ADB2C策略在ValidationTechnicalProfile上失败。

huangapple
go评论93阅读模式
英文:

ADB2C policies fails on ValidationTechnicalProfile

问题

在我的ValidationTechnicalProfile中，我遇到了一个问题：

  1. <ValidationTechnicalProfile ReferenceId="REST-acquireaccesstoken"/>

如果我从ValidationTechnicalProfiles中删除这个部分，登录就可以正常工作，但是如果保留这个ValidationTechnicalProfile，登录会失败，出现以下错误：

  1. "Key": "Exception",
  2. "Value": {
  3.   "Kind": "Handled",
  4.   "HResult": "80131500",
  5.   "Message": "Invalid username or password.",
  6.   "Data": {
  7.     "IsPolicySpecificError": false
  8.   }
  9. }

同样的技术配置在OrchestrationStep中调用时可以正常工作。AppInsight日志也没有提供帮助，我只能看到上述错误。以下是TechnicalProfile的配置：

  1. <TechnicalProfile Id="REST-AcquireAccessToken">
  2.   <DisplayName></DisplayName>
  3.   <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  4.   <Metadata>
  5.     <Item Key="ServiceUrl">https://login.microsoftonline.com/xxxxxxxxxx/oauth2/v2.0/token</Item>
  6.     <Item Key="AuthenticationType">Basic</Item>
  7.     <Item Key="SendClaimsIn">Form</Item>
  8.     <Item Key="AllowInsecureAuthInProduction">true</Item>
  9.   </Metadata>
  10.   <CryptographicKeys>
  11.     <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ClientId" />
  12.     <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_Secret" />
  13.   </CryptographicKeys>
  14.   <InputClaims>
  15.     <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="client_credentials" AlwaysUseDefaultValue="true" />
  16.     <InputClaim ClaimTypeReferenceId="scope" DefaultValue="api://xxxxxxxx/.default" AlwaysUseDefaultValue="true" />
  17.   </InputClaims>
  18.   <OutputClaims>
  19.     <OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="access_token" />
  20.   </OutputClaims>
  21.   <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
  22. </TechnicalProfile>

请帮助解决这个问题。

英文:

I am facing an issue, in my ValidationTechnicalProfile,

  1. <ValidationTechnicalProfile ReferenceId="REST-acquireaccesstoken"/>

if I remove this from ValidationTechnicalProfiles, login works, but with this ValidationTechnicalProfile it fails with:

"Key": "Exception",
"Value": {
"Kind": "Handled",
"HResult": "80131500",
"Message": "Invalid username or password.",
"Data": {
"IsPolicySpecificError": false
}
}

This same Technical profile works fine if I call it in OrchestrationStep. The appinsight logs are not help as well, all I see is above error. Here is the TechnicalProfile

  1. <TechnicalProfile Id="REST-AcquireAccessToken">
  2.           <DisplayName></DisplayName>
  3.           <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  4.           <Metadata>
  5.             <Item Key="ServiceUrl">https://login.microsoftonline.com/xxxxxxxxxx/oauth2/v2.0/token</Item>
  6.             <Item Key="AuthenticationType">Basic</Item>
  7.             <Item Key="SendClaimsIn">Form</Item>
  8.             <Item Key="AllowInsecureAuthInProduction">true</Item>
  9.           </Metadata>
  10.           <CryptographicKeys>
  11.             <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_ClientId" />
  12.             <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_Secret" />
  13.           </CryptographicKeys>
  14.           <InputClaims>
  15.             <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="client_credentials" AlwaysUseDefaultValue="true" />
  16.             <InputClaim ClaimTypeReferenceId="scope" DefaultValue="api://xxxxxxxx/.default" AlwaysUseDefaultValue="true" />
  17.           </InputClaims>
  18.           <OutputClaims>
  19.             <OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="access_token" />
  20.           </OutputClaims>
  21.           <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
  22.         </TechnicalProfile>

Please help

答案1

得分: 0

以下是您要翻译的内容：

"grant_type" 和 "scope" 声明在 REST-AcquireAccessToken 和 login-NonInteractive 技术配置文件中都有使用。我认为您在 REST-AcquireAccessToken 技术配置文件中使用的值正在覆盖 login-NonInteractive 中的默认值。

在 REST-AcquireAccessToken 技术配置文件中，使用不同名称的声明以及正确的 PartnerClaimType。

示例：

  1. <!-- ClaimsSchema -->
  3. <ClaimType Id="IntApigrant_type">
  4.     <DisplayName>授权类型</DisplayName>
  5.     <DataType>string</DataType>
  6. </ClaimType>
  8. <ClaimType Id="IntApiscope">
  9.     <DisplayName>范围</DisplayName>
  10.     <DataType>string</DataType>
  11. </ClaimType>
  13. <!-- REST-AcquireAccessToken -->
  15. <InputClaims>
  16.     <InputClaim ClaimTypeReferenceId="IntApigrant_type" PartnerClaimType="grant_type" DefaultValue="client_credentials" AlwaysUseDefaultValue="true" />
  17.     <InputClaim ClaimTypeReferenceId="IntApiscope" PartnerClaimType="scope" DefaultValue="{Settings:IntermediateApiScope}" AlwaysUseDefaultValue="true" />
  18. </InputClaims>

或者您可以在 login-NonInteractive 配置文件中为这两个声明添加 AlwaysUseDefaultValue="true"。

英文:

The grant_type and scope claims are used in both REST-AcquireAccessToken and login-NonInteractive technical profiles. I believe the values that you used in REST-AcquireAccessToken technical profile is overriding the default values in login-NonInteractive.

Use claims with different names along with proper PartnerClaimType in REST-AcquireAccessToken technical profile.

example:

  1. &lt;!-- ClaimsSchema --&gt;
  3. &lt;ClaimType Id=&quot;IntApigrant_type&quot;&gt;
  4.     &lt;DisplayName&gt;Grant type&lt;/DisplayName&gt;
  5.     &lt;DataType&gt;string&lt;/DataType&gt;
  6. &lt;/ClaimType&gt;
  8. &lt;ClaimType Id=&quot;IntApiscope&quot;&gt;
  9.     &lt;DisplayName&gt;scope&lt;/DisplayName&gt;
  10.     &lt;DataType&gt;string&lt;/DataType&gt;
  11. &lt;/ClaimType&gt;
  13. &lt;!-- REST-AcquireAccessToken --&gt;
  15. &lt;InputClaims&gt;
  16.     &lt;InputClaim ClaimTypeReferenceId=&quot;IntApigrant_type&quot; PartnerClaimType=&quot;grant_type&quot; DefaultValue=&quot;client_credentials&quot; AlwaysUseDefaultValue=&quot;true&quot; /&gt;
  17.     &lt;InputClaim ClaimTypeReferenceId=&quot;IntApiscope&quot; PartnerClaimType=&quot;scope&quot; DefaultValue=&quot;{Settings:IntermediateApiScope}&quot; AlwaysUseDefaultValue=&quot;true&quot; /&gt;
  18. &lt;/InputClaims&gt;

Or you can put AlwaysUseDefaultValue="true" in login-NonInteractive for those two claims.

huangapple
  • 本文由 发表于 2023年6月8日 05:49:37
  • 转载请务必保留本文链接：https://go.coder-hub.com/76427310.html
  • aad-b2c
  • azure
  • azure-ad-b2c
  • azure-ad-b2c-custom-policy
  • azure-b2c
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定