Azure AD B2C仅社交账户邮件邀请注册流程配置报错求助

尝试基于Azure AD B2C自定义策略实现邀请注册流程，参考的是本地账户版本的示例策略，但我的租户仅支持社交账户（外部IDP），完全不使用本地账户。在调整RedeemInvite.xml适配社交账户时，反复遇到以下错误：

Claim type "alternativeSecurityId" is the input claim of technical profile "AAD-UserReadUsingAlternativeSecurityId-NoError" in step "3" of user journey "SignInWithIdTokenHint" but it is not an output claim in any of the previous steps.

已将示例中「本地账户」的引用替换为基础策略里「社交账户」的对应内容，也尝试在每个<InputClaims>下添加alternativeSecurityId引用排查，但仍不理解错误原因。

相关代码片段 #

声明alternativeSecurityId为输入的Claims Provider代码 #

<InputClaims>
    <InputClaim ClaimTypeReferenceId="alternativeSecurityId" PartnerClaimType="alternativeSecurityId" Required="true" />
</InputClaims>
<OutputClaims>
    <!-- Required claims -->
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <!-- Optional claims -->
    <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
    <OutputClaim ClaimTypeReferenceId="displayame" /
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="surname" />
    <OutputClaim ClaimTypeReferenceId="alternativeSecurityId" />
</OutputClaims>

用户旅程步骤1-3代码 #

<OrchestrationStep Order="1" Type="GetClaims" CpimIssuerTechnicalProfileReferenceId="IdTokenHint_ExtractClaims" />
<!-- Check if user tries to run the policy without invitation -->
<OrchestrationStep Order="2" Type="ClaimsExchange">
    <Preconditions>
         <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
         </Precondition>
    </Preconditions>        
    <ClaimsExchanges>
         <ClaimsExchange Id="SelfAsserted-Unsolicited" TechnicalProfileReferenceId="SelfAsserted-Unsolicited" />
    </ClaimsExchanges>
</OrchestrationStep>
<!-- Read the user properties from the directory - should not exist -->
<OrchestrationStep Order="3" Type="ClaimsExchange">
    <ClaimsExchanges>
         <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError"/>
    </ClaimsExchanges>
</OrchestrationStep>

这个错误的核心是：执行第3步的AAD-UserReadUsingAlternativeSecurityId-NoError技术配置文件时，alternativeSecurityId声明还未被前面的步骤生成并输出到声明包中。针对社交账户的邀请流程，需做以下调整：

1. 补充社交登录环节
   原示例是本地账户流程，没有社交登录步骤，而alternativeSecurityId是用户通过社交IDP认证后才会生成的声明。需在第2步之后、原第3步之前添加社交IDP登录的编排步骤，让用户先完成社交账户认证，获取alternativeSecurityId。调整后的编排步骤示例：

<OrchestrationStep Order="1" Type="GetClaims" CpimIssuerTechnicalProfileReferenceId="IdTokenHint_ExtractClaims" />
<!-- Check if user tries to run the policy without invitation -->
<OrchestrationStep Order="2" Type="ClaimsExchange">
    <Preconditions>
         <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>email</Value>
              <Action>SkipThisOrchestrationStep</Action>
         </Precondition>
    </Preconditions>        
    <ClaimsExchanges>
         <ClaimsExchange Id="SelfAsserted-Unsolicited" TechnicalProfileReferenceId="SelfAsserted-Unsolicited" />
    </ClaimsExchanges>
</OrchestrationStep>
<!-- 新增：社交IDP登录步骤，替换为你的实际IDP配置 -->
<OrchestrationStep Order="3" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
    <ClaimsProviderSelections>
        <ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
    </ClaimsProviderSelections>
    <ClaimsExchanges>
        <ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" />
    </ClaimsExchanges>
</OrchestrationStep>
<!-- 原读取用户步骤调整为第4步 -->
<OrchestrationStep Order="4" Type="ClaimsExchange">
    <ClaimsExchanges>
         <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError"/>
    </ClaimsExchanges>
</OrchestrationStep>

2. 修正代码笔误
   你提供的Claims Provider代码中，<OutputClaim ClaimTypeReferenceId="displayame" /缺少闭合的>，这会导致策略解析错误，需先修复该问题。

3. 确认社交IDP的输出声明
   确保你使用的社交IDP技术配置文件（如Google-OAUTH、Facebook-OAUTH）默认输出alternativeSecurityId，若未输出，需在对应技术配置文件的<OutputClaims>节点中添加该声明。

内容的提问来源于stack exchange，提问作者anemoneyy