ADB2C 自定义策略 - 验证针对字符串值的声明始终返回 true

Question

我有一个 id_token_hint，我正在从中读取扩展属性以检查该角色是否为管理员，如果是则不发布（跳过）令牌。

要检查用户是否是管理员，我正在执行以下操作

    <ClaimType Id="isAdmin">
    <DisplayName>Verify if user is Admin User</DisplayName>
    <DataType>boolean</DataType>
    <UserHelpText>Verify if user is Admin User</UserHelpText>
    </ClaimType>

声明转换

    <ClaimsTransformation Id="isAdminUser" TransformationMethod="CompareClaimToValue">
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="extension_role" TransformationClaimType="inputClaim1" />
    </InputClaims>
    <InputParameters>
      <InputParameter Id="compareTo" DataType="string" Value="Super Admin" />
      <InputParameter Id="operator" DataType="string" Value="equal" />
      <InputParameter Id="ignoreCase" DataType="string" Value="true" />
    </InputParameters>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="isAdmin" TransformationClaimType="outputClaim" />
    </OutputClaims>
    </ClaimsTransformation>

用户旅程

    <OrchestrationStep Order="5" Type="ClaimsExchange">
      <Preconditions>
         <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
           <Value>isAdminUser</Value>
           <Value>False</Value>
           <Action>SkipThisOrchestrationStep</Action>
         </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="AdminUserNotAllowed" TechnicalProfileReferenceId="AdminUserNotAllowed" />
      </ClaimsExchanges>
</OrchestrationStep>

问题是此条件对所有用户（以及非管理员）都返回 true。

从应用洞察：

    Claims 
email: myadmin@mailinator.com 
errorMessage: Admin user access via SignIn link is not allowed. Please access the application via normal SignIn 
extension_role: Super Admin
    
    Claims 
email: myorgadmin@abc.com 
errorMessage: Admin user access via SignIn link is not allowed. Please access the application via normal SignIn 
extension_role: Organization Admin RW

澄清我的要求是

if (extension_role === "Super Admin")
   //Do not allow magic signIn

我最初尝试过 ClaimEquals，但在所有情况下都返回了 true。

<OrchestrationStep Order="6" Type="ClaimsExchange">
  <Preconditions>
    <Precondition Type="ClaimEquals" ExecuteActionsIf="tru">
      <Value>extension_role</Value>
      <Value>Super Admin</Value>
      <Action>SkipThisOrchestrationStep</Action>
    </Precondition>
  </Preconditions>
  <ClaimsExchanges>
    <ClaimsExchange Id="SelfAssertedAgencyNotMatched" TechnicalProfileReferenceId="SelfAssertedAgencyNotMatched" />
  </ClaimsExchanges>
</OrchestrationStep>   

Answer 1

尝试这样的事情。

这使用 TransformationMethod="CompareClaims",