azure-ad-b2c - 更改电子邮件时如何检查新电子邮件是否存在

Question

我已经实现了允许登录用户修改其电子邮件地址的流程。我有电子邮件验证过程，该过程在验证码发送到新电子邮件地址并且用户输入该代码后发生。在此步骤中，当用户输入代码并单击“验证”时，我想检查系统中是否已存在用户所需的电子邮件地址并引发错误。然而，当前的逻辑并没有按预期运行。

<TechnicalProfile Id="AAD-UserExistUsingEmailCheck">
  <Metadata>
    <Item Key="Operation">Read</Item>
    <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">false</Item>
  </Metadata>
  <IncludeInSso>false</IncludeInSso>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
  </InputClaims>
  <OutputClaims>
     <OutputClaim ClaimTypeReferenceId="emailObjectId" PartnerClaimType="objectId" />
  </OutputClaims>
  <IncludeTechnicalProfile ReferenceId="AAD-Common" />
</TechnicalProfile>

<DisplayControl Id="ChangeEmailVerificationControl" UserInterfaceControlType="VerificationControl">
        <!-- Display control to prompt for a email and verify it by sending code to it. -->
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="email" />
        </InputClaims>
        <DisplayClaims>
          <DisplayClaim ClaimTypeReferenceId="email" Required="true" />
          <DisplayClaim ClaimTypeReferenceId="emailVerificationCode" ControlClaimType="VerificationCode" Required="true" />
        </DisplayClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="email" />
        </OutputClaims>
        <Actions>
          <Action Id="SendCode">
            <ValidationClaimsExchange>
              <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="GenerateEmailOtp" />
              <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="ChangeEmailOtp" />
            </ValidationClaimsExchange>
          </Action>
          <Action Id="VerifyCode">
            <ValidationClaimsExchange>
              <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="AAD-UserExistUsingEmailCheck" ContinueOnError="false" />
              <ValidationClaimsExchangeTechnicalProfile TechnicalProfileReferenceId="VerifyEmailOtp" >
                <Preconditions>
                  <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                      <Value>emailObjectId</Value>
                      <Action>SkipThisValidationTechnicalProfile</Action>
                  </Precondition>
                </Preconditions>
              </ValidationClaimsExchangeTechnicalProfile>
            </ValidationClaimsExchange>
          </Action>
        </Actions>
      </DisplayControl>

<TechnicalProfile Id="LocalAccountWriteEmailUsingObjectId">
          <DisplayName>Update email address</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted.profileupdate</Item>
            <Item Key="UserMessageIfClaimsTransformationStringsAreNotEqual">There is another user with this email address</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="userPrincipalName" />
          </InputClaims>
          <DisplayClaims>
            <DisplayClaim DisplayControlReferenceId="ChangeEmailVerificationControl" />
          </DisplayClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="AAD-UserExistUsingEmailCheck" />
            <ValidationTechnicalProfile ReferenceId="AAD-UserWriteEmailUsingObjectId" />
            <ValidationTechnicalProfile ReferenceId="SendEmailChangeEvent" />
          </ValidationTechnicalProfiles>
        </TechnicalProfile>

Answer 1

如果您使用的是 Azure AD B2C Starterpack，则

TrustFrameworkBase.xml

文件中已经有一个技术配置文件，用于更新配置文件，如果电子邮件地址已存在，则会引发错误，并且无需编写自定义逻辑来查找目录.

        <TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
          <Metadata>
            <Item Key="Operation">Write</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" />
          </InputClaims>
          <PersistedClaims>
            <!-- Required claims -->
            <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
            <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
            <PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" />
            <PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" />

            <!-- Optional claims. -->
            <PersistedClaim ClaimTypeReferenceId="givenName" />
            <PersistedClaim ClaimTypeReferenceId="surname" />
          </PersistedClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
          </OutputClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>

如果电子邮件地址与目录中的另一个地址冲突，元数据节点

<Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>

将不允许用户继续。

因此，您的代码将如下所示：

        <TechnicalProfile Id="LocalAccountWriteEmailUsingObjectId">
          <DisplayName>Update email address</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ContentDefinitionReferenceId">api.selfasserted.profileupdate</Item>
            <Item Key="UserMessageIfClaimsTransformationStringsAreNotEqual">There is another user with this email address</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="userPrincipalName" />
          </InputClaims>
          <DisplayClaims>
            <DisplayClaim DisplayControlReferenceId="ChangeEmailVerificationControl" />
          </DisplayClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
            <ValidationTechnicalProfile ReferenceId="SendEmailChangeEvent" />
          </ValidationTechnicalProfiles>
        </TechnicalProfile>

唯一需要注意的是，用户在验证电子邮件地址后必须点击“继续”按钮，但您可以通过在显示控件验证电子邮件后使用 JavaScript 单击“继续”来删除此要求。