AzureB2C Anmeldung zum Identity Provider fehlgeschlagen: AADB2C99002: Benutzer existiert nicht

Question

Ich versuche Azure AD B2C und ich habe Google und Microsoft Identity Providers über Azure Portal hinzugefügt.

Wenn ich versuche, mit Microsoft oder Google IP anmelden, erhalte ich immer folgende Fehlermeldung in den OnAuthenticationFailed-Handler:

AADB2C99002: Benutzer existiert nicht. Bitte registrieren Sie sich, bevor Sie sich anmelden können.

Aber wenn ich das "Local Account SignIn" von Azure B2C verwendet, funktioniert alles gut. Fehle ich etwas in meiner Konfiguration?

Das folgende Code-Snippet zeigt meine OWIN-Konfiguration.

private void ConfigureAuthentication(IAppBuilder app) 
    { 
     app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); 

     app.UseCookieAuthentication(new CookieAuthenticationOptions()); 

     OpenIdConnectAuthenticationOptions options = new OpenIdConnectAuthenticationOptions 
     { 
      // These are standard OpenID Connect parameters, with values pulled from web.config 
      ClientId = clientId, 
      RedirectUri = redirectUri, 
      PostLogoutRedirectUri = redirectUri, 
      Notifications = new OpenIdConnectAuthenticationNotifications 
      { 
       AuthenticationFailed = OnAuthenticationFailed, 
       RedirectToIdentityProvider = OnRedirectToIdentityProvider, 
       AuthorizationCodeReceived = OnAuthorizationCodeReceived, 
       SecurityTokenValidated = context => { 
        return null; 
        } 
       }, 

      Scope = "openid offline_access", 

      // The PolicyConfigurationManager takes care of getting the correct Azure AD authentication 
      // endpoints from the OpenID Connect metadata endpoint. It is included in the PolicyAuthHelpers folder. 
      ConfigurationManager = new PolicyConfigurationManager(
       String.Format(CultureInfo.InvariantCulture, aadInstance, tenant, "/v2.0", OIDCMetadataSuffix), 
       new string[] { SignUpPolicyId, SignInPolicyId, ProfilePolicyId }), 

      // This piece is optional - it is used for displaying the user's name in the navigation bar. 
      TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters 
      { 
       NameClaimType = "name", 
      }, 
     }; 

     app.UseOpenIdConnectAuthentication(options); 
    } 

    // This notification can be used to manipulate the OIDC request before it is sent. Here we use it to send the correct policy. 
    private async Task OnRedirectToIdentityProvider(RedirectToIdentityProviderNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification) 
    { 
     PolicyConfigurationManager mgr = notification.Options.ConfigurationManager as PolicyConfigurationManager; 
     if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest) 
     { 
      OpenIdConnectConfiguration config = await mgr.GetConfigurationByPolicyAsync(CancellationToken.None, notification.OwinContext.Authentication.AuthenticationResponseRevoke.Properties.Dictionary[AzureB2C.PolicyKey]); 
      notification.ProtocolMessage.IssuerAddress = config.EndSessionEndpoint; 
     } 
     else 
     { 
      OpenIdConnectConfiguration config = await mgr.GetConfigurationByPolicyAsync(CancellationToken.None, notification.OwinContext.Authentication.AuthenticationResponseChallenge.Properties.Dictionary[AzureB2C.PolicyKey]); 
      notification.ProtocolMessage.IssuerAddress = config.AuthorizationEndpoint; 
     } 
    } 

    private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification) 
    { 
     // The user's objectId is extracted from the claims provided in the id_token, and used to cache tokens in ADAL 
     // The authority is constructed by appending your B2C directory's name to "https://login.microsoftonline.com/" 
     // The client credential is where you provide your application secret, and is used to authenticate the application to Azure AD 
     string userObjectID = notification.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value; 
     string authority = String.Format(CultureInfo.InvariantCulture, aadInstance, tenant, string.Empty, string.Empty); 
     ClientCredential credential = new ClientCredential(clientId, clientSecret); 

     // We don't care which policy is used to access the TaskService, so let's use the most recent policy 
     string mostRecentPolicy = notification.AuthenticationTicket.Identity.FindFirst(AzureB2C.AcrClaimType).Value; 

     // The Authentication Context is ADAL's primary class, which represents your connection to your B2C directory 
     // ADAL uses an in-memory token cache by default. In this case, we've extended the default cache to use a simple per-user session cache 
     AuthenticationContext authContext = new AuthenticationContext(authority, new NaiveSessionCache(userObjectID)); 

     // Here you ask for a token using the web app's clientId as the scope, since the web app and service share the same clientId. 
     // The token will be stored in the ADAL token cache, for use in our controllers 
     AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(notification.Code, new Uri(redirectUri), credential, new string[] { clientId }, mostRecentPolicy); 
    } 

    // Used for avoiding yellow-screen-of-death 
    private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification) 
    { 
     _log.Error("AuthenticationFailed!\r\nError={0}\r\nErrorDescription={1}\r\n{0}", 
      notification.ProtocolMessage.Error, 
      notification.ProtocolMessage.ErrorDescription, 
      notification.Exception.ToString()); 

     notification.HandleResponse(); 
     notification.Response.Redirect("/Home/OpenIdError?message=" + notification.ProtocolMessage.ErrorDescription); 
     return Task.FromResult(0); 
    } 
} 

Answer 1

Externe Identitäten zuerst müssen ‚anmelden‘ auch vor der Unterzeichnung. Während Anmeldung der externen Identität B2C verbunden ist.

Auf der Anmeldeseite können Sie zusätzliche Attribute für Ihre Benutzer anfordern, z. B. eine Kundennummer. Sie benötigen dies für externe Identitäten und für die Local Account Benutzer in B2C, keinen Unterschied zwischen den beiden.

Dies ist ein anderes Verhalten im Vergleich zum Hinzufügen eines Identity-Providers ohne B2C, wo jeder Login einfach funktioniert.

Edit: Wie Konstantin erwähnt, löst das neue kombinierte sign-up or sign-in policy dieses Problem: https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-reference-policies/#create-a-sign-up-or-sign-in-policy