSigninEmailExchange），确保流程无登录入口。
• 强化邀请令牌验证的TechnicalProfile，强制携带有效令牌才能进入注册流程：

<TechnicalProfile Id="ValidateInviteToken">
  <DisplayName>Validate Invite Token</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ServiceUrl">https://your-invite-service.com/api/validate-token</Item>
    <Item Key="AuthenticationType">None</Item>
    <Item Key="SendClaimsIn">Body</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="inviteToken" Required="true" />
    <InputClaim ClaimTypeReferenceId="email" Required="true" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="extension_InviteId" />
    <OutputClaim ClaimTypeReferenceId="invitedRole" />
  </OutputClaims>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

排查要点 #

• 核对所有<ClaimsExchange>的Id是否在UserJourney中存在对应定义
• 确认本地账号TechnicalProfile的Id与ClaimsExchange引用的Id完全一致
• 根据策略上传错误提示，定位到具体未定义的节点进行补全

内容的提问来源于stack exchange，提问作者Josh