使用自定义策略配置多租户Azure AD嵌入登录报错求助

我通过Azure AD B2C自定义策略实现用户认证，已完成多租户Azure AD登录及iframe嵌入功能的配置。但将登录页嵌入ASP.NET MVC页面后，使用Azure AD登录时出现报错（截图：）。

以下是我的配置片段：

SignSignup 配置 #

<RelyingParty>
    <DefaultUserJourney ReferenceId="CustomSignUpSignIn" />
    <UserJourneyBehaviors>
      <JourneyFraming Enabled="true" Sources="https://test.dynatex.io https://testsquid.dynatex.io/" />
    </UserJourneyBehaviors>
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="givenName" />
        <OutputClaim ClaimTypeReferenceId="surname" />

B2C_1A_TRUSTFRAMEWORKEXTENSIONS.xml 配置 #

<ClaimsProvider>
      <Domain>onmicrosoft.com</Domain>
      <DisplayName>Common AAD</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="AADCommon-OpenIdConnect">
          <DisplayName>Multi-Tenant Azure Ad</DisplayName>
          <Protocol Name="OpenIdConnect" />
          <Metadata>
            <Item Key="ProviderName">https://login.microsoftonline.com</Item>
            <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
            <!-- Update the Client ID below to the Application ID -->
            <Item Key="response_types">code</Item>
            <Item Key="response_mode">form_post</Item>
            <Item Key="scope">openid profile email</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="UsePolicyInRedirectUri">false</Item>
            <Item Key="DiscoverMetadataByTokenIssuer">true</Item>
            <Item Key="client_id">9...</Item>
            <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com</Item>
            <!-- <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000,https://login.microsoftonline.com/11111111-1111-1111-1111-111111111111</Item> -->
          </Metadata>
          <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_msa" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="loginHint" PartnerClaimType="login_hint" DefaultValue="{OIDC:LoginHint}" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
            <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
            <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
            <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
            <OutputClaim ClaimTypeReferenceId="roles" />
            <OutputClaim ClaimTypeReferenceId="groups" />

这个报错源于Azure AD登录页面默认的X-Frame-Options安全限制，禁止被嵌入iframe，结合你的配置，按以下步骤调整：

• 配置多租户Azure AD应用嵌入权限：在对应应用注册的「认证」页面，开启「允许公共客户端流」，并将https://test.dynatex.io、https://testsquid.dynatex.io/添加到「允许的嵌入来源」列表。
• 修改B2C技术配置的响应模式：在AADCommon-OpenIdConnect的Metadata节点中，将<Item Key="response_mode">form_post</Item>替换为<Item Key="response_mode">fragment</Item>，避免iframe内的跨域表单提交问题。
• 验证JourneyFraming域名：确保JourneyFraming的Sources值与嵌入站点域名完全一致，不要遗漏协议或斜杠。
• 调整MVC页面iframe属性：嵌入iframe时添加必要权限，示例：

<iframe src="你的B2C登录策略URL" sandbox="allow-same-origin allow-forms allow-popups"></iframe>

内容的提问来源于stack exchange，提问作者quanchinhong