AADB2C90238：提供的令牌不包含有效的頒發者。請提供另一個令牌並重試

Question

我正在使用 ADB2C 並添加 AAD 作為 Home realm 發現的身份提供者。 HRD 按預期工作，它根據域將用戶重定向到 AAD（ https://login.microsoftonline.com ）進行身份驗證，在成功身份驗證后，它重定向到 jwt.ms 並顯示“AADB2C90238：提供的令牌不包含有效的頒發者. 請提供另一個令牌，然后重試。” 錯誤代碼。 以下是我的技術簡介和用戶旅程。

      <TechnicalProfiles>
                <TechnicalProfile Id="AAD-OIDC">
                    <DisplayName>Login with AAD (OIDC)</DisplayName>
                    <Description>Login with AAD (OIDC)</Description>
                    <Protocol Name="OpenIdConnect" />
                    <OutputTokenFormat>JWT</OutputTokenFormat>
                    <Metadata>
                        <Item Key="METADATA">https://login.microsoftonline.com/CloudSolution2022.onmicrosoft.com/.well-known/openid-configuration</Item>
                        <Item Key="ProviderName">https://sts.windows.net/ffc9d30c-a7e7-486d-bbcd-66d88af6f4c9/</Item>
                        <Item Key="client_id">8d102d89-864e-417e-912d-3e3441cc4bf5</Item>
                        <Item Key="IdTokenAudience">8d102d89-864e-417e-912d-3e3441cc4bf5</Item>
                        <Item Key="UsePolicyInRedirectUri">false</Item>
                        <Item Key="resource">https://graph.windows.net</Item>
                        <Item Key="response_types">id_token</Item>
                        <Item Key="scope">openid</Item>
                        <Item Key="response_mode">form_post</Item>
                        <Item Key="HttpBinding">POST</Item>
                        <Item Key="ClaimTypeOnWhichToEnable">identityProviders</Item>
                        <Item Key="ClaimValueOnWhichToEnable">cloud-solutions.co.in</Item>
                    </Metadata>
                    <CryptographicKeys>
                        <Key Id="client_secret" StorageReferenceId="B2C_1A_aadSecretFederation" />
                    </CryptographicKeys>
                    <InputClaims>
                        <!--Demo: pass the login_hint to Azure AD home realm discovery page-->
                        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="CloudSolution" />
                    </InputClaims>
                    <OutputClaims>
                        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
                        <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" />
                        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
                        <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
                        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
                        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
                        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="AADOIDCIDP" AlwaysUseDefaultValue="true" />
                        <OutputClaim ClaimTypeReferenceId="email" />
                    </OutputClaims>
                    <OutputClaimsTransformations>
                        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
                        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
                        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
                        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
                    </OutputClaimsTransformations>
                    <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
                    <EnabledForUserJourneys>OnItemExistenceInStringCollectionClaim</EnabledForUserJourneys>
                </TechnicalProfile>
            </TechnicalProfiles>

用戶旅程

   <UserJourney Id="SignIn">

            <OrchestrationSteps>
                <OrchestrationStep Order="1" Type="ClaimsExchange">
                    <ClaimsExchanges>
                        <ClaimsExchange Id="SigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-Signin-Email" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <OrchestrationStep Order="2" Type="ClaimsExchange">
                    <ClaimsExchanges>
                        <ClaimsExchange Id="ParseDomainHintLogic" TechnicalProfileReferenceId="HRDLogic" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <!-- If the domain_hint did not match any known domain, then redirect to a default local account sign in-->
                <OrchestrationStep Order="3" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
                    <Preconditions>
                        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
                            <Value>isKnownCustomer</Value>
                            <Value>True</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsProviderSelections>
                        <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
                    </ClaimsProviderSelections>
                    <ClaimsExchanges>
                        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
                    </ClaimsExchanges>
                </OrchestrationStep>
                <!-- dont run this step if the domain was known, or we have an objectid (local account sign in)-->
                <OrchestrationStep Order="4" Type="ClaimsExchange">
                    <Preconditions>
                        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                            <Value>objectId</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
                            <Value>isKnownCustomer</Value>
                            <Value>True</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsExchanges>
                        <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <!-- If the domain matched any known domain, then this step will have a single IdP
                    enabled due to each known IdP TP having an enablement flag via identityProviders claim -->
                <OrchestrationStep Order="5" Type="ClaimsProviderSelection" ContentDefinitionReferenceId="api.idpselections">
                    <Preconditions>
                        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
                            <Value>isKnownCustomer</Value>
                            <Value>True</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsProviderSelections>
                        <ClaimsProviderSelection TargetClaimsExchangeId="AADOIDC" />
                    </ClaimsProviderSelections>
                </OrchestrationStep>

