0

我想根据在 Azure B2C 自定义策略中作为声明接收的 TenantID 动态分配不同的 JWT 颁发者。我在下面进行了测试，效果很好。有没有更好的方法来做到这一点？

名为“extension_userTenantId”的声明返回 1、2、3 或 4 作为值。我更新了分配 JWT 颁发者的用户流程。

 <!-- Custom JWT Issuer - for all partners (TenantID - 2,3,4, except for partner with (TenantID - 1) -->
    <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" >  
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>extension_userTenantId</Value>
          <Value>1</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>         
      </Preconditions>
    </OrchestrationStep>
    
    <!-- Custom JWT Issuer - for partner with (TenantID - 1) except for all other partners (TenantID - 2,3,4) -->
    <OrchestrationStep Order="8" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer1" > 
      <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>extension_userTenantId</Value>
          <Value>2</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>extension_userTenantId</Value>
          <Value>3</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
          <Value>extension_userTenantId</Value>
          <Value>4</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
    </OrchestrationStep>
  </OrchestrationSteps>

定义了 2 个 JWT 颁发者提供程序。一个具有默认刷新令牌生命周期（14 天），另一个设置为 60 天。

<ClaimsProvider>
  <DisplayName>Token Issuer</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="JwtIssuer">
      <DisplayName>JWT Issuer</DisplayName>
      <Protocol Name="None" />
      <OutputTokenFormat>JWT</OutputTokenFormat>
      <Metadata>
        <!-- Token will be valid 2 hrs -->
        <Item Key="token_lifetime_secs">7200</Item>
        <Item Key="id_token_lifetime_secs">7200</Item>
        <Item Key="client_id">{service:te}</Item>
        <Item Key="issuer_refresh_token_user_identity_claim_type">objectId</Item>
        <Item Key="SendTokenResponseBodyWithJsonNumbers">true</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
        <Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" />
      </CryptographicKeys>
      <InputClaims />
      <OutputClaims />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

<ClaimsProvider>
  <DisplayName>Token Issuer</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="JwtIssuer1">
      <DisplayName>JWT Issuer</DisplayName>
      <Protocol Name="None" />
      <OutputTokenFormat>JWT</OutputTokenFormat>
      <Metadata>
        <!-- Token will be valid 2 hrs & Refresh Token valid for 60 days -->
        <Item Key="token_lifetime_secs">7200</Item>
        <Item Key="id_token_lifetime_secs">7200</Item>
        <Item Key="refresh_token_lifetime_secs">5184000</Item>
        <Item Key="client_id">{service:te}</Item>
        <Item Key="issuer_refresh_token_user_identity_claim_type">objectId</Item>
        <Item Key="SendTokenResponseBodyWithJsonNumbers">true</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
        <Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" />
      </CryptographicKeys>
      <InputClaims />
      <OutputClaims />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

谢谢

4

0 回答 0