Azure B2C 无密码注册仅使用自定义策略中的电子邮件

Question

My system needs to use passwordless with email authentication in both sign up & sign in.
That mean user just needs to enter an email, then the system will send the one time passcode into that emai & let user sign in (if there is no account yet, just create a new one with that email silently with default information)
I tried this sample & it works for exist local users (with email & password)
Is there anyway to create local user with only email? My users just see the input email screen & the input passcode screen. They don't need to fill anything else.

Answer 1

When a local user account is created, the password property must be set, which is why that sample flow prompts the new user for this.

If you don't want to prompt for this, then the password property can be set to a random value, as follows.

1. Remove the newPassword and reenterPassword claims as output claims from the LocalAccountSignUpWithLogonEmail technical profile:

<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
  ...
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
    <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
    <OutputClaim ClaimTypeReferenceId="authenticationSource" />
    <OutputClaim ClaimTypeReferenceId="newUser" />

    <!-- Optional claims, to be collected from the user -->
    <OutputClaim ClaimTypeReferenceId="displayName" />
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="surName" />
  </OutputClaims>
  ...
</TechnicalProfile>

2. For the AAD-UserWriteUsingLogonEmail technical profile, add an input claims transformation to that generates the new password and set the accountEnabled property to false so that the new user can't sign in with the generated password:

<TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
  ...
  <InputClaimsTransformations>
    <InputClaimsTransformation ReferenceId="GenerateNewPassword" />
  </InputClaimsTransformations>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
  </InputClaims>
  <PersistedClaims>
    <PersistedClaim ClaimTypeReferenceId="accountEnabled" DefaultValue="false" AlwaysUseDefaultValue="true" />
    <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
    <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password"/>
    <PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration,DisableStrongPassword" />
    ...
  </PersistedClaims>
</TechnicalProfile>

3. Declare the accountEnabled claim as follows:

<ClaimType Id="accountEnabled">
  <DisplayName>Account Enabled</DisplayName>
  <DataType>boolean</DataType>
</ClaimType>

4. Declare the GenerateNewPassword claims transformation of type CreateRandomString as follows:

<ClaimsTransformation Id="GenerateNewPassword" TransformationMethod="CreateRandomString">
  <InputParameters>
    <InputParameter Id="randomGeneratorType" DataType="string" Value="GUID" />
  </InputParameters>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="newPassword" TransformationClaimType="outputClaim" />
  </OutputClaims>
</ClaimsTransformation>

Answer 2

我已经用第二个示例更新了政策https://github.com/azure-ad-b2c/samples/tree/master/policies/passwordless-email