Azure B2C自定义策略拆分注册流程故障排查求助

问题根源 #

你遇到的500错误，是因为移除LocalAccountSignUpWithLogonEmail中的用户写入验证配置后，第一步的自我断言技术配置缺少必要的逻辑支撑，或是第二步的技术配置未正确承接第一步收集的邮箱、密码信息，导致策略执行时无法获取必需的用户属性。

具体修改步骤 #

1. 调整第一步注册技术配置（LocalAccountSignUpWithLogonEmail） #

保留邮箱、密码的收集逻辑和邮箱唯一性校验，移除账户创建的验证配置：

<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
  <DisplayName>Email signup</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
    <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
    <Item Key="language.button_continue">Continue</Item>
  </Metadata>
  <CryptographicKeys>
    <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
  </CryptographicKeys>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
    <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
    <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
    <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
    <OutputClaim ClaimTypeReferenceId="authenticationSource" />
    <OutputClaim ClaimTypeReferenceId="newUser" />
  </OutputClaims>
  <ValidationTechnicalProfiles>
    <!-- 仅保留邮箱唯一性校验，防止重复注册 -->
    <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />
  </ValidationTechnicalProfiles>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

2. 创建第二步用户信息收集技术配置 #

新增一个自我断言技术配置，用于收集用户名等附加信息，并在验证阶段执行账户创建：

<TechnicalProfile Id="LocalAccountSignUpProfileDetails">
  <DisplayName>Complete Your Profile</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
    <Item Key="language.button_continue">Create Account</Item>
  </Metadata>
  <InputClaims>
    <!-- 承接第一步已验证的邮箱 -->
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" />
  </InputClaims>
  <OutputClaims>
    <!-- 定义需要收集的用户属性，按需调整 -->
    <OutputClaim ClaimTypeReferenceId="givenName" Required="true" />
    <OutputClaim ClaimTypeReferenceId="surName" Required="true" />
    <OutputClaim ClaimTypeReferenceId="displayName" Required="true" />
  </OutputClaims>
  <ValidationTechnicalProfiles>
    <!-- 在这里执行账户创建操作 -->
    <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
  </ValidationTechnicalProfiles>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

3. 更新用户旅程，串联两步流程 #

修改用户旅程，确保先执行第一步邮箱密码收集，再执行第二步信息完善与账户创建：

<UserJourney Id="SignUp">
  <OrchestrationSteps>
    <!-- 步骤1：收集邮箱、密码并校验唯一性 -->
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="FirstSignUpStep" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 步骤2：收集用户信息并创建账户 -->
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="SecondSignUpStep" TechnicalProfileReferenceId="LocalAccountSignUpProfileDetails" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 步骤3：发行身份令牌 -->
    <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

4. 确保账户创建技术配置接收所有必需属性 #

检查AAD-UserWriteUsingLogonEmail的输入和持久化声明，确保包含第一步的邮箱、密码，以及第二步收集的用户属性：

<TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
  <Metadata>
    <Item Key="Operation">Write</Item>
    <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
  </Metadata>
  <IncludeInSso>false</IncludeInSso>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
    <InputClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" Required="true" />
    <InputClaim ClaimTypeReferenceId="displayName" />
    <InputClaim ClaimTypeReferenceId="givenName" />
    <InputClaim ClaimTypeReferenceId="surName" />
  </InputClaims>
  <PersistedClaims>
    <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
    <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
    <PersistedClaim ClaimTypeReferenceId="displayName" />
    <PersistedClaim ClaimTypeReferenceId="givenName" />
    <PersistedClaim ClaimTypeReferenceId="surName" />
    <PersistedClaim ClaimTypeReferenceId="objectId" />
    <PersistedClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
    <PersistedClaim ClaimTypeReferenceId="newUser" />
    <PersistedClaim ClaimTypeReferenceId="userPrincipalName" />
    <PersistedClaim ClaimTypeReferenceId="ipAddress" />
  </PersistedClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <OutputClaim ClaimTypeReferenceId="newUser" />
  </OutputClaims>
  <IncludeTechnicalProfile ReferenceId="AAD-Common" />
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

关键注意点 #

• 第一步必须保留AAD-UserReadUsingEmailAddress校验，避免用户注册已存在的邮箱。
• 第二步的输入声明要正确引用第一步的已验证邮箱，确保数据传递无误。
• 所有需要收集的用户属性，必须在策略的<ClaimTypes>节点中提前定义。

内容的提问来源于stack exchange，提问作者Chaitu