基于自定义注册登录策略，按所选IDP动态显示属性的实现求助

Hey there! Let's work through this requirement for your Azure AD B2C custom policies. The key here is to conditionally show the business email field only when users sign up via social identity providers (Facebook, LinkedIn, Twitter, Google) and skip it entirely for Azure AD users. Here's a step-by-step solution based on your existing setup with the SelfAsserted-Social technical profile:

1. Confirm Your Identity Provider IDs #

First, make sure you know the exact ClaimsProvider ID for your Azure AD setup (this is defined in your policy's <ClaimsProviders> section). For example, it might be AADCommon or a custom ID you chose. Social providers will have IDs like Facebook, LinkedIn, etc.

2. Add Preconditions to the Business Email Input Claim #

Modify the InputClaim for your business email in the SelfAsserted-Social technical profile to include preconditions that check the user's identity provider. This will hide the field when the user comes from Azure AD.

Here's the updated XML snippet:

<TechnicalProfile Id="SelfAsserted-Social">
  <DisplayName>User ID signup</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <!-- Your existing metadata here -->
  </Metadata>
  <InputClaims>
    <!-- Other input claims -->
    <InputClaim ClaimTypeReferenceId="businessEmail" Required="true">
      <Preconditions>
        <!-- Skip if identityProvider claim doesn't exist (fallback) -->
        <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
          <Value>identityProvider</Value>
          <Action>SkipThisClaim</Action>
        </Precondition>
        <!-- Skip if user is coming from Azure AD -->
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>identityProvider</Value>
          <Value>AADCommon</Value> <!-- Replace with your Azure AD ClaimsProvider ID -->
          <Action>SkipThisClaim</Action>
        </Precondition>
      </Preconditions>
    </InputClaim>
  </InputClaims>
  <!-- Rest of your technical profile configuration -->
</TechnicalProfile>

What this does:

• Checks if the identityProvider claim exists (ensures we're dealing with a user from an external IDP)
• If the user's identity provider matches your Azure AD ID, it skips rendering the business email field
• For all other social providers, the field remains visible and required

3. (Optional) Auto-Populate Business Email for Azure AD Users #

If Azure AD already provides the user's email as a claim, you can auto-map it to your businessEmail claim without requiring user input. Modify your Azure AD technical profile to include this output claim:

<TechnicalProfile Id="AADCommon-OpenIdConnect">
  <!-- Existing configuration -->
  <OutputClaims>
    <!-- Other output claims -->
    <OutputClaim ClaimTypeReferenceId="businessEmail" PartnerClaimType="email" />
  </OutputClaims>
</TechnicalProfile>

This ensures the business email is saved to the directory automatically for Azure AD users.

4. Adjust Validation (If Needed) #

If your SelfAsserted-Social profile uses validation technical profiles (e.g., for checking email format or writing to the directory), add matching preconditions to skip those steps for Azure AD users. For example:

<ValidationTechnicalProfiles>
  <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingAlternativeSecurityId">
    <Preconditions>
      <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
        <Value>identityProvider</Value>
        <Value>AADCommon</Value>
        <Action>SkipThisValidationTechnicalProfile</Action>
      </Precondition>
    </Preconditions>
  </ValidationTechnicalProfile>
</ValidationTechnicalProfiles>

5. Test Thoroughly #

• Test sign-up via each social provider: Verify the business email field appears and is required
• Test sign-up via Azure AD: Verify the field is skipped entirely, and the email is correctly stored (if you set up auto-mapping)

内容的提问来源于stack exchange，提问作者Lucky