查询Azure AD B2C策略文件XML元素的详细定义与配置说明

Hey there! I totally get where you're coming from—Azure AD B2C custom policies can feel like navigating a maze when you're hunting down XML element specs. Let me break down where to find the details you need, plus quick explanations for the elements you mentioned:

The official Microsoft Docs have a dedicated Custom Policy Schema Reference section that covers every XML element used in Azure AD B2C custom policies. This is your go-to source for detailed specs, allowed attributes, and usage examples for every component.

Within this reference, elements are organized by their role in the policy structure (e.g., policy root elements, orchestration steps, technical profiles, claim types). You can browse alphabetically or by category to find exactly what you're looking for.

Key Element Breakdowns #

Let’s cover the specific elements you asked about to get you started:

OrchestrationStep #

What it is: The core building block of your policy’s execution flow. Each OrchestrationStep defines a single action or sequence of actions that runs in the order specified by its Order attribute.

What it does: It orchestrates the high-level logic of your policy—like collecting user input, validating credentials, redirecting to an identity provider, or calling an external API.

Common configuration options:

• Order: A numeric value that sets the execution sequence (starts at 1, increments sequentially).
• Type: Defines the step’s purpose (e.g., CombinedSignInAndSignUp for a unified login/signup screen, ClaimsExchange to run a technical profile, SendClaims to issue tokens).
• ContentDefinitionReferenceId: Links to a UI template (like api.signuporsignin) that renders the step’s interface.
• ClaimsProviderSelections: Lists identity providers users can choose from in this step.

Example snippet:

<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
  <ClaimsProviderSelections>
    <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
    <ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange" />
  </ClaimsProviderSelections>
</OrchestrationStep>

TechnicalProfile #

What it is: The "workhorse" of custom policies. A TechnicalProfile encapsulates a specific task or interaction—think of it as a reusable module that handles authentication, data validation, API calls, or claim storage.

What it does: It defines the nitty-gritty logic for operations like:

• Signing in with a local account or social identity provider (e.g., Google, Facebook)
• Collecting and validating user input (like signup forms)
• Calling external REST APIs to enrich user data
• Reading/writing claims to Azure AD B2C’s directory

Common configuration options:

• Id: A unique identifier for the technical profile (used to reference it in orchestration steps).
• DisplayName: A user-friendly name shown in UI elements (like button text).
• Protocol: Specifies the protocol used (e.g., OpenIdConnect for OIDC providers, Restful for API calls, SelfAsserted for user input forms).
• Metadata: Key-value pairs that configure protocol-specific settings (like error messages, provider endpoints).
• InputClaims: Claims passed into the technical profile (e.g., a user’s email for login).
• OutputClaims: Claims returned by the technical profile (e.g., the user’s objectId after successful authentication).
• ValidationTechnicalProfiles: Nested technical profiles that run to validate input (e.g., checking if an email is already registered).

Example snippet:

<TechnicalProfile Id="LocalAccountSigninEmailExchange">
  <DisplayName>Local Account Signin</DisplayName>
  <Protocol Name="OpenIdConnect" />
  <Metadata>
    <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">We can't find your account—please sign up instead</Item>
    <Item Key="UserMessageIfInvalidPassword">Your password is incorrect</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="signInName" Required="true" />
    <InputClaim ClaimTypeReferenceId="password" Required="true" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <OutputClaim ClaimTypeReferenceId="displayName" />
  </OutputClaims>
</TechnicalProfile>

Bonus Tips #

• When exploring sample policies from Microsoft, look for inline comments that explain how elements work together. These samples are a great complement to the schema reference.
• If you’re stuck on a specific element’s behavior, check the "Remarks" section in its schema reference entry—it often includes best practices and common pitfalls.

内容的提问来源于stack exchange，提问作者Wauna