Azure AD B2C编辑资料自定义策略：如何强制已登录用户重新认证？

默认情况下，Azure AD B2C入门包的编辑资料自定义策略会利用用户已有的登录会话跳过认证环节。要强制用户每次编辑资料时都重新完成身份认证，可通过以下步骤修改配置：

核心修改点 #

将用户旅程中负责登录的技术配置替换为主动登录类型的配置，避免依赖已有会话跳过认证：

修改后的用户旅程配置 #

<UserJourney Id="ProfileEdit">
  <OrchestrationSteps>
    <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
      <ClaimsProviderSelections>
        <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
      </ClaimsProviderSelections>
    </OrchestrationStep>
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <!-- 将原SelfAsserted类型的登录配置替换为主动登录配置 -->
        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="LocalAccountSignInWithLogonName" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="B2CUserProfileUpdateExchange" TechnicalProfileReferenceId="SelfAsserted-ProfileUpdate" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

补充强化配置（可选） #

若需要更严格的强制认证控制，可在登录技术配置中添加ForceAuthn="true"属性，确保即使存在有效会话也强制重新认证：

<TechnicalProfile Id="LocalAccountSignInWithLogonName">
  <DisplayName>Local Account Signin</DisplayName>
  <Protocol Name="OpenIdConnect" />
  <Metadata>
    <!-- 新增强制认证属性 -->
    <Item Key="ForceAuthn">true</Item>
    <!-- 保留原其他元数据配置 -->
    <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">We can't seem to find your account</Item>
    <Item Key="UserMessageIfInvalidPassword">Your password is incorrect</Item>
    <Item Key="UserMessageIfOldPasswordUsed">Looks like you used an old password</Item>
    <Item Key="ProviderName">https://sts.windows.net/</Item>
    <Item Key="METADATA">https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration</Item>
    <Item Key="authorization_endpoint">https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize</Item>
    <Item Key="response_types">code</Item>
    <Item Key="response_mode">form_post</Item>
    <Item Key="scope">openid</Item>
    <Item Key="grant_type">authorization_code</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="username" Required="true" />
    <InputClaim ClaimTypeReferenceId="password" Required="true" />
    <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="password" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" />
    <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
    <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
    <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
    <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
    <OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" />
    <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
  </OutputClaims>
  <OutputClaimsTransformations>
    <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
    <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
    <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
    <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
  </OutputClaimsTransformations>
  <ValidationTechnicalProfiles>
    <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingUsernameAndPassword" />
  </ValidationTechnicalProfiles>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

原理说明 #

• SelfAsserted-LocalAccountSignin-Email属于自断言技术配置，会自动检测用户是否已有有效会话，若存在则跳过登录步骤；
• LocalAccountSignInWithLogonName是主动登录技术配置，无论用户是否已登录，都会强制显示登录界面要求输入凭证；
• ForceAuthn="true"属性会进一步告知Azure AD B2C忽略现有会话，强制用户重新完成身份认证流程。

内容的提问来源于stack exchange，提问作者uppercase