Azure AD B2C自定义策略：密码重置时添加用户提示文本

已实现自助密码重置及90天密码过期功能，当前用户修改密码（尤其是密码过期场景）时未收到原因通知，需在密码字段上方插入提示文本，现提供相关文件，寻求实现方案。

提供的文件 #

依赖方文件 #

（注：原链接已移除，文件内容为Azure AD B2C基础策略相关配置）

扩展策略文件 #

<BasePolicy>
    <TenantId>b2c.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkLocalization</PolicyId>
  </BasePolicy>
  <!--   <BuildingBlocks>
    <ClaimsSchema>
    </ClaimsSchema>
  </BuildingBlocks> -->
  <ClaimsProviders>
    <ClaimsProvider>
      <DisplayName>Facebook</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="Facebook-OAUTH">
          <Metadata>
            <Item Key="client_id">facebook_clientid</Item>
            <Item Key="scope">email public_profile</Item>
            <Item Key="ClaimsEndpoint">https://graph.facebook.com/me?fields=id,first_name,last_name,name,email</Item>
          </Metadata>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Token Issuer</DisplayName>
      <TechnicalProfiles>
        <!-- SAML Token Issuer technical profile -->
        <TechnicalProfile Id="Saml2AssertionIssuer">
          <DisplayName>Token Issuer</DisplayName>
          <Protocol Name="SAML2" />
          <OutputTokenFormat>SAML2</OutputTokenFormat>
          <CryptographicKeys>
            <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SAML" />
            <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SAML" />
          </CryptographicKeys>
          <InputClaims />
          <OutputClaims />
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer" />
        </TechnicalProfile>
        <!-- Session management technical profile for SAML-based tokens -->
        <TechnicalProfile Id="SM-Saml-issuer">
          <DisplayName>Session Management Provider</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Local Account SignIn</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="login-NonInteractive">
          <Metadata>
            <!-- ProxyIdentityExperienceFrameworkAppId -->
            <Item Key="client_id">1257aca9-6111-abcs-adca-d740612012fa</Item>
            <!-- IdentityExperienceFrameworkAppId -->
            <Item Key="IdTokenAudience">10f6e761-c111-dadd-acv0-affb3875cdaf</Item>
          </Metadata>
          <InputClaims>
            <!-- ProxyIdentityExperienceFrameworkAppId -->
            <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="1257aca9-6111-abcs-adca-d740612012fa" />
            <!-- IdentityExperienceFrameworkAppId -->
            <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="10f6e761-c111-dadd-acv0-affb3875cdaf" />
          </InputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Local Account</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Azure Active Directory</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AAD-Common">
          <Metadata>
            <!--Insert b2c-extensions-app application ID here, for example: 11111111-1111-1111-1111-111111111111-->
            <Item Key="ClientId">83axdc56-1aaa-4bbb-a666-4589cbb7a212</Item>
            <!--Insert b2c-extensions-app application ObjectId here, for example: 22222222-2222-2222-2222-222222222222-->
            <Item Key="ApplicationObjectId">8d93c18a-d111-4fff-8aaa-43ebedadd5b1</Item>
          </Metadata>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>
  <!--UserJourneys>
  </UserJourneys-->

实现步骤 #

1. 添加提示声明 #

取消扩展策略中BuildingBlocks的注释，添加用于存储提示文本的声明：

<BuildingBlocks>
  <ClaimsSchema>
    <ClaimType Id="PasswordExpirationHint">
      <DisplayName>密码提示</DisplayName>
      <DataType>string</DataType>
      <UserHelpText>提示用户修改密码的原因</UserHelpText>
    </ClaimType>
  </ClaimsSchema>
</BuildingBlocks>

2. 设置提示文本值 #

在用户旅程中对应密码修改的步骤（比如密码过期强制修改或自助重置的步骤），找到对应的技术配置文件，添加输出声明来设置提示文本：

• 密码过期场景：

<OutputClaim ClaimTypeReferenceId="PasswordExpirationHint" DefaultValue="您的密码已过期，请设置新密码。" />

• 自助重置场景：

<OutputClaim ClaimTypeReferenceId="PasswordExpirationHint" DefaultValue="请设置新密码以完成重置。" />

3. 在页面布局中显示提示 #

找到密码字段所在页面的技术配置文件（比如LocalAccountWritePasswordUsingObjectId），添加配置让提示文本显示在密码字段上方：

<TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId">
  <Metadata>
    <Item Key="ui:showClaimList">PasswordExpirationHint</Item>
  </Metadata>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="PasswordExpirationHint" />
  </OutputClaims>
</TechnicalProfile>

4. 本地化支持（可选） #

如果需要多语言提示，在本地化策略文件中添加对应语言的文本：

<LocalizedResources Id="en">
  <LocalizedStrings>
    <LocalizedString ElementType="ClaimType" ElementId="PasswordExpirationHint" StringId="UserHelpText">Your password has expired. Please set a new password.</LocalizedString>
  </LocalizedStrings>
</LocalizedResources>
<LocalizedResources Id="zh-CN">
  <LocalizedStrings>
    <LocalizedString ElementType="ClaimType" ElementId="PasswordExpirationHint" StringId="UserHelpText">您的密码已过期，请设置新密码。</LocalizedString>
  </LocalizedStrings>
</LocalizedResources>

内容的提问来源于stack exchange，提问作者denisdm91