Azure B2C防止用户输入

Question

我在Azure B2C租户上发布了一个应用程序。有两个auth方法，一个是联邦SAML提供者，另一个是常规Azure AD租户。我希望避免外部SAML的用户被保存在我的Azure B2C租户中。对于每个成功登录的用户，都会在我的Azure B2C租户中创建一个用户条目。如何防止b2c租户中的用户条目？这是我的用户之旅：

  <UserJourneys>
    <UserJourney Id="UDIMASignUpOrSignIn">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <!-- <ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange" /> -->
            <ClaimsProviderSelection TargetClaimsExchangeId="CEF" />
            <ClaimsProviderSelection TargetClaimsExchangeId="UDIMA" />
          </ClaimsProviderSelections>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <!-- <ClaimsExchange Id="FacebookExchange" TechnicalProfileReferenceId="Facebook-OAUTH" /> -->
            <ClaimsExchange Id="CEF" TechnicalProfileReferenceId="AADCEF-OpenIdConnect" />
            <ClaimsExchange Id="UDIMA" TechnicalProfileReferenceId="Saml2AssertionIssuer" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- For social IDP authentication, attempt to find the user account in the directory. -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- For social IDP authentication, attempt to find the user account in the directory. -->
        <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect
             from the user. So, in that case, create the user in the directory if one does not already exist
             (verified using objectId which would be set from the last step if account was created in the directory. -->
        
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        
        <!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId).  -->
        
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />
          </ClaimsExchanges>
        </OrchestrationStep>
        
        <!-- <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="AADCEF-OpenIdConnect" /> -->
        <OrchestrationStep Order="6" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
  </UserJourneys>

Answer 1

请检查所提供的参考资料是否可以使用。

默认情况下，对于外部标识，Azure AD B2C将在其自己的目录.So one中创建一个用户对象(objectID) --它可能能够存储由外部IdP断言的声明，还可以使用由该外部标识创建的最终用户声明或您自己的application.Object id来传递到下一步处理和使用。

Azure中的ObjectID属性通常保存在带有identityProvider的alternateSecurityID中。

<OutputClaims>
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid"/>
<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
</OutputClaims>

<OutputClaimsTransformations>
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
</OutputClaimsTransformations>

参考： 使用溢出查询联邦身份的B2C

请检查用户是否已与其objectId和颁发者(身份提供程序)进行检查，以解除链接或阻止登录或删除该用户标识。

<ClaimsTransformation Id="RemoveUserIdentityFromCollectionByIssuer" TransformationMethod="RemoveUserIdentityFromCollectionByIssuer">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="issuerToUnlink" TransformationClaimType="issuer" />
          <InputClaim ClaimTypeReferenceId="userIdentities" TransformationClaimType="collection" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="userIdentities" TransformationClaimType="collection" />
        </OutputClaims>
  </ClaimsTransformation>

有关详细信息，请查看active-directory-b2c-advanced-policies/TRUSTFRAMEWORKBASE.xml·GitHub。

如果需要的话，也是Azure B2c如何防止用户登录直到管理员批准-堆栈溢出。

参考：

active-directory-b2c-advanced-policies/account-linking at master·Azure-Samples/active-directory-b2c-advanced-policies·GitHub