如何在用户注册时将Azure AD B2C用户保存至Cosmos DB？及单页应用场景下原子性存储指定JSON数据至Cosmos DB容器的实现方法

Great question—ensuring atomicity between Azure AD B2C registration and Cosmos DB storage is crucial to avoid inconsistent user data. The most reliable way to achieve this is by leveraging Azure AD B2C Custom Policies to hook into the registration flow and perform the Cosmos DB write as part of the identity provider's transaction. Here's a step-by-step breakdown:

1. Build an Azure Function to Handle Cosmos DB Writes #

First, create an Azure Function that receives user details from B2C and writes the required JSON to your Cosmos DB container. This function acts as the secure bridge between B2C and Cosmos DB, and we’ll configure B2C to call it during registration.

Sample Node.js Function Code #

const { CosmosClient } = require("@azure/cosmos");
const client = new CosmosClient(process.env.COSMOS_CONNECTION_STRING);
const database = client.database("YourDatabaseName");
const container = database.container("YourContainerName");

module.exports = async function (context, req) {
    context.log('Received request to save user to Cosmos DB');

    // Extract userId and email from the request body (sent by B2C)
    const { userId, email } = req.body;

    if (!userId || !email) {
        context.res = {
            status: 400,
            body: "Missing required fields: userId or email"
        };
        return;
    }

    try {
        // Create the user document (use userId as Cosmos DB document ID for uniqueness)
        const userDoc = {
            userId: userId,
            email: email,
            id: userId
        };

        // Upsert the document (create if new, update if existing)
        const { resource } = await container.items.upsert(userDoc);
        context.log(`Successfully saved user: ${userId}`);

        context.res = {
            status: 200,
            body: { success: true, message: "User saved to Cosmos DB" }
        };
    } catch (error) {
        context.log.error(`Error saving user to Cosmos DB: ${error.message}`);
        context.res = {
            status: 500,
            body: { success: false, message: "Failed to save user to Cosmos DB" }
        };
    }
};

• Security & Setup Tips:
  • Use a managed identity for the Azure Function to access Cosmos DB (no hardcoded connection strings needed).
  • Secure the function with an API key or Azure AD authentication to block unauthorized calls.

2. Integrate the Function into Azure AD B2C Custom Policies #

Update your B2C custom policy to call this function immediately after the user is registered. This ensures that if the Cosmos DB write fails, the entire registration process is rolled back.

Step 2.1: Define a RESTful Technical Profile #

Add this XML snippet to your policy’s <ClaimsProviders> section to define the call to your Azure Function:

<ClaimsProvider>
  <DisplayName>REST APIs</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="REST-SaveUserToCosmosDB">
      <DisplayName>Save User to Cosmos DB</DisplayName>
      <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      <Metadata>
        <Item Key="ServiceUrl">https://your-function-app.azurewebsites.net/api/SaveUserToCosmosDB?code=your-function-key</Item>
        <Item Key="SendClaimsIn">Body</Item>
        <Item Key="AuthenticationType">None</Item> <!-- Use "Bearer" if using Azure AD auth -->
      </Metadata>
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="userId" />
        <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
      </InputClaims>
      <OutputClaims>
        <!-- No output claims needed unless you want to return data back to B2C -->
      </OutputClaims>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

Step 2.2: Add the Technical Profile to the Registration User Journey #

Modify your user journey to include this technical profile right after the user account is created. Update the <OrchestrationSteps> in your <UserJourney> section:

<OrchestrationStep Order="7" Type="ClaimsExchange">
  <ClaimsExchanges>
    <ClaimsExchange Id="SaveUserToCosmosDB" TechnicalProfileReferenceId="REST-SaveUserToCosmosDB" />
  </ClaimsExchanges>
</OrchestrationStep>

If the function returns a non-200 status code, B2C will abort the registration and show an error to the user—guaranteeing atomicity (either both the user is created in B2C and saved to Cosmos DB, or neither happens).

3. Verify Atomicity #

To confirm the behavior:

• Test a registration where the Cosmos DB write fails (e.g., temporarily disable the function). The user should not appear in Azure AD B2C.
• Test a successful registration: the user exists in both B2C and Cosmos DB.

Alternative: Client-Side Approach (Non-Atomic) #

If you can’t use custom policies (e.g., relying on built-in user flows), you could call the Cosmos DB-writing API from your SPA after the user registers. However, this does not guarantee atomicity: if the API call fails (network issue, timeout), the user will exist in B2C but not in Cosmos DB. Only use this if atomicity isn’t a strict requirement.

内容的提问来源于stack exchange，提问作者user776490