Fatal编程技术网
  • azure-ad-b2c/
  • Azure ad b2c Azure AD B2C本地帐户密码在几个小时后停止工作

Azure ad b2c Azure AD B2C本地帐户密码在几个小时后停止工作

azure-ad-b2c

Azure ad b2c Azure AD B2C本地帐户密码在几个小时后停止工作,azure-ad-b2c,Azure Ad B2c,我已经根据中的示例为社会和本地帐户创建了自定义策略。我已经启用了Microsoft和Google的登录功能，并测试了这两种功能，我还启用了使用本地帐户登录 我看到的问题是当地账户。我可以创建一个密码，密码可以正常工作几个小时（不确定具体多长时间），然后开始给出一个通用的“无效用户名或密码”。错误。当我为同一用户输入错误的密码时，我会收到另一条消息“您的密码不正确”（这对应于相关的日志条目） 我已启用应用程序洞察，只能找到以下例外情况 关于如何清除这两个错误的任何帮助都将非常有用 “Stateba

我已经根据中的示例为社会和本地帐户创建了自定义策略。我已经启用了Microsoft和Google的登录功能，并测试了这两种功能，我还启用了使用本地帐户登录

我看到的问题是当地账户。我可以创建一个密码，密码可以正常工作几个小时（不确定具体多长时间），然后开始给出一个通用的“无效用户名或密码”。错误。当我为同一用户输入错误的密码时，我会收到另一条消息“您的密码不正确”（这对应于相关的日志条目）

我已启用应用程序洞察，只能找到以下例外情况

关于如何清除这两个错误的任何帮助都将非常有用

“Statebag”：{
“复杂CLMS”“：{}，
“”验证请求“”：{
“内容类型”：“未指定”，
“已创建”：“2017-10-04T19:17:49.2510644Z”，
“”键“”：“”验证请求“”，
“持久的”：对，
“”值“”：“”客户端\u id=307&resource=cf87&username=user%domain.com&password=fakep@ss！123&grant_type=password&scope=openid&nca=1；1；登录非交互式；False“”
},
“”验证响应“”：{
“内容类型”：“Json”，
“已创建”：“2017-10-04T19:17:49.2510644Z”，
“”键“”：“”验证响应“”，
“持久的”：对，
“值”：“{\”错误：：“无效的授权”，“错误描述”：”AADSTS65001:用户或管理员未同意使用ID为“307”且名为“IdentityExperienceFramework”的应用程序。请为此用户和资源发送交互式授权请求。\\r\\n访问ID:7c4\\r\\n相关ID:3cc\\r\\nTimestamp:2017-10-04 19:17:49Z\，“错误代码”：[65001]，“时间戳”：2017-10-04 19:17:49Z\，“跟踪id\：”7c4\，“相关性id\：”3cc\”；1；非交互登录；错误
},
“复杂项”：“机器事件、报告、TCTX、M\U EXCP”
}
这是第二个例外

“键”：“异常”，
“价值”：{
“种类”：“处理过的”，
“HResult”：“80131500”，
“Message”“：”“如果存储索赔的索赔主体记录已存在，则策略id”“B2C”“租户id”“xxx.onmicrosoft.com”“中id为”“AAD UserWriteUsingLogonEmail”“的技术配置文件要求引发错误。标识符索赔类型id为”“signInNames.emailAddress”“的类型为”“User”“的索赔主体\“”已存在。“”，
“数据”：{
“IsPolicySpecificError”：true，
“租户”：“xxx.onmicrosoft.com”，
“PolicyId”：“B2C注册”，
“TechnicalProfile.Id”“：”“AAD UserWriteUsingLogonEmail”“，
“ClaimsPrincipal.IdentifierClaim.ClaimTypeId”“：”“signInNames.emailAddress”“，
“ClaimsPrincipal.PrincipalType”“：”“用户”“，
“CreateClaimsPrincipalIfItDoesNotExist”“：”“True”“，
“RaiserRorifClaimsPrincipalalReadyExists”“：“True”“，
“RaiseErrorIfClaimsPrincipalDoesNotExist”“：”“False”
}
}

这是TrustFrameworkExtensions.xml文件的内容。它与示例之间的唯一区别是我使用了2个提供程序，而不是1个

<?xml version="1.0" encoding="utf-8" ?>
<TrustFrameworkPolicy 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
  xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" 
  PolicySchemaVersion="0.3.0.0" 
  TenantId="xxx.onmicrosoft.com" 
  PolicyId="B2C_1A_TrustFrameworkExtensions" 
  PublicPolicyUri="http://xxx.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions">

  <BasePolicy>
    <TenantId>xxx.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkBase</PolicyId>
  </BasePolicy>
  <BuildingBlocks>

  </BuildingBlocks>

  <ClaimsProviders>

    <ClaimsProvider>
      <DisplayName>Local Account SignIn</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="login-NonInteractive">
          <Metadata>
            <Item Key="client_id">307</Item>
            <Item Key="IdTokenAudience">cf8</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="307" />
            <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="cf8" />
          </InputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

