ClaimsSchemaClaimsSchema

• 11/04/2020
• • m
  • a

ClaimsSchema 元素定义了可以引用为策略的一部分的声明类型。The ClaimsSchema element defines the claim types that can be referenced as part of the policy. 声明架构是发出声明的位置。Claims schema is the place where you declare your claims. 声明可以是名字、姓氏、显示名称、电话号码等。A claim can be first name, last name, display name, phone number and more. ClaimsSchema 元素包含 ClaimType 元素的列表。ClaimsSchema element contains list of ClaimType elements. ClaimType 元素包含 Id 属性，它是声明名称。The ClaimType element contains the Id attribute, which is the claim name.

<BuildingBlocks>
  <ClaimsSchema>
    <ClaimType Id="Id">
      <DisplayName>Surname</DisplayName>
      <DataType>string</DataType>
      <DefaultPartnerClaimTypes>
        <Protocol Name="OAuth2" PartnerClaimType="family_name" />
        <Protocol Name="OpenIdConnect" PartnerClaimType="family_name" />
        <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
      </DefaultPartnerClaimTypes>
      <UserHelpText>Your surname (also known as family name or last name).</UserHelpText>
      <UserInputType>TextBox</UserInputType>

ClaimTypeClaimType

ClaimType 元素包含以下属性：The ClaimType element contains the following attribute:

ClaimType 元素包含以下元素：The ClaimType element contains the following elements:

数据类型DataType

DataType 元素支持以下值：The DataType element supports the following values:

DefaultPartnerClaimTypesDefaultPartnerClaimTypes

DefaultPartnerClaimTypes 可能包含以下元素：The DefaultPartnerClaimTypes may contain the following element:

Protocol 元素包含以下属性：The Protocol element contains the following attributes:

在以下示例中，当标识体验框架与 SAML2 标识提供者或信赖方应用交互时，surname 声明将映射到 http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname，如果使用 OpenIdConnect 和 OAuth2，该声明将映射到 family_name。In the following example, when the Identity Experience Framework interacts with a SAML2 identity provider or relying party application, the surname claim is mapped to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, with OpenIdConnect and OAuth2, the claim is mapped to family_name.

<ClaimType Id="surname">
  <DisplayName>Surname</DisplayName>
  <DataType>string</DataType>
  <DefaultPartnerClaimTypes>
    <Protocol Name="OAuth2" PartnerClaimType="family_name" />
    <Protocol Name="OpenIdConnect" PartnerClaimType="family_name" />
    <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
  </DefaultPartnerClaimTypes>
</ClaimType>

因此，Azure AD B2C 发布的 JWT 令牌会忽略 family_name，而不是 ClaimType 名称 surname 。As a result, the JWT token issued by Azure AD B2C, emits the family_name instead of ClaimType name surname.

{
  "sub": "6fbbd70d-262b-4b50-804c-257ae1706ef2",
  "auth_time": 1535013501,
  "given_name": "David",
  "family_name": "Williams",
  "name": "David Williams",
}

MaskMask

Mask 元素包含以下属性：The Mask element contains the following attributes:

以下示例将配置具有 Simple 掩码的 PhoneNumber 声明：The following example configures a PhoneNumber claim with the Simple mask:

<ClaimType Id="PhoneNumber">
  <DisplayName>Phone Number</DisplayName>
  <DataType>string</DataType>
  <Mask Type="Simple">XXX-XXX-</Mask>
  <UserHelpText>Your telephone number.</UserHelpText>
</ClaimType>

标识体验框架呈现电话号码的同时隐藏了前六个数字：The Identity Experience Framework renders the phone number while hiding the first six digits:

以下示例将配置具有 Regex 掩码的 AlternateEmail 声明：The following example configures a AlternateEmail claim with the Regex mask:

<ClaimType Id="AlternateEmail">
  <DisplayName>Please verify the secondary email linked to your account</DisplayName>
  <DataType>string</DataType>
  <Mask Type="Regex" Regex="(?&lt;=.).(?=.*@)">*</Mask>
  <UserInputType>Readonly</UserInputType>
</ClaimType>

标识体验框架仅呈现电子邮件地址和电子邮件域名的第一个字母：The Identity Experience Framework renders only the first letter of the email address and the email domain name:

限制Restriction

Restriction 元素可能包含以下属性：The Restriction element may contain the following attribute:

Restriction 元素包含以下元素：The Restriction element contains the following elements:

枚举Enumeration

Enumeration 元素定义了可供用户在用户界面中选择声明的可用选项，例如 CheckboxMultiSelect、DropdownSingleSelect 或 RadioSingleSelect 中的值。The Enumeration element defines available options for the user to select for a claim in the user interface, such as a value in a CheckboxMultiSelect, DropdownSingleSelect, or RadioSingleSelect. 另外，可以使用 LocalizedCollections 元素定义和本地化可用选项。Alternatively, you can define and localize available options with LocalizedCollections element. 若要从声明 Enumeration 集合中查找项目，请使用 GetMappedValueFromLocalizedCollection 声明转换。To look up an item from a claim Enumeration collection, use GetMappedValueFromLocalizedCollection claims transformation.

