Azure AD B2C自定义策略旁路或跳过特定的电话号码编排流程

Question

我们使用的是Azure AD B2C电话号码OTP身份验证流程，因此我们需要运行自动化测试，因此我们需要跳过OTP验证步骤。下面是B2C_1A_PH_SUSI文件代码。

<UserJourney Id="PhoneSignInUp">
  <OrchestrationSteps>
    <!--
       Ask the user for the phone number. 
       The ValidationTechnicalProfile tries to read the user from the directory using the phone number
    -->
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="SignIn" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Username" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 
      Verify the phone number via SMS or Callback
     -->
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>isActiveMFASession</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      <ClaimsExchanges>
        <ClaimsExchange Id="PhoneFactor-Verify" TechnicalProfileReferenceId="PhoneFactor-InputOrVerify-PhoneLogon" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- 
      If the user didn't exist previously, create the object in the directory
    -->
    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>objectId</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserWriteUser" TechnicalProfileReferenceId="AAD-UserWriteUsingPhoneNumber" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!--
      return the JWT token
    -->
    <OrchestrationStep Order="4" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

Answer 1

想必，对于自动化测试，您是使用ROPC登录用户吗？

在这种情况下，在PhoneFactor周围添加一个先决条件，检查ROPC用户并跳过步骤。

只需给用户一个“奇怪”的登录名-很多q/z/x等等:-)很难猜到安全性。

Answer 2

我找到了一种绕过OTP的方法，方法是添加一个先决条件值块，给出您想跳过<Value>+91xxxxxxxx</Value>的编号，请参阅下面的

<!-- 
      Verify the phone number via SMS or Callback
     -->
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
          <Value>isActiveMFASession</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
        

        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>signinnames.phoneNumber</Value>
          <Value>+91xxxxxxxx</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>

     </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="PhoneFactor-Verify" TechnicalProfileReferenceId="PhoneFactor-InputOrVerify-PhoneLogon" />
      </ClaimsExchanges>
    </OrchestrationStep>