Azure ad b2c Azure AD B2C TOTP示例

试图让B2C TOTP示例正常工作，但在上载自定义策略文件时遇到问题。（此处为github回购：）

我从SocialAndLocalAccounts策略启动包中的TrustFrameworkBase.xml开始。在适当的位置添加我的租户并上传-成功。接下来，github repo中的TrustFrameworkExtensions.xml创建了WebApp GraphAPI DirectoryExtensions应用程序，如文档所示，再加上IdentityExperienceFramework应用程序和ProxyIdentityExperienceFramework应用程序。将ID放置在扩展策略文件中的适当位置并上载-我收到以下错误：

验证失败：在Microsoft.com上租户的策略“B2C_1A_TOTP_TRUSTFRAMEWORKEXTENSIONS”中发现2个验证错误。在Microsoft.com上租户的策略“B2C_1A_TOTP_TRUSTFRAMEWORKEXTENSIONS”中发现用户旅程“SignUpOrSignIn”“有步骤5和2个索赔交换。必须先选择索赔提供商，以确定可以使用哪种索赔交换。租户的“B2C_1A_TOTP_TrustFrameworkExtensions”策略中的用户旅程“SignUpOrSignIn”\uuuuu_____________________________________。它之前必须有索赔提供者选择，以便确定可以使用哪种索赔交换

有没有关于我遗漏了什么的建议

根据请求添加了SignUpOrSignIn用户旅程：

<UserJourney Id="SignUpOrSignIn">
  <OrchestrationSteps>

    <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
      <ClaimsProviderSelections>
        <ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange" />
        <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
      </ClaimsProviderSelections>
      <ClaimsExchanges>
        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Check if the user has selected to sign in using one of the social providers -->
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="FacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH" />
        <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- For social IDP authentication, attempt to find the user account in the directory. -->
    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>authenticationSource</Value>
          <Value>localAccountAuthentication</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). 
      This can only happen when authentication happened using a social IDP. If local account was created or authentication done
      using ESTS in step 2, then an user account must exist in the directory by this time. -->
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect 
         from the user. So, in that case, create the user in the directory if one does not already exist 
         (verified using objectId which would be set from the last step if account was created in the directory. -->
    <OrchestrationStep Order="5" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is always executed. 
     This step reads any user attributes that we may not have received when authenticating using ESTS so they 
     include the AppCode MFA attributes 
      in the token. -->
    <OrchestrationStep Order="6" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is executed only for unregistered 
    accounts (new created account or if user cancel the sign-up process). 
    It generates a verification app secret key for the user (none interactive step). -->
    <OrchestrationStep Order="7" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>extension_StrongAuthenticationAppSecretKey</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AppFactorGenerateTotpWebHook" TechnicalProfileReferenceId="AppFactor-GenerateTotpWebHook" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is executed only for unregistered 
    accounts (new created account or if user cancel the sign-up process). 
    It registers a verification app through QR code that mobile authentication app should scan. -->
    <OrchestrationStep Order="8" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
          <Value>strongAuthenticationAppQRCodeBitmap</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AppFactorRegisterExchange" TechnicalProfileReferenceId="AppFactor-Register" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is executed only for registered accounts.
    It asks the user to provide the TOTP code and verifies the provided code (using validation technical profile). -->
    <OrchestrationStep Order="9" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>strongAuthenticationAppQRCodeBitmap</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AppFactorChallengeExchange" TechnicalProfileReferenceId="AppFactor-Challenge" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is always executed.
    It updates the verification app time step matched for a given user in the Azure Active Directory.
    An error is raised if the user does not exist. -->
    <OrchestrationStep Order="10" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADWriteUserAppCodeByObjectId" TechnicalProfileReferenceId="AAD-WriteUserAppCodeByObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <OrchestrationStep Order="11" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />

  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

目标
SkipThisOrchestrationStep
认证源
localAccountAuthentication
SkipThisOrchestrationStep
目标
SkipThisOrchestrationStep
目标
SkipThisOrchestrationStep
扩展名\u strong AuthenticationAppSecretKey
SkipThisOrchestrationStep
strong身份验证AppQRCodeBitmap
SkipThisOrchestrationStep
strong身份验证AppQRCodeBitmap
SkipThisOrchestrationStep

当您有两个相同Id的用户旅行时会发生这种情况。

当您有两个相同Id的用户旅行时会发生这种情况。

您可以在用户旅行定义中发布注册人签名吗？此外，您还可以尝试重命名用户旅程，因为如果它们具有相同的名称，则很可能会覆盖基本文件中的用户旅程。这在过去引起了非常奇怪的问题。我想我的第一个错误是认为其中一个样本确实有效！！我将把注册人Signin Travel添加到原来的帖子中。看看这段旅程，听起来肯定发生了合并。你能尝试更改旅行Id吗？重命名它。现在获取此错误：验证失败：在租户“certificateservices.onmicrosoft.com”的策略“B2C_1A_TOTP_SIGNUP_SIGNIN”中发现1个验证错误。启用JavaScript时，请在内容定义中使用页面契约。我已经将：contract添加到所有datauri值中-但我缺少了其他内容？将datauri idpselection更改为providerselection并将contract添加到所有uri中使我克服了此错误-现在，我的新signuporsignin策略生成了一个与AppFactor GenerateTopWebhook配置文件的身份验证模式相关的不同错误-需要将AllowInsecureAuthInProduction设置为true-我会研究一下-感谢您的帮助您可以发布注册者登录用户旅程定义吗？此外，您还可以尝试重命名用户旅程，因为如果它们具有相同的名称，则很可能会覆盖基本文件中的用户旅程。这在过去引起了非常奇怪的问题。我想我的第一个错误是认为其中一个样本确实有效！！我将把注册人Signin Travel添加到原来的帖子中。看看这段旅程，听起来肯定发生了合并。你能尝试更改旅行Id吗？重命名它。现在获取此错误：验证失败：在租户“certificateservices.onmicrosoft.com”的策略“B2C_1A_TOTP_SIGNUP_SIGNIN”中发现1个验证错误。启用JavaScript时，请在内容定义中使用页面契约。我已经将：contract添加到所有datauri值中-但我缺少了其他内容？将datauri idpselection更改为providerselection并将contract添加到所有uri中使我克服了此错误-现在，我的新signuporsignin策略生成了一个与AppFactor GenerateTopWebhook配置文件的身份验证模式相关的不同错误-需要将AllowInsecureAuthInProduction设置为true-我将对此进行一点研究-感谢您的帮助谢谢-这是其他任何关注此主题的人的答案Hanks-这是其他任何关注此主题的人的答案