azure-ad-b2c -如何检查电子邮件和电话号码是否与现有用户匹配

Question

在允许用户更改密码之前，我试图验证他们的电子邮件和电话是否符合Azure B2C中现有的密码。如果我删除电话#并只验证电子邮件

我想知道是否有人能帮我。

下面是我的自定义策略来验证它：

​

<TechnicalProfile Id="AAD-UserReadUsingEmailAddressAndPhoneNo">
          <Metadata>
            <Item Key="Operation">Read</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
            <InputClaim ClaimTypeReferenceId="signInNames.phoneNumber" Required="true" />
          </InputClaims>
          <OutputClaims>
            <!-- Required claims -->
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
            <OutputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" />
            <!-- Optional claims -->
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="displayName" />
            <OutputClaim ClaimTypeReferenceId="accountEnabled" />
            <OutputClaim ClaimTypeReferenceId="otherMails" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
            <OutputClaim ClaimTypeReferenceId="signInNames.phoneNumber" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
          </OutputClaimsTransformations>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
        </TechnicalProfile>

​

​

<ClaimType Id="signInNames.phoneNumber">
        <DisplayName>+1XXX</DisplayName>
        <DataType>phoneNumber</DataType>
        <DefaultPartnerClaimTypes>
          <Protocol Name="OpenIdConnect" PartnerClaimType="phone_number" />
        </DefaultPartnerClaimTypes>
        <UserHelpText>Phone Number that can be used to contact you.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>

​

​

<ClaimsProvider>
      <DisplayName>Local Account</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddress_Custom">
          <DisplayName>Reset password using email address</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
          </Metadata>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="email" Required="true" />
            <OutputClaim ClaimTypeReferenceId="signInNames.phoneNumber" Required="true" />
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" />
            <OutputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddressAndPhoneNo" />
          </ValidationTechnicalProfiles>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

​

Answer 1

您可能需要验证是否将电话号码存储为signInNames.phoneNumber，而不是其他电话号码类型之一(如strongAuthenticationPhoneNumber)。我知道这听起来很明显，但有时会发生。

它也可能有助于将检查分成多个部分。首先检查电子邮件地址，然后使用UserReadUsingEmailAddress获取用户电话号码(或其中的一些变化)，然后使用第二个VTP断言您从帐户中提取的电话号码与用户键入的电话号码匹配。