Azure B2C执行ROPC流程前检查用户存在性时遇未实现错误

问题背景 #

我们正在实现Azure AD B2C的ROPC（Resource Owner Password Credentials）流程，需求是在执行OpenID Connect调用前检查用户是否存在，不存在则创建（仅测试场景）。完全复制了官方文档中的ResourceOwnerPassword-Oauth2技术配置文件，自定义了UserJourney和AAD-UserExists技术配置文件，之后在Application Insight中收到错误：

{
"Kind": "FatalException",
"Content": {
  "Time": "8:24 AM",
  "Exception": {
    "Kind": "Handled",
    "HResult": "80004001",
    "Message": "The method or operation is not implemented.",
    "Data": {}
  }
}

自定义的UserJourney代码：

<UserJourney Id="SignInSilent" DefaultCpimIssuerTechnicalProfileReferenceId="JwtIssuer">
    <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
    <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
            <ClaimsExchanges>
                <ClaimsExchange Id="CheckIfUserExists" TechnicalProfileReferenceId="AAD-UserExists" />
            </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
            <ClaimsExchanges>
                <ClaimsExchange Id="ResourceOwnerFlow" TechnicalProfileReferenceId="ResourceOwnerPasswordCredentials-OAUTH2" />
            </ClaimsExchanges>
        </OrchestrationStep>
    </OrchestrationSteps>
</UserJourney>

自定义的AAD-UserExists技术配置文件：

<TechnicalProfile Id="AAD-UserExists">
    <Metadata>
        <Item Key="Operation">Read</Item>
        <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">false</Item>
        <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
    </Metadata>
        <IncludeInSso>false</IncludeInSso>
        <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" DefaultValue="{OIDC:Username}" AlwaysUseDefaultValue="true" Required="true" />
        </InputClaims>
        <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" DefaultValue="NOTFOUND" />
        </OutputClaims>
        <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="AssertObjectIdObjectIdNotFoundAreEqual" />
        </OutputClaimsTransformations>
        <IncludeTechnicalProfile ReferenceId="AAD-Common" />
</TechnicalProfile>

错误原因 #

1. ROPC流程编排限制：ROPC是Azure AD B2C中特殊的OAuth2流程，其技术配置文件ResourceOwnerPasswordCredentials-OAUTH2本身包含完整的用户验证逻辑，且不允许在其之前添加自定义的ClaimsExchange步骤。强行插入前置检查步骤会触发流程未定义的操作，导致"The method or operation is not implemented."错误。
2. 额外潜在问题：AAD-UserExists中引用的AssertObjectIdObjectIdNotFoundAreEqual声明转换若未提前定义，也会引发错误，但当前致命错误的根源是ROPC流程的编排违规。

解决方案 #

要实现"检查用户存在-不存在则创建"的ROPC流程，需直接修改ROPC技术配置文件，而非添加前置步骤：

1. 启用ROPC自动创建用户逻辑 #

在ResourceOwnerPasswordCredentials-OAUTH2的<Metadata>中添加配置，开启自动创建用户功能：

<Metadata>
    <!-- 原有配置保留 -->
    <Item Key="client_id">你的应用注册ID</Item>
    <Item Key="IdTokenAudience">你的应用注册ID</Item>
    <Item Key="response_types">id_token</Item>
    <Item Key="scope">openid</Item>
    <!-- 添加以下配置 -->
    <Item Key="CreateUserIfNotFound">true</Item>
</Metadata>

2. 恢复ROPC默认编排流程 #

移除UserJourney中的前置检查步骤，只保留ROPC技术配置文件的调用：

<UserJourney Id="SignInSilent" DefaultCpimIssuerTechnicalProfileReferenceId="JwtIssuer">
    <PreserveOriginalAssertion>false</PreserveOriginalAssertion>
    <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
            <ClaimsExchanges>
                <ClaimsExchange Id="ResourceOwnerFlow" TechnicalProfileReferenceId="ResourceOwnerPasswordCredentials-OAUTH2" />
            </ClaimsExchanges>
        </OrchestrationStep>
    </OrchestrationSteps>
</UserJourney>

3. 验证基础配置 #

确保AAD-Common技术配置文件包含正确的ServiceUrl、ClientId等参数，支持用户创建操作。

内容的提问来源于stack exchange，提问作者Thibault Lesuisse