Azure AD B2C自定义策略嵌入iframe报错：X-Frame-Options设为deny

错误信息 #

Refused to display 'https://login.microsoftonline.com/' in a frame because it set 'X-Frame-Options' to 'deny'

现有配置 #

注册登录策略 #

<UserJourneys>
    <UserJourney Id="SignUpOrSignIn">
      <OrchestrationSteps>
        <!-- get AppRoleAssignment -->
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="GetUserAppRoleAssignment" TechnicalProfileReferenceId="GetUserAppRoleAssignment" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="5" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
  </UserJourneys>
  <RelyingParty>
    <DefaultUserJourney ReferenceId="CustomSignUpSignIn" />
    <UserJourneyBehaviors>
      <JourneyFraming Enabled="true" Sources="https://.io https://testsquid.dynatex.io" />
    </UserJourneyBehaviors>
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
....
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>

B2C_1A_TRUSTFRAMEWORKEXTENSIONS.xml中的多租户AD配置 #

<ClaimsProvider>
      <Domain>microsoftonline.com</Domain>
      <DisplayName>Common AAD</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AADCommon-OpenIdConnect">
          <DisplayName>Multi-Tenant Azure Ad</DisplayName>
          <Protocol Name="OpenIdConnect" />
          <Metadata>
            <Item Key="ProviderName">https://login.microsoftonline.com</Item>
            <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
            <!-- Update the Client ID below to the Application ID -->
            <Item Key="response_types">code</Item>
            <Item Key="response_mode">form_post</Item>
            <Item Key="scope">openid profile email</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="UsePolicyInRedirectUri">false</Item>
            <Item Key="DiscoverMetadataByTokenIssuer">true</Item>
            <Item Key="client_id">....23-34e2ae21b7eb</Item>
            <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com</Item>
            <!-- <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000,https://login.microsoftonline.com/11111111-1111-1111-1111-111111111111</Item> -->
          </Metadata>

解决方法 #

1. 修正JourneyFraming的Sources配置 #

当前Sources包含无效地址https://.io，会导致白名单配置失效，只保留合法父页面域名：

<UserJourneyBehaviors>
  <JourneyFraming Enabled="true" Sources="https://testsquid.dynatex.io" />
</UserJourneyBehaviors>

确保所有列入Sources的域名完整且格式正确。

2. 为多租户AAD技术配置添加iframe支持 #

在AADCommon-OpenIdConnect的Metadata中添加允许iframe的参数，同时调整响应模式适配嵌入场景：

<Metadata>
  <!-- 保留原有参数 -->
  <Item Key="ProviderName">https://login.microsoftonline.com</Item>
  <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
  <Item Key="response_types">code</Item>
  <Item Key="scope">openid profile email</Item>
  <Item Key="HttpBinding">POST</Item>
  <Item Key="UsePolicyInRedirectUri">false</Item>
  <Item Key="DiscoverMetadataByTokenIssuer">true</Item>
  <Item Key="client_id">....23-34e2ae21b7eb</Item>
  <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com</Item>
  
  <!-- 添加以下参数 -->
  <Item Key="response_mode">query</Item>
  <Item Key="FrameAllowed">true</Item>
</Metadata>

将response_mode从form_post改为query，避免iframe中的跨域提交问题。

3. 验证应用注册的重定向URI #

确保Azure AD B2C应用注册中的重定向URI属于Sources配置的域名范围，且类型选择"Web"。

4. 检查目标租户的iframe限制 #

若用户登录的企业租户有安全策略禁用iframe嵌入，需联系租户管理员调整相关设置。

内容的提问来源于stack exchange，提问作者quanchinhong