Azure B2C自定义流仅配置邮箱验证的报错排查

算力阿峰

2026-6-12

问题描述

我正尝试实现一个纯邮箱验证策略，验证完成后返回已验证的邮箱地址，但运行流程时b2clogin页面直接报错。已接入Application Insights，但未获取到有效调试信息。当前使用Microsoft提供的示例Base、Localization文件，以及自定义的Extensions文件和Relying Party策略文件，文件内容如下：

Extensions文件内容

<?xml version="1.0" encoding="utf-8" ?>
<TrustFrameworkPolicy
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
  PolicySchemaVersion="0.3.0.0"
  TenantId="xxx.onmicrosoft.com"
  PolicyId="B2C_1A_TrustFrameworkExtensions"
  PublicPolicyUri="http://xxx.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions">

  <BasePolicy>
    <TenantId>xxx.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkBase</PolicyId>
  </BasePolicy>
  
  <BuildingBlocks>
    <Predicates />
    <PredicateValidations />
  </BuildingBlocks>

  <ClaimsProviders>
    <ClaimsProvider>
      <DisplayName>Collect Email</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="SelfAsserted-CollectEmail">
          <DisplayName>Collect Email Address</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
            <Item Key="language.intro">Enter your email address</Item>
            <Item Key="language.button_continue">Continue</Item>
          </Metadata>
          <InputClaims />
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" Required="true" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

    <ClaimsProvider>
      <DisplayName>Email Verification</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="SelfAsserted-VerifyEmail">
          <DisplayName>Verify Email</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
            <Item Key="language.intro">Please verify your email address</Item>
            <Item Key="language.button_continue">Verify</Item>
            <Item Key="EnforceEmailVerification">true</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" Required="true" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>

  <UserJourneys>
    <UserJourney Id="VerifyEmail">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="CollectEmail" TechnicalProfileReferenceId="SelfAsserted-CollectEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="VerifyEmailExchange" TechnicalProfileReferenceId="SelfAsserted-VerifyEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
  </UserJourneys>

  <RelyingParty>
    <DefaultUserJourney ReferenceId="VerifyEmail" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>Email Verification Only</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="email" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

Relying Party策略文件内容

<?xml version="1.0" encoding="UTF-8"?>
<TrustFrameworkPolicy
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
  PolicySchemaVersion="0.3.0.0"
  TenantId="xxx.onmicrosoft.com"
  PolicyId="B2C_1A_VerifyEmail"
  PublicPolicyUri="http://xxx.onmicrosoft.com/B2C_1A_VerifyEmail"
  UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights">

  <BasePolicy>
    <TenantId>xxx.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>

  <RelyingParty>
    <DefaultUserJourney ReferenceId="VerifyEmail" />
    <UserJourneyBehaviors>
      <JourneyInsights TelemetryEngine="ApplicationInsights" ConnectionString="xxx" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" />
    </UserJourneyBehaviors>
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>Email Verification Only</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="email" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

请问需要如何操作才能让该流程正常运行？

解决方案

以下是修复该邮箱验证策略的关键步骤：

1. 移除Extensions文件中的重复RelyingParty节点

B2C策略遵循分层结构：Base定义核心基础配置，Extensions扩展技术逻辑和用户旅程，RelyingParty（RP）单独负责对外暴露的策略端点。你的Extensions文件中包含了<RelyingParty>节点，这会导致策略冲突，需删除Extensions文件末尾的整个<RelyingParty>块。

2. 修正邮箱验证技术配置的逻辑

当前的SelfAsserted-VerifyEmail使用了错误的Handler，无法触发内置的邮箱验证流程。需要调整为B2C专用的邮箱验证处理器，并补充验证后的声明输出：

<TechnicalProfile Id="SelfAsserted-VerifyEmail">
  <DisplayName>Verify Email</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.EmailVerificationProvider" />
  <Metadata>
    <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
    <Item Key="language.intro">Please verify your email address</Item>
    <Item Key="language.button_continue">Verify</Item>
  </Metadata>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="email" Required="true" />
    <OutputClaim ClaimTypeReferenceId="emailVerified" DefaultValue="true" />
  </OutputClaims>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

3. 确保声明类型存在

检查Base策略的<ClaimTypes>是否包含email和emailVerified，如果没有，需在Extensions文件的<BuildingBlocks>中添加声明定义：

<BuildingBlocks>
  <ClaimsSchema>
    <ClaimType Id="email">
      <DisplayName>Email Address</DisplayName>
      <DataType>string</DataType>
      <UserHelpText>The email address that will be verified</UserHelpText>
      <UserInputType>TextBox</UserInputType>
      <Restriction>
        <Pattern RegularExpression="^[a-zA-Z0-9.!#$%&amp;'^_`{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." />
      </Restriction>
    </ClaimType>
    <ClaimType Id="emailVerified">
      <DisplayName>Email Verified</DisplayName>
      <DataType>boolean</DataType>
      <UserHelpText>Indicates whether the email address has been verified.</UserHelpText>
    </ClaimType>
  </ClaimsSchema>
  <Predicates />
  <PredicateValidations />
</BuildingBlocks>

4. 修复Application Insights调试问题

如果AI未输出日志，检查以下几点：

确认ConnectionString正确，且对应的Application Insights资源在同一租户下
DeveloperMode设为true后需等待5-10分钟让日志生效
确保RP文件中UserJourneyRecorderEndpoint和JourneyInsights配置无拼写错误

5. 重新上传并测试策略

完成修改后，按Base → Extensions → RP的顺序重新上传策略文件，然后测试流程：

访问RP策略的测试端点
输入邮箱地址后点击继续
输入邮箱收到的验证代码完成验证
确认流程返回包含已验证邮箱的JWT令牌

内容的提问来源于stack exchange，提问作者marius

Azure B2C自定义流仅配置邮箱验证的报错排查

Extensions文件内容 #

Relying Party策略文件内容 #

1. 移除Extensions文件中的重复RelyingParty节点 #

2. 修正邮箱验证技术配置的逻辑 #

3. 确保声明类型存在 #

4. 修复Application Insights调试问题 #

5. 重新上传并测试策略 #