密码重置子旅程后Azure B2C强制登录

我们正在使用密码重置子旅程，如此处所述（https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-password-reset-policy?pivots=b2c-custom-policy#self-service-password-reset-recommended https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-password-reset-policy?pivots=b2c-custom-policy#self-service-password-reset-recommended).

使用此功能时，用户会自动登录成功的密码重置流程。我们希望阻止这种情况，并在密码重置成功后将用户重定向到登录页面。

我们如何才能实现这一目标，主要旅程如下：

    <UserJourney Id="SignIn">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signin">
              <ClaimsProviderSelections>
                <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
                <ClaimsProviderSelection TargetClaimsExchangeId="ForgotPasswordExchange" />
              </ClaimsProviderSelections>
              <ClaimsExchanges>
                <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <Preconditions>
                <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                  <Value>objectId</Value>
                  <Action>SkipThisOrchestrationStep</Action>
                </Precondition>
              </Preconditions>
              <ClaimsExchanges>
                <ClaimsExchange Id="ForgotPasswordExchange" TechnicalProfileReferenceId="ForgotPassword" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="InvokeSubJourney">
              <Preconditions>
                <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
                  <Value>isForgotPassword</Value>
                  <Action>SkipThisOrchestrationStep</Action>
                </Precondition>
              </Preconditions>
              <JourneyList>
                <Candidate SubJourneyReferenceId="PasswordReset" />
              </JourneyList>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>.....
------------------------------------------------------
    <SubJourney Id="PasswordReset" Type="Call">
          <OrchestrationSteps>
            <OrchestrationStep Order="1" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="PasswordResetUsingEmailAddressExchange" TechnicalProfileReferenceId="LocalAccountDiscoveryUsingLogonName" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <!-- This step reads any user attributes that we may not have received when in the token. -->
            <OrchestrationStep Order="2" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="VerifyEmail" TechnicalProfileReferenceId="VerifyEmail" />
              </ClaimsExchanges>
            </OrchestrationStep>
            <OrchestrationStep Order="4" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="NewCredentials" TechnicalProfileReferenceId="LocalAccountWritePasswordUsingObjectId" />
              </ClaimsExchanges>
            </OrchestrationStep>
          </OrchestrationSteps>

Option 1

一个简单的解决方案（可能并不理想）是阻止用户使用没有取消/继续按钮的自断言页面作为密码重置子旅程的最后一步。这样用户永远不会获得 jwt 令牌。
您可以在自断言页面中包含一些文本，例如“您的密码已成功重置”。请重新登录。您还可以在同一页面中提供登录 URL，以便用户可以导航到它或使用 JavaScript 在延迟后重定向。

Example:

 <TechnicalProfile Id="SelfAsserted-PasswordResetBlockPage">
    <DisplayName>Show Block message</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
        <Item Key="AllowGenerationOfClaimsWithNullValues">true</Item>
        <Item Key="setting.showContinueButton">false</Item>
        <Item Key="setting.showCancelButton">false</Item>
    </Metadata>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="responseMsg" DefaultValue="Your password has been reset successfully. Please login again with your new credentials." AlwaysUseDefaultValue="true"/>
    </InputClaims>
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="responseMsg" />
    </OutputClaims>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

<ClaimType Id="responseMsg">
    <DisplayName>Information</DisplayName>
    <DataType>string</DataType>
    <AdminHelpText>A claim responsible for holding response messages to send to the relying party</AdminHelpText>
    <UserHelpText>A claim responsible for holding response messages to send to the relying party</UserHelpText>
    <UserInputType>Paragraph</UserInputType>
</ClaimType>

Option 2
具有在密码重置后再次登录的编排步骤。如果尚未完成密码重置，请跳过它。

Note：确保进行广泛的测试，尤其是 SSO 流程，以确保一切按预期工作。