                <OrchestrationStep Order="6" Type="ClaimsExchange">
                    <Preconditions>
                        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                            <Value>objectId</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
                            <Value>isKnownCustomer</Value>
                            <Value>True</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsExchanges>
                        <ClaimsExchange Id="AADOIDC" TechnicalProfileReferenceId="AAD-OIDC" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <!-- For social IDP authentication, attempt to find the user account in the directory. -->
                <OrchestrationStep Order="7" Type="ClaimsExchange">
                    <Preconditions>
                        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
                            <Value>isKnownCustomer</Value>
                            <Value>True</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsExchanges>
                        <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <!-- Still dont have objectId (social idp user that doesnt yet exist) - write the account -->
                <OrchestrationStep Order="8" Type="ClaimsExchange">
                    <Preconditions>
                        <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                            <Value>objectId</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsExchanges>
                        <ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <OrchestrationStep Order="9" Type="ClaimsExchange">
                    <Preconditions>
                        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
                            <Value>isKnownCustomer</Value>
                            <Value>True</Value>
                            <Action>SkipThisOrchestrationStep</Action>
                        </Precondition>
                    </Preconditions>
                    <ClaimsExchanges>
                        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
                    </ClaimsExchanges>
                </OrchestrationStep>

                <OrchestrationStep Order="10" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
            </OrchestrationSteps>
            <ClientDefinition ReferenceId="DefaultWeb" />
        </UserJourney>

我跟蹤了這些請求並能夠獲得具有以下所有值的令牌。

讓我知道是否需要任何其他信息。

Answer 1

我能夠通過從元數據中刪除以下項目來解決此問題。

<Item Key="ProviderName">https://sts.windows.net/ffc9d30c-a7e7-486d-bbcd-66d88af6f4c9/</Item>

Answer 2

我遇到了類似的問題，但我正在嘗試支持多租戶 Microsoft 帳戶。 我將 Azure AD B2C 與organizations元數據鏈接一起使用，以支持從任何公司 Microsoft 帳戶登錄。 登錄成功，但是返回錯誤，issuer不匹配。 我已經在用戶流和自定義策略中嘗試過這個，但它不起作用。 我更願意將此與用戶流程一起使用，因為我發現自定義策略不容易使用或理解。

AADB2C90238: The provided token does not contain a valid issuer. Please provide another token and try again.

元數據鏈接：

https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration

選項 1：用戶流程

重現步驟：

Go 至 Azure b2c > 身份提供商
Create New Identity Providers > 提供詳細信息，包括上面提供的元數據 url。 新身份提供者
將身份提供者分配給登錄和注冊用戶流
運行用戶流，重定向 url 為https://jwt.ms/
使用您的 Microsoft Corp 帳戶登錄。
重定向到jwt.ms ，錯誤如上所示。

選項 2：自定義策略

此處僅顯示聲明提供者部分。

    <!-- Social User Login -->
    <ClaimsProvider>
      <DisplayName>Microsoft</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="UserAccount-Micrsoft">
          <DisplayName>Microsoft Account</DisplayName>
          <Protocol Name="OpenIdConnect" />
          <Metadata>
            <Item Key="METADATA">https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration</Item>
            <!-- Update the Client ID below to the Application ID --> 
            <Item Key="client_id">client_id</Item>
            <Item Key="response_types">code</Item>
            <Item Key="response_mode">form_post</Item>
            <Item Key="scope">openid profile email</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="UsePolicyInRedirectUri">0</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_MicrosoftSecret" />
          </CryptographicKeys>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="signInEmail" PartnerClaimType="login_hint" />
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="identityProviderAccessToken" PartnerClaimType="{oauth2:access_token}" />
            <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
            <OutputClaim ClaimTypeReferenceId="signInEmail" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
            <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" />
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
            <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialAuthentication" AlwaysUseDefaultValue="true" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
            <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
            <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
          </OutputClaimsTransformations>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
        </TechnicalProfile>

AADB2C90238：提供的令牌不包含有效的頒發者。請提供另一個令牌並重試

問題描述

2 個解決方案

解決方案1
0 2022-04-04 06:32:08

解決方案2
0 2023-01-06 17:00:27

選項 1：用戶流程

選項 2：自定義策略

AADB2C90238：提供的令牌不包含有效的頒發者。 請提供另一個令牌並重試

問題描述

2 個解決方案

解決方案1 0 2022-04-04 06:32:08

解決方案2 0 2023-01-06 17:00:27

選項 1：用戶流程

選項 2：自定義策略

AADB2C90238：提供的令牌不包含有效的頒發者。請提供另一個令牌並重試

解決方案1
0 2022-04-04 06:32:08

解決方案2
0 2023-01-06 17:00:27