Azure B2C Verification Display Control出现UX014错误求助

配置Azure AD B2C的Verification Control作为MFA流程的邮箱验证方式（替代认证器应用）时，SendCode成功发送验证码后页面显示"Bad Request"，控制台报错：

code: UX014
diags: {"pageViewId":"6a176deb-72e6-4d71-bbc6-90490a6c1121","pageId":"SelfAsserted","trace":[],"truncated":true,"code":"UX014"}
p: B2C_1A_v1_sign_in_mfa
desc: Failed to send control action request

已移除自定义UserBackend-SendOtpEmail步骤，但错误依旧，推测问题出在SendCode到VerifyCode的流程跳转环节。

相关配置代码 #

验证显示控件配置

<DisplayControl Id="emailVerificationControlMFA" UserInterfaceControlType="VerificationControl">
  <DisplayClaims>
    <DisplayClaim ClaimTypeReferenceId="verificationCode" ControlClaimType="VerificationCode" Required="true" />
  </DisplayClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="email" />
  </OutputClaims>
  <Actions>
    <Action Id="SendCode">
      <ValidationClaimsExchange>
        <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="MFAEmail-GenerateOtp" />
      </ValidationClaimsExchange>
    </Action>
    <Action Id="VerifyCode">
      <ValidationClaimsExchange>
        <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="MFAEmail-VerifyOtp" />
      </ValidationClaimsExchange>
    </Action>
  </Actions>
</DisplayControl>

MFAEmail-GenerateOtp技术配置

<TechnicalProfile Id="MFAEmail-GenerateOtp">
  <DisplayName>Generate one time password</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.OneTimePasswordProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="Operation">GenerateCode</Item>
    <Item Key="CodeExpirationInSeconds">600</Item>
    <Item Key="CodeLength">6</Item>
    <Item Key="CharacterSet">0-9</Item>
    <Item Key="NumRetryAttempts">5</Item>
    <Item Key="NumCodeGenerationAttempts">10</Item>
    <Item Key="ReuseSameCode">false</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="identifier" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="otpEmail" PartnerClaimType="otpGenerated" />
  </OutputClaims>
</TechnicalProfile>

MFAEmail-VerifyOtp技术配置

<TechnicalProfile Id="MFAEmail-VerifyOtp">
  <DisplayName>Verify one time password</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.OneTimePasswordProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="Operation">VerifyCode</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="identifier" />
    <InputClaim ClaimTypeReferenceId="verificationCode" PartnerClaimType="otpToVerify" />
  </InputClaims>
</TechnicalProfile>

引用显示控件的技术配置

<TechnicalProfile Id="EmailOTPVerification">
   <DisplayName>Email MFA Verification</DisplayName>
   <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
   <Metadata>
     <Item Key="ContentDefinitionReferenceId">api.email.mfa.verification</Item>
   </Metadata>
   <CryptographicKeys>
     <Key Id="<key_id>" StorageReferenceId="<reference_id>" />
   </CryptographicKeys>
   <DisplayClaims>
     <DisplayClaim DisplayControlReferenceId="emailVerificationControlMFA" />
   </DisplayClaims>
   <UseTechnicalProfileForSessionManagement ReferenceId="MFA-TOTP-SessionManager" />
 </TechnicalProfile>

1. 移除DisplayControl中多余的OutputClaims #

Verification Control不需要显式声明email作为OutputClaim（GenerateOtp已通过InputClaims获取该值），移除OutputClaims节点：

<DisplayControl Id="emailVerificationControlMFA" UserInterfaceControlType="VerificationControl">
  <DisplayClaims>
    <DisplayClaim ClaimTypeReferenceId="verificationCode" ControlClaimType="VerificationCode" Required="true" />
  </DisplayClaims>
  <Actions>
    <Action Id="SendCode">
      <ValidationClaimsExchange>
        <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="MFAEmail-GenerateOtp" />
      </ValidationClaimsExchange>
    </Action>
    <Action Id="VerifyCode">
      <ValidationClaimsExchange>
        <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="MFAEmail-VerifyOtp" />
      </ValidationClaimsExchange>
    </Action>
  </Actions>
</DisplayControl>

2. 确认OTP相关ClaimType已定义 #

检查TrustFrameworkExtensions.xml，确保verificationCode和otpEmail的ClaimType存在：

<ClaimType Id="verificationCode">
  <DisplayName>Verification Code</DisplayName>
  <DataType>string</DataType>
  <UserHelpText>Enter the verification code sent to your email.</UserHelpText>
  <UserInputType>TextBox</UserInputType>
</ClaimType>

<ClaimType Id="otpEmail">
  <DisplayName>One Time Password</DisplayName>
  <DataType>string</DataType>
  <AdminHelpText>Stores the one-time password generated for email verification.</AdminHelpText>
</ClaimType>

3. 替换不匹配的Session Management配置 #

MFA-TOTP-SessionManager是针对TOTP认证器的会话管理，换成通用的SM配置：

<UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />

4. 验证ContentDefinition配置 #

确认api.email.mfa.verification对应的ContentDefinition指向正确的页面模板：

<ContentDefinition Id="api.email.mfa.verification">
  <LoadUri>~/tenant/templates/AzureBlue/selfAsserted.cshtml</LoadUri>
  <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
  <DataUri>urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0</DataUri>
  <Metadata>
    <Item Key="DisplayName">Email MFA Verification</Item>
  </Metadata>
</ContentDefinition>

内容的提问来源于stack exchange，提问作者hungrybrad