CODEWITHSUNDEEP
azure-ad-b2cazure-ad-b2c-custom-policy
Jakub Bochenski
Jakub Bochenski

Reputation: 3271

Different claims for id and access token

I know how to configure custom claims https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-tokens?pivots=b2c-custom-policy

The problem is the same claims are included in access token and id token.

I want to include "displayName" claim in the id token, but not in the access token, but I don't see a way to differentiate the two

Upvotes: 0

Views: 1150

Answers (2)

Jas Suri - MSFT
Jas Suri - MSFT

Reputation: 11315

Its currently not possible to have different claim set in Access Token vs ID Token.

Upvotes: 4

Kartik Bhiwapurkar
Kartik Bhiwapurkar

Reputation: 5159

• You can edit the claims in the ID token and the access token in the implicit flow only while the same is not possible for authorization code flow with PKCE since the tokens in auth code flow with PKCE are set on the client side due to which they need to be flushed out first. Also, you can configure the relying party claims to be issued in the ID token and the access token in the custom policies for that application registered in B2C.

• Also, the relying party claims that are configured in the input claims and output claims section in the technical profile of the custom policy form the relying party definition which determines the ID token and the access token respectively. And both the tokens return with the same set of claims. You can configure the claims to be issued in the JWT token in the RP section for the implicit flow as below: -

   ‘ <RelyingParty>
  <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
  <TechnicalProfile Id="PolicyProfile">
   <DisplayName>PolicyProfile</DisplayName>
   <Protocol Name="OpenIdConnect" />
   <OutputClaims>
     <OutputClaim ClaimTypeReferenceId="displayName" />
  <OutputClaim ClaimTypeReferenceId="givenName" />
  <OutputClaim ClaimTypeReferenceId="surname" />
  <OutputClaim ClaimTypeReferenceId="email" />
  <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
  <OutputClaim ClaimTypeReferenceId="identityProvider" />
   </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
   </TechnicalProfile>
   </RelyingParty>

 {
    ...
    "sub": "6fbbd70d-262b-4b50-804c-257ae1706ef2",
     ...
   } ‘

Thus, through the token technical profile that you define for each ID and the access token in implicit flow, the claims can be passed and used accordingly.

Please find the below links for more information: -

https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy#configure-your-custom-policy

Upvotes: 0

Related Questions