AAD B2C自定义策略：用户名登录不返回email声明的问题咨询

问题 #

已按照《Deploy AAD B2C Custom Policies》说明在B2C目录部署自定义策略，成功部署《Username based journey》快速部署示例。运行B2C_1A_DEMO_SUSI_USERNAME端点时，注册流程可返回email声明，但登录流程无法返回该声明。

是否需要修改B2C_1A_DEMO_TRUSTFRAMEWORKEXTENSIONS_USERNAME自定义策略中ID为SelfAsserted-LocalAccountSignin-Username的Technical Profile？若需要，应添加什么内容？若不需要，还需检查哪些配置？

当前SelfAsserted-LocalAccountSignin-Username代码 #

<TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Username">
    <DisplayName>Local Account Signin</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="SignUpTarget">SignUpWithLogonUsernameExchange</Item>
        <Item Key="setting.operatingMode">Username</Item>
        <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
    </Metadata>
    <IncludeInSso>false</IncludeInSso>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="signInName" />
    </InputClaims>
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
        <OutputClaim ClaimTypeReferenceId="password" Required="true" />
        <OutputClaim ClaimTypeReferenceId="objectId" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" />
    </OutputClaims>
    <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
    </ValidationTechnicalProfiles>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

对比可返回email的LocalAccountSignUpWithLogonName代码 #

<TechnicalProfile Id="LocalAccountSignUpWithLogonName">
    <DisplayName>User ID signup</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
        <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
        <Item Key="LocalAccountType">Username</Item>
        <Item Key="LocalAccountProfile">true</Item>
        <Item Key="language.button_continue">Create</Item>
    </Metadata>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="signInName" />
    </InputClaims>
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectId" Required="true" />
        <OutputClaim ClaimTypeReferenceId="signInName" Required="true" />
        <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
        <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
        <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="newUser" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" />
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
        <OutputClaim ClaimTypeReferenceId="givenName" Required="true" />
        <OutputClaim ClaimTypeReferenceId="surname" Required="true" />
    </OutputClaims>
    <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonName" />
    </ValidationTechnicalProfiles>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

尝试在SelfAsserted-LocalAccountSignin-Username的OutputClaims中添加<OutputClaim ClaimTypeReferenceId="email" />，但出现异常错误，尚未启用洞察功能追踪。

解决方案 #

不需要修改SelfAsserted-LocalAccountSignin-Username的Technical Profile——这个组件的作用是收集用户登录凭据（用户名、密码），并非从Azure AD读取用户属性，直接添加email声明会因缺少输入源触发错误。你需要从以下两个关键配置入手：

1. 修改login-NonInteractive技术 profile #

这个Technical Profile是登录流程中负责验证凭据并从Azure AD获取用户信息的核心组件。找到它的定义，在其<OutputClaims>节点中添加email声明，确保从AAD读取该属性：

<OutputClaim ClaimTypeReferenceId="email" />

2. 确认信赖方策略的输出声明 #

打开B2C_1A_DEMO_SUSI_USERNAME对应的信赖方策略文件，在<RelyingParty>下的<OutputClaims>节点中，确保包含email声明，这样最终返回给应用的令牌中才会携带该属性：

<OutputClaim ClaimTypeReferenceId="email" />

额外检查 #

• 确认用户注册时email属性已正确写入Azure AD（从你的注册TP代码看已配置PartnerClaimType="Verified.Email"，这部分应该无问题）。
• 如果login-NonInteractive继承自基础策略，先检查基础策略中的定义，再在扩展策略中覆写其OutputClaims添加email。

内容的提问来源于stack exchange，提问作者Jake Maxwell