CODEWITHSUNDEEP
azure-active-directorymicrosoft-identity-platform
Victorio Berra
Victorio Berra

Reputation: 3105

Can I add a custom static claim to auth tokens with a AAD OIDC app registration?

I have a basic Azure AD App Registration. This is a non-interactive client IE console/machine client with a secret and no redirect URI. I would also like this to also work for interactive clients however.

How can I add a claim to my token called "hello": "world"?

Upvotes: 0

Views: 1678

Answers (1)

Sridevi
Sridevi

Reputation: 22442

To add a custom claim like "hello": "world" in the token, you can create claim mapping policy using PowerShell.

1)Make sure to have AzureADPreview module installed, before running below commands.

Connect-AzureAD
New-AzureADPolicy -Definition @('
{
    "ClaimsMappingPolicy":
    {
        "Version":1,"IncludeBasicClaimSet":"true", 
        "ClaimsSchema": [{"Source":"user","ID":"extensionattribute1","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/hello","JwtClaimType":"hello"}]
    }
}') -DisplayName "HelloExtraClaim" -Type "ClaimsMappingPolicy"

Output:

enter image description here

2)Note the ID of the policy and assign it to your service principal using below command:

Add-AzureADServicePrincipalPolicy -Id serviceprincipal_ObjectID -RefObjectId policy_ID

3)To confirm whether the policy is assigned or not, run below command:

Get-AzureADServicePrincipalPolicy -Id serviceprincipal_ObjectID

Output:

enter image description here

4)To assign value to that claim, sign in as admin to Microsoft Graph Explorer and run the below query:

PATCH https://graph.microsoft.com/beta/me
{
"onPremisesExtensionAttributes": 
    {
        "extensionAttribute1": "world"
    }
}

Response: enter image description here

5)Make sure to set "acceptMappedClaims": true in App's Manifest like below:

Go to Azure Portal -> Azure Active Directory -> App registrations -> Your App -> Manifest

enter image description here

6)Go to Expose an API tab and set Application ID URI to your domain like below:

enter image description here

7)Generate a token to your application by signing with admin account.

After decoding the above ID token in jwt.ms, I got the claim "hello": "world" successfully as below:

enter image description here

Credits: How to add custom user defined claims to azure ad token | GitHub by TiagoBrenck

Upvotes: 1

Related Questions