AzureB2Cアイデンティティプロバイダログインに失敗しました：AADB2C99002：ユーザが存在しません

Question

私はAzure AD B2Cを試しています。私はAzure Portalを通じてGoogleとMicrosoft Identity Providersを追加しました。

私は、MicrosoftやGoogle IPを使用してログインしようとする

は、私はいつもOnAuthenticationFailed・ハンドラに次のエラーメッセージが表示されます

AADB2C99002：ユーザは存在しません。ログインする前にサインアップしてください。

しかし、Azure B2Cが提供する「Local Account SignIn」を使用していると、すべて正常に動作しています。私の設定で何かが欠けていますか？

次のコードスニペットは、私のOWIN設定を示しています。

private void ConfigureAuthentication(IAppBuilder app) 
    { 
     app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); 

     app.UseCookieAuthentication(new CookieAuthenticationOptions()); 

     OpenIdConnectAuthenticationOptions options = new OpenIdConnectAuthenticationOptions 
     { 
      // These are standard OpenID Connect parameters, with values pulled from web.config 
      ClientId = clientId, 
      RedirectUri = redirectUri, 
      PostLogoutRedirectUri = redirectUri, 
      Notifications = new OpenIdConnectAuthenticationNotifications 
      { 
       AuthenticationFailed = OnAuthenticationFailed, 
       RedirectToIdentityProvider = OnRedirectToIdentityProvider, 
       AuthorizationCodeReceived = OnAuthorizationCodeReceived, 
       SecurityTokenValidated = context => { 
        return null; 
        } 
       }, 

      Scope = "openid offline_access", 

      // The PolicyConfigurationManager takes care of getting the correct Azure AD authentication 
      // endpoints from the OpenID Connect metadata endpoint. It is included in the PolicyAuthHelpers folder. 
      ConfigurationManager = new PolicyConfigurationManager(
       String.Format(CultureInfo.InvariantCulture, aadInstance, tenant, "/v2.0", OIDCMetadataSuffix), 
       new string[] { SignUpPolicyId, SignInPolicyId, ProfilePolicyId }), 

      // This piece is optional - it is used for displaying the user's name in the navigation bar. 
      TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters 
      { 
       NameClaimType = "name", 
      }, 
     }; 

     app.UseOpenIdConnectAuthentication(options); 
    } 

    // This notification can be used to manipulate the OIDC request before it is sent. Here we use it to send the correct policy. 
    private async Task OnRedirectToIdentityProvider(RedirectToIdentityProviderNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification) 
    { 
     PolicyConfigurationManager mgr = notification.Options.ConfigurationManager as PolicyConfigurationManager; 
     if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest) 
     { 
      OpenIdConnectConfiguration config = await mgr.GetConfigurationByPolicyAsync(CancellationToken.None, notification.OwinContext.Authentication.AuthenticationResponseRevoke.Properties.Dictionary[AzureB2C.PolicyKey]); 
      notification.ProtocolMessage.IssuerAddress = config.EndSessionEndpoint; 
     } 
     else 
     { 
      OpenIdConnectConfiguration config = await mgr.GetConfigurationByPolicyAsync(CancellationToken.None, notification.OwinContext.Authentication.AuthenticationResponseChallenge.Properties.Dictionary[AzureB2C.PolicyKey]); 
      notification.ProtocolMessage.IssuerAddress = config.AuthorizationEndpoint; 
     } 
    } 

    private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification) 
    { 
     // The user's objectId is extracted from the claims provided in the id_token, and used to cache tokens in ADAL 
     // The authority is constructed by appending your B2C directory's name to "https://login.microsoftonline.com/" 
     // The client credential is where you provide your application secret, and is used to authenticate the application to Azure AD 
     string userObjectID = notification.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value; 
     string authority = String.Format(CultureInfo.InvariantCulture, aadInstance, tenant, string.Empty, string.Empty); 
     ClientCredential credential = new ClientCredential(clientId, clientSecret); 

     // We don't care which policy is used to access the TaskService, so let's use the most recent policy 
     string mostRecentPolicy = notification.AuthenticationTicket.Identity.FindFirst(AzureB2C.AcrClaimType).Value; 

     // The Authentication Context is ADAL's primary class, which represents your connection to your B2C directory 
     // ADAL uses an in-memory token cache by default. In this case, we've extended the default cache to use a simple per-user session cache 
     AuthenticationContext authContext = new AuthenticationContext(authority, new NaiveSessionCache(userObjectID)); 

     // Here you ask for a token using the web app's clientId as the scope, since the web app and service share the same clientId. 
     // The token will be stored in the ADAL token cache, for use in our controllers 
     AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(notification.Code, new Uri(redirectUri), credential, new string[] { clientId }, mostRecentPolicy); 
    } 

    // Used for avoiding yellow-screen-of-death 
    private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification) 
    { 
     _log.Error("AuthenticationFailed!\r\nError={0}\r\nErrorDescription={1}\r\n{0}", 
      notification.ProtocolMessage.Error, 
      notification.ProtocolMessage.ErrorDescription, 
      notification.Exception.ToString()); 

     notification.HandleResponse(); 
     notification.Response.Redirect("/Home/OpenIdError?message=" + notification.ProtocolMessage.ErrorDescription); 
     return Task.FromResult(0); 
    } 
} 

Answer 1

外部アイデンティティは、最初の外部IDがB2Cにリンクされているサインアップ時には。同様で署名する前に、「サインアップ」する必要があります。

サインアップページでは、顧客番号など、ユーザーの追加属性を尋ねることができます。外部IDとB2CのLocal Accountユーザの場合は、この2つの違いはありません。

これは、すべてのログインが動作するB2Cなしのアイデンティティプロバイダを追加するのとは異なる動作です。

編集：コンスタンチンが述べたように、新しい組み合わせsign-up or sign-in policyはこの問題を解決： https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-reference-policies/#create-a-sign-up-or-sign-in-policy