Azure AD B2C - GitHub 的自定义提供程序无法获取访问令牌

Question

我正在使用自定义策略将 GitHub 设置为 Azure AD B2C 中的自定义提供程序。我能够进入登录页面并成功重定向回正确的 azure 广告 link，但 Azure AD B2C 中的服务器错误始终拒绝 OAUTH 的第二部分。

当我查看应用洞察跟踪日志时，它说 "An invalid OAuth response was received" 并且遇到了 "Unexpected character encountered while parsing value: a"。这是我设置的策略提供者：

<ClaimsProvider>
      <Domain>github.com</Domain>
      <DisplayName>GitHub</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="GitHub-OAUTH">
          <DisplayName>GitHub</DisplayName>
          <Protocol Name="OAuth2" />
          <Metadata>
            <Item Key="ProviderName">github</Item>
            <Item Key="authorization_endpoint">https://github.com/login/oauth/authorize</Item>
            <Item Key="AccessTokenEndpoint">https://github.com/login/oauth/access_token?</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="ClaimsEndpoint">https://api.github.com/user</Item>
            <Item Key="client_id">My Client Id</Item>
            <Item Key="UsePolicyInRedirectUri">0</Item>
            <Item Key="scope">user</Item>
            <Item Key="response_types">code</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_GitHubSecret" />
          </CryptographicKeys>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="id" />
            <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
            <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="github.com" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
            <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
            <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
          </OutputClaimsTransformations>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

我想知道问题是否是 access_token 没有在 json 中返回？我自己在 postman 中完成了所有步骤，代码作为 url 参数返回，access_token 在响应正文中返回，如下所示：

access_token=<snip>&scope=user%3Aemail&token_type=bearer

我是否缺少自定义提供程序中的元数据项来支持此响应？还是这在 Azure AD B2C 中不起作用？

Answer 1

是的，这是因为访问令牌响应被编码为 HTML 形式，而不是 JSON。

以下是如何与GitHub整合。

1) 为类型 long:

的 GitHub 用户标识符添加声明类型

<ClaimType Id="gitHubUserId">
  <DisplayName>GitHub User ID</DisplayName>
  <DataType>long</DataType>
</ClaimType>

2) 添加声明转换，用于从 long 类型的 GitHub 用户标识符转换为 string 类型的 Azure AD B2C 社交用户标识符：

<ClaimsTransformation Id="CreateAlternativeSecurityUserIdForGitHub" TransformationMethod="ConvertNumberToStringClaim">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="gitHubUserId" TransformationClaimType="inputClaim" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="stringFormat" DataType="string" Value="{0}" />
  </InputParameters>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="socialIdpUserId" TransformationClaimType="outputClaim" />
  </OutputClaims>
</ClaimsTransformation>

3) 添加 GitHub OAuth 流程的技术配置文件：

<TechnicalProfile Id="GitHub-OAUTH">
  <DisplayName>GitHub</DisplayName>
  <Protocol Name="OAuth2" />
  <Metadata>
    <Item Key="ProviderName">github.com</Item>
    <Item Key="authorization_endpoint">https://github.com/login/oauth/authorize</Item>
    <Item Key="AccessTokenEndpoint">https://github.com/login/oauth/access_token</Item>
    <Item Key="HttpBinding">GET</Item>
    <Item Key="ClaimsEndpoint">https://api.github.com/user</Item>
    <Item Key="client_id">Insert the client identifier</Item>
    <Item Key="scope">user</Item>
    <Item Key="UserAgentForClaimsExchange">CPIM-Basic/{tenant}/{policy}</Item>
  </Metadata>
  <CryptographicKeys>
    <Key Id="client_secret" StorageReferenceId="B2C_1A_GitHubSecret" />
  </CryptographicKeys>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="gitHubUserId" PartnerClaimType="id" />
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
    <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
    <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
    <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="github.com" />
  </OutputClaims>
  <OutputClaimsTransformations>
    <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
    <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
    <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityUserIdForGitHub" />
    <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
  </OutputClaimsTransformations>
  <UseTechnicalProfileForSessionManagement ReferenceId="SSOSession-Noop" />
</TechnicalProfile>

Azure AD B2C - GitHub 的自定义提供程序无法获取访问令牌

Azure AD B2C - Custom Provider for GitHub cannot get access token

azure

oauth-2.0

azure-ad-b2c