在azure ad b2c中,是否有任何选项可以使用自定义策略设置密码重置限制?

tquggr8v  于 2023-08-07  发布在  其他
关注(0)|答案(1)|浏览(95)

我有一个身份验证的自定义策略,在该自定义策略中,我有一个选项重置密码,现在我可以重置密码为无限制的时间在一天左右,我想限制重置密码选项为每天5次。是否有任何选项使用自定义策略。
我已经尝试了一些使用自定义策略,但它抛出一些错误,我将在这里添加自定义策略的一些部分以供参考。
索赔方案

<ClaimType Id="extension_MaxPasswordResets">
  <DisplayName>Max Password Resets</DisplayName>
  <DataType>long</DataType>
  <AdminHelpText>Stores the number of password resets for the user.</AdminHelpText>
  <UserHelpText>Stores the number of password resets for the user.</UserHelpText>
</ClaimType>
<ClaimType Id="allowPasswordReset">
  <DisplayName>Allow Password Reset</DisplayName>
  <DataType>boolean</DataType>
  <UserHelpText>Indicates whether password reset is allowed.</UserHelpText>
</ClaimType>

字符串
索赔转换

<ClaimsTransformations>
  <!-- Other transformations -->
  <!-- Transformation to check if the password reset count is less than or equal to 5 -->
  <ClaimsTransformation Id="AssertBooleanClaimIsLessOrEqualToValue" TransformationMethod="AssertBooleanClaimIsEqualToValue">
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="extension_MaxPasswordResets" TransformationClaimType="inputClaim" />
    </InputClaims>
    <InputParameters>
      <InputParameter Id="valueToCompareTo" DataType="long" Value="5" />
      <InputParameter Id="operator" DataType="string" Value="lessOrEquals" />
    </InputParameters>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="allowPasswordReset" TransformationClaimType="outputClaim" />
    </OutputClaims>
  </ClaimsTransformation>
</ClaimsTransformations>


这里是技术档案

<TechnicalProfile Id="CheckPasswordResetCount">
  <DisplayName>Check Password Reset Count</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
  </Metadata>
  <InputClaims>
    <!-- Reference the claim that stores the password reset count -->
    <InputClaim ClaimTypeReferenceId="extension_MaxPasswordResets" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="allowPasswordReset" DefaultValue="false" />
  </OutputClaims>
  <OutputClaimsTransformations>
    <!-- Check if the password reset count exceeds 5 -->
    <OutputClaimsTransformation ReferenceId="AssertBooleanClaimIsLessOrEqualToValue" />
  </OutputClaimsTransformations>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>


我有一个子旅程重置密码在用户旅程

<SubJourney Id="PasswordReset" Type="Call">
  <OrchestrationSteps>
    <!-- Step to check the password reset count before proceeding -->
    <OrchestrationStep Order="1" Type="ClaimsExchange">
      <Preconditions>
        <!-- Check if the user is trying to reset the password -->
        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
          <Value>passwordreset</Value>
          <Value>true</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <!-- <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="CheckPasswordResetCount" />
      </ValidationTechnicalProfiles> -->
      <ClaimsExchanges>
        <!-- Perform a claims exchange with the custom validation technical profile -->
        <ClaimsExchange Id="MyCustomValidationExchange" TechnicalProfileReferenceId="CheckPasswordResetCount" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- Validate user's email address. Run this step only when user resets the password-->
    <OrchestrationStep Order="2" Type="ClaimsExchange">
      <Preconditions>
        <!-- Check if the user is trying to reset the password -->
        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
          <Value>passwordreset</Value>
          <Value>true</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress-AcctExists" />
      </ClaimsExchanges>
    </OrchestrationStep>
    <!-- Collect and persist a new password. Run this step only when user resets the password-->
    <OrchestrationStep Order="3" Type="ClaimsExchange">
      <Preconditions>
        <!-- Check if the user is trying to reset the password -->
        <Precondition Type="ClaimEquals" ExecuteActionsIf="false">
          <Value>passwordreset</Value>
          <Value>true</Value>
          <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
      </Preconditions>
      <ClaimsExchanges>
        <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
      </ClaimsExchanges>
    </OrchestrationStep>
  </OrchestrationSteps>
</SubJourney>


我不确定这是正确还是错误。
这是我得到的错误:
输入索赔在ClaimsTransformation中不匹配,id为“AssertBooleanClaimIsLessOrEqualToValue”,转换方法为“AssertBooleanClaimIsEqualToValue”。以下InputClaims在Policy中声明,但不是TransformMethod所期望的:[Long]inputClaim。以下InputClaims是TransformMethod所期望的,但未在策略中声明:[Boolean]inputClaim.`
我相信有些人可以帮我解决这个问题。

chhqkbe1

chhqkbe11#

使用转换方法AssertBooleanClaimIsEqualToValueAssert的是布尔值,而不是数值
您需要使用AssertNumber转换方法。

<ClaimsTransformation Id="isOverLimit" TransformationMethod="AssertNumber">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="extension_MaxPasswordResets" TransformationClaimType="inputClaim" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="Operator" DataType="string" Value="GreaterThan" />
    <InputParameter Id="CompareToValue" DataType="int" Value="5" />
    <InputParameter Id="throwError" DataType="boolean" Value="false" />
  </InputParameters>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="attemptsCountExceeded" TransformationClaimType="outputClaim" />
  </OutputClaims>
</ClaimsTransformation>

字符串
请参阅:Msft文档-索赔转换:Assert编号
但更重要的是,我质疑为什么这是一个要求,它只会阻碍用户和他们的体验。如果他们的帐户被泄露,他们不能更改密码怎么办?你也要阻止他们经历忘记密码的旅程吗?

  • n* 小时后,您将如何重置计数器?

相关问题