blocks|key|2493202|text|嗯，这太尴尬了，我肯定已经看了这行大约30次了，都没有注意到……|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2493203|我正在检索OID令牌，它的声明类型是：|2493204|http://schemas.microsoft.com/identity/claims/objectidentifier|offset|length|2493205|在我提供的截图中可以清楚地看到。我将把这个问题留下来，因为模式可能会让其他人失去兴趣。|2493206|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|1P|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@$F|T|G|U|1|V]]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|X|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|E]]]]

Well, this is embarrassing, I must have looked over this line about 30 times and not noticed...

I was retrieving the OID token, it's claim type was:

<a href="http://schemas.microsoft.com/identity/claims/objectidentifier" rel="noreferrer">http://schemas.microsoft.com/identity/claims/objectidentifier</a>

As can be clearly seen in my provided screenshots. I'll leave this question up as, the schema may throw someone else off.

blocks|key|2703313|text|由于上面的链接被破坏了，这是我努力寻找的工作示例，下面是我最终使用的代码片段；|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2703314|using+System.IdentityModel.Tokens.Jwt;
...
string+oid;
string+pTokenInput+=+Request.Headers["x-ms-token-aad-id-token"].ToString();
var+lJWTHandler+=+new+JwtSecurityTokenHandler();
if+(lJWTHandler.CanReadToken(pTokenInput)
{
++++var+lToken+=+lJWTHandler.ReadJwtToken(pTokenInput);
++++if+(lToken.Payload.ContainsKey("oid"))
++++++++oid+=+lToken.Payload["oid"].ToString();
}|code-block|syntax|javascript|2703315|希望这能帮助到其他人。|2703316|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Since the links above are broken and this is something that I really struggled to find a working example of, here is a code fragment of what I ended up using;

<pre><code>using System.IdentityModel.Tokens.Jwt;
...
string oid;
string pTokenInput = Request.Headers["x-ms-token-aad-id-token"].ToString();
var lJWTHandler = new JwtSecurityTokenHandler();
if (lJWTHandler.CanReadToken(pTokenInput)
{
 var lToken = lJWTHandler.ReadJwtToken(pTokenInput);
 if (lToken.Payload.ContainsKey("oid"))
 oid = lToken.Payload["oid"].ToString();
}
</code></pre>

Hopefully, this will help someone else...

blocks|key|2703318|text|我在这一点上挣扎了一段时间，这篇文章帮助了我。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2703319|为了使用一些代码更新内容，下面将获取对象标识符值(Azure中的唯一用户id+)|2703320|User.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value|code-block|syntax|javascript|2703321|感谢您指出模式/类型之间的差异！|2703322|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

I struggled with this for a little while and this post helped me.

To update things with some code, the below will obtain the object identifier value (unique user id in Azure)

<pre><code>User.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value
</code></pre>

Thanks for pointing out the differences in the schema/types!

blocks|key|30893|text|似乎在这里你不一定需要对象标识符。在调试时，我看到对象标识符的值被映射到nameidentifier|type|unstyled|depth|inlineStyleRanges|entityRanges|data|30894|📷|atomic|offset|length|30895|​|30896|它可以通过内置的常量NameIdentifier访问|style|CODE|30897|var+identity+=+authState.User.Identity+as+System.Security.Claims.ClaimsIdentity;
var+userId+=+identity.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier).Value;|code-block|syntax|javascript|30898|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/3335c3ffaef7d33d532d049bb4a94234.png|imageAlt^0|0|0|1|0|0|0|A|E|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|11|8|@]|9|@$E|12|F|13|1|14]]|A|$]]|$1|G|3|H|5|6|7|15|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|16|8|@$E|17|F|18|K|L]]|9|@]|A|$]]|$1|M|3|N|5|O|7|19|8|@]|9|@]|A|$P|Q]]|$1|R|3|-4|5|6|7|1A|8|@]|9|@]|A|$]]]|S|$T|$5|U|V|W|A|$X|Y|Z|-4]]]]

It seems that you do not necessarily need object-identifier here.
When debugging, I see that the value of object-identifier is mapped to nameidentifier
<a href="https://i.stack.imgur.com/fLQfC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fLQfC.png" alt="enter image description here"></a>

Which is accessible with the built-in constant <code>NameIdentifier</code>:

<pre><code>var identity = authState.User.Identity as System.Security.Claims.ClaimsIdentity;
var userId = identity.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier).Value;
</code></pre>

Why do I want this?

I'm trying to get a unique identifier from my user which I can connect to database records. There are reasons I don't want to use the Email as the identifier. I read that SUB claim isn't supported with B2C, and to use OID in it's place. 

Steps I've Taken

So, I've set up that both of my policies return Object ID on Azure B2C: 

<a href="https://i.stack.imgur.com/6ayzM.png" rel="noreferrer"><img src="https://i.stack.imgur.com/6ayzM.png" alt="enter image description here"></a>

I'm using individual SignIn and SignUp policies at the moment, and I get all of the claims back, including the email claim which I specified I wanted to be returned. I cannot however find a claim related to OID or SUB. 

<pre><code>User.Claims 
</code></pre>

Nets me the following results:

<a href="https://i.stack.imgur.com/5b5El.png" rel="noreferrer"><img src="https://i.stack.imgur.com/5b5El.png" alt="enter image description here"></a>

The single breadcrumb of hope that I have found is this claim:

Type: <a href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" rel="noreferrer">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier</a>

Value: Not supported currently. Use oid claim. 

Questions

Have I missed some additional step that you need to perform to retrieve this particular claim? 

Has anyone had any success retrieving an OID or SUB from Azure B2C?

How do I get an OID claim in ASPCore from Azure B2C

数据库

我为什么想要这个？我正在尝试从我的用户那里获取一个唯一的标识符，我可以将其连接到数据库记录。我不想使用电子邮件作为标识符是有原因的。我读到B2C不支持子声明，并在它所在的地方使用OID。我已经采取的步骤所以，我已经设置了我的两个策略都在Azure B2C上返回对象ID：​​我目前使用的是单独的SignIn和SignUp...

问如何从Azure B2C获取ASPCore中的OID声明
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何从Azure B2C获取ASPCore中的OID声明EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何从Azure B2C获取ASPCore中的OID声明
EN