使用 azure b2c、MFA 和 REST API 时如何重置 MFA 并获得新的 QR

Question

我已经按照https://github.com/azure-ad-b2c/samples/tree/master/policies/custom-mfa-totp在 azure B2C 中构建 MFA 并且它工作正常。 只是一个问题，在用户扫描二维码并注册手机后，如果他们想使用另一部手机或重置他们的MFA，他们如何重新获得二维码？

Answer 1

任何类型的帐户管理都应存在于“配置文件编辑”策略中。 此示例不包含它。 您需要从 TrustFrameworkExtensions.xml 中提取组件，例如AppFactor-Register 、 AppFactor-Challenge等技术配置文件，并将其添加到 ProfileEdit 的新用户旅程中 - 可能会创建全新的体验。 当然，将需要将写入技术配置文件添加回目录以“更新”存储的任何信息。

实现您的场景的大多数组件已经在此示例中存在 - 只需创建一个名为“ProfileEditwithQR”或其他内容的新用户旅程，然后将入门包 profileEdit 用户旅程复制到您的扩展文件（如果您还没有这样做）-然后将此示例中的步骤添加到其中。

这将要求您至少具备 300 级有关自定义策略的知识才能将它们组合在一起。

Answer 2

我创建了一个允许重新创建二维码的策略。

先决条件：您已经能够在您的租户中运行此示例。

将此添加到TrustFrameworkExtension.xml ：

<UserJourney Id="EditQR" DefaultCpimIssuerTechnicalProfileReferenceId="JwtIssuer">
  <OrchestrationSteps>

    <OrchestrationStep Order="1" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
      <ClaimsProviderSelections>
        <ClaimsProviderSelection TargetClaimsExchangeId="LocalAccountSigninEmailExchange" />
      </ClaimsProviderSelections>
    </OrchestrationStep>
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is alwasy executed. 
    It generates a verification app secret key for the user (none interactive step). -->
    <OrchestrationStep Order="4" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AppFactorGenerateTotpWebHook" TechnicalProfileReferenceId="AppFactor-GenerateTotpWebHook" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is alwasy executed. 
    It registers a verification app through QR code that mobile authentication app should scan. -->
    <OrchestrationStep Order="5" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AppFactorRegisterExchange" TechnicalProfileReferenceId="AppFactor-Register" />
      </ClaimsExchanges>
    </OrchestrationStep>

    <!-- Demo: The following orchestration step is always executed.
    It updates the verification app time step matched for a given user in the Azure Active Directory.
    An error is raised if the user does not exist. -->
    <OrchestrationStep Order="6" Type="ClaimsExchange">
      <ClaimsExchanges>
        <ClaimsExchange Id="AADWriteUserAppCodeByObjectId" TechnicalProfileReferenceId="AAD-WriteUserAppCodeByObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
    
    <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />

  </OrchestrationSteps>
  <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

这是新的用户流程，我称之为EditQR.xml ：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<TrustFrameworkPolicy
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
  PolicySchemaVersion="0.3.0.0"
  TenantId="yourtenant.onmicrosoft.com"
  PolicyId="B2C_1A_editQr"
  PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_editQr">

  <BasePolicy>
    <TenantId>yourtenant.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
  </BasePolicy>

  <RelyingParty>
    <DefaultUserJourney ReferenceId="EditQR" />

    <UserJourneyBehaviors>
      <ScriptExecution>Allow</ScriptExecution>
    </UserJourneyBehaviors>
    
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
        <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />
    </TechnicalProfile>
  </RelyingParty>
</TrustFrameworkPolicy>

使用http://jwt.ms测试，您将被提示登录，然后重定向到 QR 页面。

干杯!