Enumeration 元素包含以下属性：The Enumeration element contains the following attributes:

以下示例将配置默认值设置为 New York 的 “城市”下拉列表声明：The following example configures a city dropdown list claim with a default value set to New York:

<ClaimType Id="city">
  <DisplayName>city where you work</DisplayName>
  <DataType>string</DataType>
  <UserInputType>DropdownSingleSelect</UserInputType>
  <Restriction>
    <Enumeration Text="Bellevue" Value="bellevue" SelectByDefault="false" />
    <Enumeration Text="Redmond" Value="redmond" SelectByDefault="false" />
    <Enumeration Text="New York" Value="new-york" SelectByDefault="true" />
  </Restriction>
</ClaimType>

默认值设置为纽约的城市下拉列表：Dropdown city list with a default value set to New York:

模式Pattern

Pattern 元素可以包含以下属性：The Pattern element can contain the following attributes:

以下示例将配置具有正则表达式输入验证和帮助文本的 email 声明：The following example configures an email claim with regular expression input validation and help text:

<ClaimType Id="email">
  <DisplayName>Email Address</DisplayName>
  <DataType>string</DataType>
  <DefaultPartnerClaimTypes>
    <Protocol Name="OpenIdConnect" PartnerClaimType="email" />
  </DefaultPartnerClaimTypes>
  <UserHelpText>Email address that can be used to contact you.</UserHelpText>
  <UserInputType>TextBox</UserInputType>
  <Restriction>
    <Pattern RegularExpression="^[a-zA-Z0-9.+!#$%&amp;'^_`{}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$" HelpText="Please enter a valid email address." />
    </Restriction>
 </ClaimType>

标识体验框架呈现具有电子邮件格式输入验证的电子邮件地址声明：The Identity Experience Framework renders the email address claim with email format input validation:

UserInputTypeUserInputType

Azure AD B2C 支持各种用户输入类型，例如在手动输入声明类型的声明数据时可以使用的文本框、密码和下拉列表。Azure AD B2C supports a variety of user input types, such as a textbox, password, and dropdown list that can be used when manually entering claim data for the claim type. 使用 自断言技术配置文件和 显示控件从用户收集信息时，必须指定 UserInputType 。You must specify the UserInputType when you collect information from the user by using a self-asserted technical profile and display controls.

UserInputType 元素可用的用户输入类型：The UserInputType element available user input types:

TextBoxTextBox

TextBox 用户输入类型用于提供单行文本框。The TextBox user input type is used to provide a single-line text box.

<ClaimType Id="displayName">
  <DisplayName>Display Name</DisplayName>
  <DataType>string</DataType>
  <UserHelpText>Your display name.</UserHelpText>
  <UserInputType>TextBox</UserInputType>
</ClaimType>

EmailBoxEmailBox

EmailBox 用户输入类型用于提供基本电子邮件输入字段。The EmailBox user input type is used to provide a basic email input field.

<ClaimType Id="email">
  <DisplayName>Email Address</DisplayName>
  <DataType>string</DataType>
  <UserHelpText>Email address that can be used to contact you.</UserHelpText>
  <UserInputType>EmailBox</UserInputType>
  <Restriction>
    <Pattern RegularExpression="^[a-zA-Z0-9.+!#$%&amp;'+^_`{}~-]+(?:\.[a-zA-Z0-9!#$%&amp;'+^_`{}~-]+)*@(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$" HelpText="Please enter a valid email address." />
  </Restriction>
</ClaimType>

密码Password

Password 用户输入类型用于记录用户输入的密码。The Password user input type is used to record a password entered by the user.

