AzureB2C La connexion du fournisseur d'identité a échoué: AADB2C99002: L'utilisateur n'existe pas

Question

En essayant Azure AD B2C et j'ai ajouté des fournisseurs d'identité Google et Microsoft via Azure Portal.

Quand je tente de se connecter avec Microsoft ou Google IP, je reçois toujours un message d'erreur suivant dans le OnAuthenticationFailed-Handler:

AADB2C99002: L'utilisateur n'existe pas. Veuillez vous inscrire avant de pouvoir vous connecter.

Mais quand j'utilise le "Local Sign SignIn" Fourni par Azure B2C, tout fonctionne correctement. Est-ce que je manque quelque chose dans ma configuration?

L'extrait de code suivant présente ma configuration OWIN.

private void ConfigureAuthentication(IAppBuilder app) 
    { 
     app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); 

     app.UseCookieAuthentication(new CookieAuthenticationOptions()); 

     OpenIdConnectAuthenticationOptions options = new OpenIdConnectAuthenticationOptions 
     { 
      // These are standard OpenID Connect parameters, with values pulled from web.config 
      ClientId = clientId, 
      RedirectUri = redirectUri, 
      PostLogoutRedirectUri = redirectUri, 
      Notifications = new OpenIdConnectAuthenticationNotifications 
      { 
       AuthenticationFailed = OnAuthenticationFailed, 
       RedirectToIdentityProvider = OnRedirectToIdentityProvider, 
       AuthorizationCodeReceived = OnAuthorizationCodeReceived, 
       SecurityTokenValidated = context => { 
        return null; 
        } 
       }, 

      Scope = "openid offline_access", 

      // The PolicyConfigurationManager takes care of getting the correct Azure AD authentication 
      // endpoints from the OpenID Connect metadata endpoint. It is included in the PolicyAuthHelpers folder. 
      ConfigurationManager = new PolicyConfigurationManager(
       String.Format(CultureInfo.InvariantCulture, aadInstance, tenant, "/v2.0", OIDCMetadataSuffix), 
       new string[] { SignUpPolicyId, SignInPolicyId, ProfilePolicyId }), 

      // This piece is optional - it is used for displaying the user's name in the navigation bar. 
      TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters 
      { 
       NameClaimType = "name", 
      }, 
     }; 

     app.UseOpenIdConnectAuthentication(options); 
    } 

    // This notification can be used to manipulate the OIDC request before it is sent. Here we use it to send the correct policy. 
    private async Task OnRedirectToIdentityProvider(RedirectToIdentityProviderNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification) 
    { 
     PolicyConfigurationManager mgr = notification.Options.ConfigurationManager as PolicyConfigurationManager; 
     if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest) 
     { 
      OpenIdConnectConfiguration config = await mgr.GetConfigurationByPolicyAsync(CancellationToken.None, notification.OwinContext.Authentication.AuthenticationResponseRevoke.Properties.Dictionary[AzureB2C.PolicyKey]); 
      notification.ProtocolMessage.IssuerAddress = config.EndSessionEndpoint; 
     } 
     else 
     { 
      OpenIdConnectConfiguration config = await mgr.GetConfigurationByPolicyAsync(CancellationToken.None, notification.OwinContext.Authentication.AuthenticationResponseChallenge.Properties.Dictionary[AzureB2C.PolicyKey]); 
      notification.ProtocolMessage.IssuerAddress = config.AuthorizationEndpoint; 
     } 
    } 

    private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification) 
    { 
     // The user's objectId is extracted from the claims provided in the id_token, and used to cache tokens in ADAL 
     // The authority is constructed by appending your B2C directory's name to "https://login.microsoftonline.com/" 
     // The client credential is where you provide your application secret, and is used to authenticate the application to Azure AD 
     string userObjectID = notification.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value; 
     string authority = String.Format(CultureInfo.InvariantCulture, aadInstance, tenant, string.Empty, string.Empty); 
     ClientCredential credential = new ClientCredential(clientId, clientSecret); 

     // We don't care which policy is used to access the TaskService, so let's use the most recent policy 
     string mostRecentPolicy = notification.AuthenticationTicket.Identity.FindFirst(AzureB2C.AcrClaimType).Value; 

     // The Authentication Context is ADAL's primary class, which represents your connection to your B2C directory 
     // ADAL uses an in-memory token cache by default. In this case, we've extended the default cache to use a simple per-user session cache 
     AuthenticationContext authContext = new AuthenticationContext(authority, new NaiveSessionCache(userObjectID)); 

     // Here you ask for a token using the web app's clientId as the scope, since the web app and service share the same clientId. 
     // The token will be stored in the ADAL token cache, for use in our controllers 
     AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(notification.Code, new Uri(redirectUri), credential, new string[] { clientId }, mostRecentPolicy); 
    } 

    // Used for avoiding yellow-screen-of-death 
    private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification) 
    { 
     _log.Error("AuthenticationFailed!\r\nError={0}\r\nErrorDescription={1}\r\n{0}", 
      notification.ProtocolMessage.Error, 
      notification.ProtocolMessage.ErrorDescription, 
      notification.Exception.ToString()); 

     notification.HandleResponse(); 
     notification.Response.Redirect("/Home/OpenIdError?message=" + notification.ProtocolMessage.ErrorDescription); 
     return Task.FromResult(0); 
    } 
} 

Answer 1

identités externes doivent d'abord « inscrire » et avant de signer. Inscription Au cours de l'identité externe est liée à B2C.

Dans la page d'inscription, vous pouvez demander des attributs supplémentaires pour vos utilisateurs, comme un numéro de client. Vous avez besoin de cela pour les identifiants externes et pour les utilisateurs Local Account en B2C, pas de différence entre les deux.

Ceci est un comportement différent par rapport à l'ajout d'un fournisseur d'identité sans B2C, où chaque connexion fonctionne simplement.

Edit: Comme Konstantin mentionné, le nouveau combiné sign-up or sign-in policy résout ce problème: https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-reference-policies/#create-a-sign-up-or-sign-in-policy