Azure AD B2C发送声明时'sub'缺失错误排查（实际声明存在）

我正将AD租户作为联合身份提供者接入Azure AD B2C租户，在执行最终编排步骤<OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />发送声明时，收到错误：“{ourTenant}.onmicrosoft.com中的'B2C_1A_signup_signin'策略指定的主体声明'sub'在声明集合中缺失，异常类型：PolicyException”。但通过VSCode和Application Insights检查发现，'sub'声明实际存在于声明集合中。

注：仅步骤1、2、6会执行，步骤3-5用于本地登录。

用户旅程配置 #

<UserJourney Id="SignUpOrSignIn">
      <OrchestrationSteps>

         <!-- Check if staff or member -->

        <OrchestrationStep Order="1" Type="ClaimsExchange">
   
            <ClaimsExchanges>
                <ClaimsExchange Id="AccountTypeInputCollectorClaimsExchange" TechnicalProfileReferenceId="AccountTypeInputCollector"/>
            </ClaimsExchanges>
        </OrchestrationStep>

        <!-- HANDLE STAFF LOGIN-->
         
         <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
        <Value>accountType</Value>
        <Value>staff</Value>
        <Action>SkipThisOrchestrationStep</Action>
      </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SignUpWithLogonEmailExchange-Staff" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
             <ClaimsExchange Id="FederatedClaimsExchange" TechnicalProfileReferenceId="AAD-Company-OpenIdConnect" />

          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- HANDLE NON-STAFF LOGINS-->

        <OrchestrationStep Order="3" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
        <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
        <Value>accountType</Value>
        <Action>SkipThisOrchestrationStep</Action>
      </Precondition>
      <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
        <Value>accountType</Value>
        <Value>staff</Value>
        <Action>SkipThisOrchestrationStep</Action>
      </Precondition>
    </Preconditions>
          <ClaimsProviderSelections>
            <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
            <Value>accountType</Value>
            <Value>staff</Value>
            <Action>SkipThisOrchestrationStep</Action>
           </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
         
        <!-- This step reads any user attributes that we may not have received when in the token. -->
        <OrchestrationStep Order="5" Type="ClaimsExchange">
        <Preconditions>
         <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
            <Value>accountType</Value>
            <Value>staff</Value>
            <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>

技术配置文件 #

<ClaimsProvider>
  <Domain>Company</Domain>
  <DisplayName>Login using Staff_Test_AD</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="AAD-Company-OpenIdConnect">
      <DisplayName>Continue with Active Directory</DisplayName>
      <Description>Login with an account in the staff Active Directory</Description>
      <Protocol Name="OpenIdConnect"/>
      <Metadata>
        <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
        <Item Key="client_id">{Settings:ADFederatedTestApplicationId}</Item>
        <Item Key="response_types">code</Item>
        <Item Key="scope">openid profile</Item>
        <Item Key="response_mode">form_post</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="UsePolicyInRedirectUri">false</Item>
        <Item Key="DiscoverMetadataByTokenIssuer">true</Item>
        <!-- The key below allows you to specify each of the Azure AD tenants that can be used to sign in. Update the GUIDs below for each tenant. -->
        <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/{Settings:ADFederatedTenantId}</Item>
        <!-- The commented key below specifies that users from any tenant can sign-in. Uncomment if you would like anyone with an Azure AD account to be able to sign in. -->
        <!-- <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/</Item> -->
     
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_StaffAdTest"/>
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub"/>
        <OutputClaim ClaimTypeReferenceId="sub" PartnerClaimType="sub"/>
        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
        <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <!-- <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" AlwaysUseDefaultValue="true" /> -->
        <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />

        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
        <!-- <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/> -->
      </OutputClaimsTransformations>
      <!-- <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/> -->
        <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin"/>

    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

已确认声明已在集合中传递，并通过Application Insights验证。后续补充依赖方配置如下：

依赖方配置 #

<TrustFrameworkPolicy 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" 
PolicySchemaVersion="0.3.0.0" 
TenantId="{Settings:Tenant}" 
PolicyId="B2C_1A_signup_signin" 
PublicPolicyUri="http://{Settings:Tenant}/B2C_1A_signup_signin" 
TenantObjectId="{Settings:TenantObjectId}"
DeploymentMode="Development" 
UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">
  <BasePolicy>
    <TenantId>{Settings:Tenant}</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions_SeamlessMigration</PolicyId>
  </BasePolicy>
  <RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
    <Endpoints>
      <!--points to refresh token journey when app makes refresh token request-->
      <Endpoint Id="Token" UserJourneyReferenceId="RedeemRefreshToken" />
    </Endpoints>
    <UserJourneyBehaviors>
      <JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="{Settings:ApplicationInsightsKey}" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
    </UserJourneyBehaviors>
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="givenName" />
        <OutputClaim ClaimTypeReferenceId="surname" />
        <OutputClaim ClaimTypeReferenceId="email" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" />
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Settings:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

内容的提问来源于stack exchange，提问作者Paul McCarthy