<ClaimType Id="password">
  <DisplayName>Password</DisplayName>
  <DataType>string</DataType>
  <UserHelpText>Enter password</UserHelpText>
  <UserInputType>Password</UserInputType>
</ClaimType>

DateTimeDropdownDateTimeDropdown

DateTimeDropdown 用户输入类型用于提供一组用来选择日、月和年的下拉列表。The DateTimeDropdown user input type is used to provide a set of drop-downs to select a day, month, and year. 可以使用 Predicates 和 PredicateValidations 元素来控制最小日期值和最大日期值。You can use Predicates and PredicateValidations elements to control the minimum and maximum date values. 有关详细信息，请参阅 Predicates 和 PredicateValidations 的 “配置日期范围”部分。For more information, see the Configure a date range section of Predicates and PredicateValidations.

<ClaimType Id="dateOfBirth">
  <DisplayName>Date Of Birth</DisplayName>
  <DataType>date</DataType>
  <UserHelpText>The date on which you were born.</UserHelpText>
  <UserInputType>DateTimeDropdown</UserInputType>
</ClaimType>

RadioSingleSelectRadioSingleSelect

RadioSingleSelect 用户输入类型用于提供允许用户选择一个选项的单选按钮集合。The RadioSingleSelect user input type is used to provide a collection of radio buttons that allows the user to select one option.

<ClaimType Id="color">
  <DisplayName>Preferred color</DisplayName>
  <DataType>string</DataType>
  <UserInputType>RadioSingleSelect</UserInputType>
  <Restriction>
    <Enumeration Text="Blue" Value="Blue" SelectByDefault="false" />
    <Enumeration Text="Green " Value="Green" SelectByDefault="false" />
    <Enumeration Text="Orange" Value="Orange" SelectByDefault="true" />
  </Restriction>
</ClaimType>

DropdownSingleSelectDropdownSingleSelect

DropdownSingleSelect 用户输入类型用于提供允许用户选择一个选项的下拉框。The DropdownSingleSelect user input type is used to provide a drop-down box that allows the user to select one option.

<ClaimType Id="city">
  <DisplayName>City where you work</DisplayName>
  <DataType>string</DataType>
  <UserInputType>DropdownSingleSelect</UserInputType>
  <Restriction>
    <Enumeration Text="Bellevue" Value="bellevue" SelectByDefault="false" />
    <Enumeration Text="Redmond" Value="redmond" SelectByDefault="false" />
    <Enumeration Text="New York" Value="new-york" SelectByDefault="true" />
  </Restriction>
</ClaimType>

CheckboxMultiSelectCheckboxMultiSelect

CheckboxMultiSelect 用户输入类型用于提供允许用户选择多个选项的复选框集合。The CheckboxMultiSelect user input type is used to provide a collection of checkboxes that allows the user to select multiple options.

<ClaimType Id="languages">
  <DisplayName>Languages you speak</DisplayName>
  <DataType>string</DataType>
  <UserInputType>CheckboxMultiSelect</UserInputType>
  <Restriction>
    <Enumeration Text="English" Value="English" SelectByDefault="true" />
    <Enumeration Text="France " Value="France" SelectByDefault="false" />
    <Enumeration Text="Spanish" Value="Spanish" SelectByDefault="false" />
  </Restriction>
</ClaimType>

ReadonlyReadonly

Readonly 用户输入类型用于提供要显示声明和值的只读字段。The Readonly user input type is used to provide a readonly field to display the claim and value.

<ClaimType Id="membershipNumber">
  <DisplayName>Membership number</DisplayName>
  <DataType>string</DataType>
  <UserHelpText>Your membership number (read only)</UserHelpText>
  <UserInputType>Readonly</UserInputType>
</ClaimType>

ParagraphParagraph

Paragraph 用户输入类型用于提供仅在段落标记中显示文本的字段。The Paragraph user input type is used to provide a field that shows text only in a paragraph tag. 例如，<p>文本</p>。For example, <p>text</p>. 自断言技术配置文件的 Paragraph 用户输入类型 OutputClaim 必须将 Required 属性设置为 false（默认值）。A Paragraph user input type OutputClaim of self-asserted technical profile, must set the Required attribute false (default).

<ClaimType Id="responseMsg">
  <DisplayName>Error message: </DisplayName>
  <DataType>string</DataType>
  <AdminHelpText>A claim responsible for holding response messages to send to the relying party</AdminHelpText>
  <UserHelpText>A claim responsible for holding response messages to send to the relying party</UserHelpText>
  <UserInputType>Paragraph</UserInputType>
  <Restriction>
    <Enumeration Text="B2C_V1_90001" Value="You cannot sign in because you are a minor" />
    <Enumeration Text="B2C_V1_90002" Value="This action can only be performed by gold members" />
    <Enumeration Text="B2C_V1_90003" Value="You have not been enabled for this operation" />
  </Restriction>
</ClaimType>