    <ClaimsProvider>
        <Domain>Employee SignIn with Azure AD</Domain>
        <DisplayName>Employee Login</DisplayName>
        <TechnicalProfiles>
            <TechnicalProfile Id="AzureADProfile">
                <DisplayName>Employee Login</DisplayName>
                <Description>Login with your GP account</Description>
                <Protocol Name="OpenIdConnect"/>
                <OutputTokenFormat>JWT</OutputTokenFormat>
                <Metadata>
                    <Item Key="METADATA">https://login.windows.net/yyy.onmicrosoft.com/.well-known/openid-configuration</Item>
                    <Item Key="ProviderName">https://sts.windows.net/7de/</Item>
                    <Item Key="client_id">f19</Item>
                    <Item Key="IdTokenAudience">f19</Item>
                    <Item Key="response_types">id_token</Item>
                    <Item Key="UsePolicyInRedirectUri">false</Item>
                </Metadata>
                <CryptographicKeys>
                    <Key Id="client_secret" StorageReferenceId="B2C_1A_AzureADAppSecret"/>
                </CryptographicKeys>
                <OutputClaims>
                    <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="oid"/>
                    <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
                    <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
                    <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
                    <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
                    <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="contosoAuthentication" />
                    <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="AzureADContoso" />
                </OutputClaims>
                <OutputClaimsTransformations>
                    <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
                    <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
                    <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
                    <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
                </OutputClaimsTransformations>
                <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/>
            </TechnicalProfile>
        </TechnicalProfiles>
    </ClaimsProvider>

    <ClaimsProvider>
      <Domain>google.com</Domain>
      <DisplayName>Google</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="Google-OAUTH">
            <DisplayName>Employee Login</DisplayName>
            <Protocol Name="OAuth2" />
            <Metadata>
            <Item Key="ProviderName">google</Item>
            <Item Key="authorization_endpoint">https://accounts.google.com/o/oauth2/auth</Item>
            <Item Key="AccessTokenEndpoint">https://accounts.google.com/o/oauth2/token</Item>
            <Item Key="ClaimsEndpoint">https://www.googleapis.com/oauth2/v1/userinfo</Item>
            <Item Key="scope">email</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="UsePolicyInRedirectUri">0</Item>
            <Item Key="client_id">zzz.apps.googleusercontent.com</Item>
            </Metadata>
            <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_GoogleSecret" />
            </CryptographicKeys>
            <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="id" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
            <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
            <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="google.com" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
            </OutputClaims>
            <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
            <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
            <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
            <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
            </OutputClaimsTransformations>
            <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
            <ErrorHandlers>
            <ErrorHandler>
                <ErrorResponseFormat>json</ErrorResponseFormat>
                <ResponseMatch>$[?(@@.error == 'invalid_grant')]</ResponseMatch>
                <Action>Reauthenticate</Action>
                <!--In case of authorization code used error, we don't want the user to select his account again.-->
                <!--AdditionalRequestParameters Key="prompt">select_account</AdditionalRequestParameters-->
            </ErrorHandler>
            </ErrorHandlers>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

  </ClaimsProviders>



  <UserJourneys>
      <UserJourney Id="SignUpOrSignInUsingAzureAD">
      <OrchestrationSteps>

        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>            
            <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="AzureADExchange" />
          </ClaimsProviderSelections>
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>

        </OrchestrationStep>

        <!-- Check if the user has selected to sign in using one of the social providers -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH" />
            <ClaimsExchange Id="AzureADExchange" TechnicalProfileReferenceId="AzureADProfile" />
            <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- For social IDP authentication, attempt to find the user account in the directory. -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>localAccountAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). 
          This can only happen when authentication happened using a social IDP. If local account was created or authentication done
          using ESTS in step 2, then an user account must exist in the directory by this time. -->
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent 
          in the token. -->
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>socialIdpAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect 
             from the user. So, in that case, create the user in the directory if one does not already exist 
             (verified using objectId which would be set from the last step if account was created in the directory. -->
        <OrchestrationStep Order="6" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />

      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
    </UserJourneys>

</TrustFrameworkPolicy>


xxx.onmicrosoft.com
B2C_1A_信托框架库
本地帐户登录
307
cf8
员工使用Azure AD登录
员工登录
员工登录
使用您的GP帐户登录
JWT
https://login.windows.net/yyy.onmicrosoft.com/.well-known/openid-configuration
https://sts.windows.net/7de/
f19
f19
身份证
假的
谷歌网站
谷歌
员工登录
谷歌
https://accounts.google.com/o/oauth2/auth
https://accounts.google.com/o/oauth2/token
https://www.googleapis.com/oauth2/v1/userinfo
电子邮件
邮递
0
zzz.apps.googleusercontent.com
json
$[？（@.error=='invalid_grant'）]
重新认证
目标
SkipThisOrchestrationStep
认证源
localAccountAuthentication
SkipThisOrchestrationStep

The user or administrator has not consented to use the application with ID '307' named 'IdentityExperienceFramework'.