Require Input Claims From JWT From RelyingParty in

2019-07-27 13:28发布

问题:

I'm sending hidden claims to B2C via a JWT following the WingTig Games demo code. How do I require claim(s) to be sent by the relying party? And if they are not sent, prevent the sign-up process? And provide my own error message to the user? These fields will be hidden from the user.

I tried adding required in my leaf policy in the RelyingParty node but it let me through. I tried adding required to my TechnicalProfile node but it let me through.

<InputClaims>
    <InputClaim ClaimTypeReferenceId="extension_my_claim" Required="true"/>
</InputClaims>

回答1:

As a workaround, you can add pre-condition to steps 1&2 then add additional step with your customer error page.

In the XML snippet below, I have added pre-conditions that run the steps 1&2 only if your claim exists, otherwise skip to the next step. On sept 3, the pre-condition is run only if the claims does not exist, then display custom page. It’s just an example, in your case you can add your own error page.

<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
  <Preconditions>
    <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
      <Value>{your claim name}</Value>
      <Action>SkipThisOrchestrationStep</Action>
    </Precondition>
  </Preconditions>
  <ClaimsProviderSelections>
    <ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange" />
    <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
  </ClaimsProviderSelections>
  <ClaimsExchanges>
    <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
  </ClaimsExchanges>
</OrchestrationStep>
<!-- Check if the user has selected to sign in using one of the social providers -->
<OrchestrationStep Order="2" Type="ClaimsExchange">
  <Preconditions>
    <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
      <Value>{your claim name}</Value>
      <Action>SkipThisOrchestrationStep</Action>
    </Precondition>
  </Preconditions>

  <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
    <Value>registrationSource</Value>
    <Action>SkipThisOrchestrationStep</Action>
  </Precondition>

  </Preconditions>
  <ClaimsExchanges>
    <ClaimsExchange Id="FacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH" />
    <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
  </ClaimsExchanges>
</OrchestrationStep>

<!-- Error message-->
<OrchestrationStep Order="3" Type="ReviewScreen" ContentDefinitionReferenceId="api.selfasserted">
  <Preconditions>
    <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
      <Value>registrationSource</Value>
      <Action>SkipThisOrchestrationStep</Action>
    </Precondition>
  </Preconditions>
</OrchestrationStep>


<!-- Rest of the UserJourney -->
</OrchestrationSteps>
</UserJourney> 

Locate the <ContentDefinitions> element, and add following XML

<ContentDefinition Id=" api.inputtoken.error ">
   <LoadUri>~/tenant/default/selfAsserted.cshtml</LoadUri>
   <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
   <DataUri>urn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0</DataUri>
   <Metadata>
       <Item Key="DisplayName">Collect information from user page</Item>
   </Metadata>
</ContentDefinition>

Change the LoadUri value to point to your HTML error page