Azure AD B2C模拟自定义策略：能否返回被模拟用户非邮箱属性？

已成功部署基础用户模拟自定义策略，设置can_impersonate属性为true的管理员可模拟目标用户，被模拟用户的邮箱能正常返回至impersonatedUser Claim中。

新增Claim字段impersonatedUserContactId，期望其对应被模拟用户的displayName，但该字段始终为空。核心配置如下：

Claims Types #

<ClaimType Id="impersonatedUser">
  <DisplayName>Impersonated account</DisplayName>
  <DataType>string</DataType>
  <UserHelpText/>
</ClaimType>
<ClaimType Id="impersonatedUserContactId">
  <DisplayName>Impersonated account Contact Id</DisplayName>
  <DataType>string</DataType>
  <UserHelpText/>
</ClaimType>

Technical Profile AAD-ImpersonatedUserRead #

<TechnicalProfile Id="AAD-ImpersonatedUserRead">
  <Metadata>
    <Item Key="Operation">Read</Item>
    <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
    <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An account could not be found for the provided user ID.</Item>
    <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
  </Metadata>
  <IncludeInSso>false</IncludeInSso>
  <InputClaims>
    <!--Sample: Look up in the signInNames to see if the value in targetEmail contains - look it up-->
    <InputClaim ClaimTypeReferenceId="targetEmail" PartnerClaimType="signInNames.emailAddress" Required="true"/>
  </InputClaims>
  <OutputClaims>
    <!-- Sample: Returns the value in targetEmail and check in signInNames collection, then
         returns value in SignInName and pipe into impersonatedUser-->
    <OutputClaim ClaimTypeReferenceId="impersonatedUser" PartnerClaimType="signInNames.emailAddress" />
    <OutputClaim ClaimTypeReferenceId="impersonatedUserContactId" PartnerClaimType="displayName"/>
  </OutputClaims>
  <IncludeTechnicalProfile ReferenceId="AAD-Common"/>
</TechnicalProfile>

Technical Profile SelfAsserted-TargetEmailExchange #

<TechnicalProfile Id="SelfAsserted-TargetEmailExchange">
  <DisplayName>Target Email Page</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
  <Metadata>
    <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item> 
    <!--Sample:  indicating that claim resolving should be performed. So, we can read the value of {OAUTH-KV:targetEmail} claim resolver -->
    <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
  </Metadata>
  <InputClaims>
    <!--Sample: read the targetEmail query string parameter e.g. &targetemail=bob@contoso.com -->
    <InputClaim ClaimTypeReferenceId="targetEmail" DefaultValue="{OAUTH-KV:targetEmail}" AlwaysUseDefaultValue="true"/>
  </InputClaims>
  <OutputClaims>
    <!-- Required claims -->
    <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true"/>
    <OutputClaim ClaimTypeReferenceId="impersonatedUser" Required="true"/>
    <OutputClaim ClaimTypeReferenceId="impersonatedUserContactId" Required="true" />
    <OutputClaim ClaimTypeReferenceId="targetEmail" Required="true"/>
  </OutputClaims>
  <ValidationTechnicalProfiles>
    <ValidationTechnicalProfile ReferenceId="AAD-ImpersonatedUserRead"/>
  </ValidationTechnicalProfiles>
</TechnicalProfile>

impersonatedUser和impersonatedUserContactId已添加至依赖方配置，但impersonatedUserContactId始终为空。请问是否可通过模拟策略返回用户邮箱以外的属性？如何解决？

可以通过模拟策略返回邮箱以外的用户属性，问题根源在于配置中的权限映射和必填设置冲突，按以下步骤修正：

1. 确保AAD-Common拥有读取权限 #

在AAD-Common技术配置文件的<Metadata>中添加以下项，确保能读取用户属性：

<Item Key="ReadClaimsOnBehalfOf">true</Item>
<Item Key="ClientId">你的B2C扩展应用客户端ID</Item>

2. 修正AAD-ImpersonatedUserRead的输出声明 #

明确指定displayName的映射规则，添加AlwaysUseDefaultValue="true"确保值被正确传递：

<OutputClaims>
  <OutputClaim ClaimTypeReferenceId="impersonatedUser" PartnerClaimType="signInNames.emailAddress" />
  <OutputClaim ClaimTypeReferenceId="impersonatedUserContactId" PartnerClaimType="displayName" AlwaysUseDefaultValue="true"/>
</OutputClaims>

3. 移除SelfAsserted-TargetEmailExchange的不必要必填设置 #

impersonatedUserContactId是由验证步骤返回的，不是用户输入项，因此移除Required="true"：

<OutputClaims>
  <!-- Required claims -->
  <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true"/>
  <OutputClaim ClaimTypeReferenceId="impersonatedUser" Required="true"/>
  <OutputClaim ClaimTypeReferenceId="impersonatedUserContactId" />
  <OutputClaim ClaimTypeReferenceId="targetEmail" Required="true"/>
</OutputClaims>

4. 确认依赖方输出声明 #

在依赖方配置的<OutputClaims>中，确保impersonatedUserContactId被正确声明：

<OutputClaim ClaimTypeReferenceId="impersonatedUserContactId" />

5. 排查日志（可选） #

若问题仍存在，开启B2C的日志功能，查看AAD-ImpersonatedUserRead的执行日志，确认是否成功读取到displayName属性。

内容的提问来源于stack exchange，提问作者jordanvector