如何修改Azure B2C自定义策略以添加OTP邮件投递备选方案

要实现用户在等待SMS OTP延迟时切换到邮件验证的功能，需要对现有策略做以下几处修改：

1. 扩展PhoneFactor技术配置文件，添加切换选项 #

在原PhoneFactor-InputOrVerify的Metadata中添加触发切换的提示配置，同时可配合UI自定义实现更友好的切换入口。

2. 添加邮件OTP验证的技术配置文件 #

新增基于EmailProtocolProvider的技术配置文件，用于发送和验证邮件OTP。

3. 调整编排步骤，支持切换流程 #

确保用户旅程允许从SMS验证步骤跳转到邮件验证步骤，验证完成后回归主流程。

修改后的完整ClaimsProvider代码 #

<ClaimsProvider>
  <DisplayName>PhoneFactor</DisplayName>
  <TechnicalProfiles>
    <!-- 原SMS OTP验证配置，添加切换至邮件的提示 -->
    <TechnicalProfile Id="PhoneFactor-InputOrVerify">
      <DisplayName>PhoneFactor</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.PhoneFactorProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.phonefactor</Item>
        <Item Key="ManualPhoneNumberEntryAllowed">true</Item>
        <!-- 添加切换至邮件验证的提示文本 -->
        <Item Key="UserMessageIfCantSendCode">无法收到短信验证码？点击切换至邮件验证</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
      </CryptographicKeys>
      <InputClaimsTransformations>
        <InputClaimsTransformation ReferenceId="CreateUserIdForMFA" />
      </InputClaimsTransformations>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="userIdForMFA" PartnerClaimType="UserId" />
        <InputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="Verified.strongAuthenticationPhoneNumber" PartnerClaimType="Verified.OfficePhone" />
        <OutputClaim ClaimTypeReferenceId="newPhoneNumberEntered" PartnerClaimType="newPhoneNumberEntered" />
      </OutputClaims>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-MFA" />
    </TechnicalProfile>

    <!-- 新增邮件OTP验证技术配置文件 -->
    <TechnicalProfile Id="EmailVerifyOTP">
      <DisplayName>Email OTP Verification</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.EmailProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.emailverification</Item>
        <Item Key="UserMessageIfSessionDoesNotExist">无法找到验证会话，请重新开始流程</Item>
        <Item Key="UserMessageIfInvalidCode">验证码无效，请重新输入</Item>
        <Item Key="UserMessageIfMaxRetryAttemptsReached">已达到最大重试次数，请重新发送验证码</Item>
        <Item Key="NumberOfRetryAttempts">3</Item>
        <Item Key="CodeExpirationInMinutes">15</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
      </CryptographicKeys>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailAddress" />
        <InputClaim ClaimTypeReferenceId="userIdForMFA" PartnerClaimType="UserId" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="emailAddress" />
        <OutputClaim ClaimTypeReferenceId="verifiedEmail" PartnerClaimType="verifiedEmail" />
      </OutputClaims>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-MFA" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

额外配置说明 #

• UI自定义优化：若需要更直观的切换按钮，需修改api.phonefactor对应的HTML内容模板，添加触发跳转的按钮：

  <button id="switchToEmailBtn" onclick="switchToEmailVerify()">使用邮件验证</button>
  <script>
    function switchToEmailVerify() {
      // 触发跳转至邮件验证步骤，需替换为你的策略和租户信息
      window.location.href = "https://your-tenant.b2clogin.com/your-tenant.onmicrosoft.com/B2C_1A_your-login-policy/oauth2/v2.0/authorize?p=B2C_1A_your-login-policy&redirect_uri=https://your-app-redirect-uri&client_id=your-client-id&response_type=code&scope=openid&state=your-state&nonce=your-nonce&prompt=select_account&mfa_method=email";
    }
  </script>
  

• 编排步骤调整：在用户旅程第4步后添加可选步骤，识别用户的切换请求并触发邮件验证：

  <OrchestrationStep Order="5" Type="ClaimsExchange">
    <Preconditions>
      <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
        <Value>mfa_method</Value>
        <Value>email</Value>
        <Action>SkipThisOrchestrationStep</Action>
      </Precondition>
    </Preconditions>
    <ClaimsExchanges>
      <ClaimsExchange Id="EmailVerifyExchange" TechnicalProfileReferenceId="EmailVerifyOTP" />
    </ClaimsExchanges>
  </OrchestrationStep>
  

• 前置条件：确保用户旅程的前序步骤已收集并验证用户邮箱（即email Claim已存在），否则邮件验证无法正常发送。

内容的提问来源于stack exchange，提问作者nullmicgo