我有一个身份验证的自定义策略,在该自定义策略中,我有一个选项重置密码,现在我可以重置密码为无限制的时间在一天左右,我想限制重置密码选项为每天5次。是否有任何选项使用自定义策略。
我已经尝试了一些使用自定义策略,但它抛出一些错误,我将在这里添加自定义策略的一些部分以供参考。
索赔方案
<ClaimType Id="extension_MaxPasswordResets">
<DisplayName>Max Password Resets</DisplayName>
<DataType>long</DataType>
<AdminHelpText>Stores the number of password resets for the user.</AdminHelpText>
<UserHelpText>Stores the number of password resets for the user.</UserHelpText>
</ClaimType>
<ClaimType Id="allowPasswordReset">
<DisplayName>Allow Password Reset</DisplayName>
<DataType>boolean</DataType>
<UserHelpText>Indicates whether password reset is allowed.</UserHelpText>
</ClaimType>
字符串
索赔转换
<ClaimsTransformations>
<!-- Other transformations -->
<!-- Transformation to check if the password reset count is less than or equal to 5 -->
<ClaimsTransformation Id="AssertBooleanClaimIsLessOrEqualToValue" TransformationMethod="AssertBooleanClaimIsEqualToValue">
<InputClaims>
<InputClaim ClaimTypeReferenceId="extension_MaxPasswordResets" TransformationClaimType="inputClaim" />
</InputClaims>
<InputParameters>
<InputParameter Id="valueToCompareTo" DataType="long" Value="5" />
<InputParameter Id="operator" DataType="string" Value="lessOrEquals" />
</InputParameters>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="allowPasswordReset" TransformationClaimType="outputClaim" />
</OutputClaims>
</ClaimsTransformation>
</ClaimsTransformations>
型
这里是技术档案
<TechnicalProfile Id="CheckPasswordResetCount">
<DisplayName>Check Password Reset Count</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
</Metadata>
<InputClaims>
<!-- Reference the claim that stores the password reset count -->
<InputClaim ClaimTypeReferenceId="extension_MaxPasswordResets" />
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="allowPasswordReset" DefaultValue="false" />
</OutputClaims>
<OutputClaimsTransformations>
<!-- Check if the password reset count exceeds 5 -->
<OutputClaimsTransformation ReferenceId="AssertBooleanClaimIsLessOrEqualToValue" />
</OutputClaimsTransformations>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>
型
我有一个子旅程重置密码在用户旅程
<SubJourney Id="PasswordReset" Type="Call">
<OrchestrationSteps>
<!-- Step to check the password reset count before proceeding -->
<OrchestrationStep Order="1" Type="ClaimsExchange">
<Preconditions>
<!-- Check if the user is trying to reset the password -->
<Precondition Type="ClaimEquals" ExecuteActionsIf="false">
<Value>passwordreset</Value>
<Value>true</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<!-- <ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="CheckPasswordResetCount" />
</ValidationTechnicalProfiles> -->
<ClaimsExchanges>
<!-- Perform a claims exchange with the custom validation technical profile -->
<ClaimsExchange Id="MyCustomValidationExchange" TechnicalProfileReferenceId="CheckPasswordResetCount" />
</ClaimsExchanges>
</OrchestrationStep>
<!-- Validate user's email address. Run this step only when user resets the password-->
<OrchestrationStep Order="2" Type="ClaimsExchange">
<Preconditions>
<!-- Check if the user is trying to reset the password -->
<Precondition Type="ClaimEquals" ExecuteActionsIf="false">
<Value>passwordreset</Value>
<Value>true</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<ClaimsExchanges>
<ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingEmailAddress-AcctExists" />
</ClaimsExchanges>
</OrchestrationStep>
<!-- Collect and persist a new password. Run this step only when user resets the password-->
<OrchestrationStep Order="3" Type="ClaimsExchange">
<Preconditions>
<!-- Check if the user is trying to reset the password -->
<Precondition Type="ClaimEquals" ExecuteActionsIf="false">
<Value>passwordreset</Value>
<Value>true</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<ClaimsExchanges>
<ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
</ClaimsExchanges>
</OrchestrationStep>
</OrchestrationSteps>
</SubJourney>
型
我不确定这是正确还是错误。
这是我得到的错误:
输入索赔在ClaimsTransformation中不匹配,id为“AssertBooleanClaimIsLessOrEqualToValue”,转换方法为“AssertBooleanClaimIsEqualToValue”。以下InputClaims在Policy中声明,但不是TransformMethod所期望的:[Long]inputClaim。以下InputClaims是TransformMethod所期望的,但未在策略中声明:[Boolean]inputClaim.`
我相信有些人可以帮我解决这个问题。
1条答案
按热度按时间chhqkbe11#
使用转换方法
AssertBooleanClaimIsEqualToValue
Assert的是布尔值,而不是数值您需要使用
AssertNumber
转换方法。字符串
请参阅:Msft文档-索赔转换:Assert编号
但更重要的是,我质疑为什么这是一个要求,它只会阻碍用户和他们的体验。如果他们的帐户被泄露,他们不能更改密码怎么办?你也要阻止他们经历忘记密码的旅程吗?