0

我正在尝试将 e msal 2.0 (msal-browser) 用于我的 react 应用程序以使用 Azure AD B2C 自定义策略进行身份验证，但我没有任何适当的文档或示例

4

2 回答 2

0

（从评论转移到答案）

MSAL.js 2.0 当前不支持 Azure AD B2C 与 PKCE 授权代码流一起使用。目前，Azure AD B2C 建议使用隐式流。

请参阅文档Note中的更多信息，您可以在GitHub库中看到它被声明为尚不适用于 B2C。

于 2020-10-08T17:35:33.463 回答
0

此示例应该对您有用，它使用Azure AD B2C + 自定义策略 + MSAL.js 2.0 + 授权代码流。

<!-- The AAD Common Endpoint Claims Provider. Matches on the existence of AAD-Common in the claimsProvider collection -->
<ClaimsProvider>
  <DisplayName>Login with AAD OIDC</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="AAD-OIDC">
      <DisplayName>Login with AAD (OIDC)</DisplayName>
      <Description>Login with AAD (OIDC)</Description>
      <Protocol Name="OpenIdConnect" />
      <OutputTokenFormat>JWT</OutputTokenFormat>
      <Metadata>
        <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
        <!-- TODO: Create multi-tenant App Registration and add client ID here -->
        <Item Key="client_id">xxxxx</Item>
        <Item Key="response_types">code</Item>
        <Item Key="scope">openid profile</Item>
        <Item Key="response_mode">form_post</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="UsePolicyInRedirectUri">false</Item>
        <Item Key="DiscoverMetadataByTokenIssuer">true</Item>
        <!-- TODO: Add the Tenant IDs of each Valid Token Issuer -->
        <!-- The key below allows you to specify each of the Azure AD tenants that can be used to sign in. Update the GUIDs below for each tenant. -->
        <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/xxxxx</Item>
        <Item Key="ClaimTypeOnWhichToEnable">claimsProvider</Item>
        <Item Key="ClaimValueOnWhichToEnable">AAD-Common</Item>
      </Metadata>
      <CryptographicKeys>
        <!-- TODO: Update the storage reference ID for the client secret of the Multi-Tenant App Registration Client -->
        <Key Id="client_secret" StorageReferenceId="B2C_1A_ADDMultiTenantAngularSPA" />
      </CryptographicKeys>
      <InputClaims>
        <!--pass the login_hint to Azure AD home realm discovery page to bypass email address entry again-->
        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="login_hint" />
        <!--Disable the prompt on the partner IdP to "Sign in with another account"-->
        <InputClaim ClaimTypeReferenceId="hsu" PartnerClaimType="hsu" DefaultValue="1" AlwaysUseDefaultValue="true" />
      </InputClaims>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
        <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
      <EnabledForUserJourneys>OnItemExistenceInStringCollectionClaim</EnabledForUserJourneys>
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>
于 2020-10-01T07:24:28.180 回答