Azure AD B2C自定义策略：重置密码前REST API验证及状态码配置问询

需求与实现思路 #

在Azure AD B2C重置密码自定义策略中，需在发送邮件验证码前执行REST API验证，要求：

• 支持API返回成功/错误状态时流程继续执行
• 基于API响应的状态码设置前置条件，控制是否触发发送验证码的动作

实现方案：

• 定义REST API验证技术配置文件，设置ContinueOnError=true，允许API返回错误状态时流程不中断
• 在发送验证码的ValidationClaimsExchangeTechnicalProfile中添加前置条件，通过检查存储响应状态码的claim，当状态码为200、400或409时执行SkipThisValidationTechnicalProfile动作，跳过发送验证码步骤

REST API响应示例 #

{
    "version": "1.0.0",
    "userMessage": "用户无Addenda Quote访问权限，请联系管理员。",
    "status": 409,
    "isUserExist": false
}

Claim Type定义 #

<ClaimType Id="status">
    <DisplayName>用户访问API状态码</DisplayName>
    <DataType>int</DataType>
</ClaimType>

REST技术配置文件 #

<TechnicalProfile Id="REST-ReadFromDB">
    <DisplayName>从数据库验证用户</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="ServiceUrl">https:........</Item>
        <Item Key="SendClaimsIn">Header</Item>
        <Item Key="AuthenticationType">None</Item>
        <Item Key="AllowInsecureAuthInProduction">false</Item>
    </Metadata>
    <IncludeInSso>false</IncludeInSso>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="emailAddress" PartnerClaimType="email" />
    </InputClaims> 
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="status" PartnerClaimType="status"/>
    </OutputClaims>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

Display Control配置 #

<DisplayControls>
    <DisplayControl Id="emailVerificationControl" UserInterfaceControlType="VerificationControl">
        <InputClaims>
            <InputClaim ClaimTypeReferenceId="emailAddress" />
        </InputClaims>
        <DisplayClaims>
            <DisplayClaim ClaimTypeReferenceId="emailAddress" ControlClaimType="Email" Required="true" />
            <DisplayClaim ClaimTypeReferenceId="verificationCode" ControlClaimType="VerificationCode" Required="true" />
        </DisplayClaims>
        <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="azureMfaSessionId" />
        </OutputClaims>
        <Actions>
            <Action Id="SendCode">
                <ValidationClaimsExchange>
                    <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AAD-UserReadUsingEmailAddress-emailAddress" ContinueOnError="true"/>
                    <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="REST-ReadFromDB" ContinueOnError="true">
                    </ValidationClaimsExchangeTechnicalProfile>
                    <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AadSspr-SendCode">
                        <Preconditions>
                            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
                                <Value>objectId</Value>
                                <Action>SkipThisValidationTechnicalProfile</Action>
                            </Precondition>
                            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                                <Value>status</Value>
                                <Action>SkipThisValidationTechnicalProfile</Action>
                            </Precondition>
                        </Preconditions>
                    </ValidationClaimsExchangeTechnicalProfile>
                </ValidationClaimsExchange>
            </Action>
            <Action Id="VerifyCode">
                <ValidationClaimsExchange>
                    <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AadSspr-VerifyCode" />
                </ValidationClaimsExchange>
            </Action>
        </Actions>
    </DisplayControl>
</DisplayControls>

内容的提问来源于stack exchange，提问作者sajna m nair