Azure AD B2C自定义策略密钥管理：我可以上传2个策略密钥，并将两个密钥用于ID提示令牌验证吗？
我有一个自定义Azure AD B2C使用单个策略密钥注册邀请流。该键用于签署邀请链接电子邮件中包含的令牌，然后在注册时间进行验证。证书即将到期，我正在尝试弄清楚如何不影响不接受邀请的用户。
我们生成的ID令牌持续1个月。
我有一个具有当前密钥的密钥容器（B2C_1A_IDTOKENHINTCERT）。关键容器在我的自定义策略中引用。我想将更新的证书添加到同一密钥容器中，以便在ON容器中有2个键，然后在Web服务器上交换使用链接使用签名令牌的证书。
我希望使用当前证书签名的两个旧链接以及新证书生成的新链接在注册期间有效。
这可能吗？
I have a custom Azure AD B2C Sign Up Invitation flow with a single policy key. The key is used to sign the token that's contained in the invitation link email and is then validated at sign up time. The cert is expiring soon and I'm trying to figure out how to not impact users who've not accepted an invitation.
The id token that we generate is good for 1 month.
I have a key container (B2C_1A_IdTokenHintCert) that has the current key. The key container is referenced in my custom policy. I'd like to add the renewed cert to the same key container so that there are 2 keys in the on container and then swap out the cert on the web server that generates the link with the signed token.
I'd like for both old links that are signed with the current cert and new links generated with the new cert be valid during signup.
Is this possible?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您每个策略密钥ID只能具有一个值。但是，您可以将新证书作为新的策略密钥上传，然后在用户旅程中添加附加的技术资料，以验证您针对新策略密钥的标记提示。示例：步骤1试图验证对策略密钥1的标记提示，如果不成功，请尝试验证对策略密钥2的标记提示。那样，可以验证旧的链接和新链接。
You can only have one value per policy key id. However, you can upload your new certificate as a new policy key, then add an additional technical profile into your user journey that validates your token hint against the new policy key. Example: Step 1 tries to validate the token hint against policy key 1, if it's not successful, then try to validate the token hint against policy key 2. That way old links and new links can both be validated.
您可以在密钥容器中拥有多个证书。该系统将同时确定邀请令牌是否有效，直到证书本身到期为止。
You can have more than one certificate inside a key container. The system will use both to determine if the invitation token is valid up until the cert itself expires.