CODEWITHSUNDEEP
azure-ad-b2copenid-connectazure-ad-b2c-custom-policy
Reysic
Reysic

Reputation: 11

Retrieve custom claim from federating IdP access token in Azure AD B2C custom policy

I am configuring an OIDC-based SSO flow in Azure AD B2C using custom policy to allow users to login to downstream applications with their federated identity provider's (IdP) credentials. Custom policy is used to allow some complex business logic to be run prior to providing the token to the downstream applications.

The flow is correctly redirecting users to the external IdP for login and ultimately back to my downstream applications with associated claims. However, there is a custom claim that is only available in the access token received by B2C from the external IdP (not the ID token), and I can't figure out how to retrieve this claim from the access token to be used in the B2C user journey and ultimately provided with all the other claims to the downstream applications.

I can see that B2C does receive both the ID and access tokens by reviewing Application Insights logs (sample output):

"TESTtechnicalprofile": {
    "ContentType": "Jwt",
    "Created": "2022-10-15T07:37:45.8678974Z",
    "Key": "TESTtechnicalprofile",
    "Persistent": true,
    "Value": "eyJhb..."
},
"TESTtechnicalprofileaccess_token": {
    "ContentType": "Unspecified",
    "Created": "2022-10-15T07:37:45.8678974Z",
    "Key": "TESTtechnicalprofileaccess_token",
    "Persistent": false,
    "Value": "eyJhb..."
},

And general format of the payloads of the tokens is as follows:

ID Token

{
    "<name of custom claim I can retrieve>": "custom claim value",
    "iss": ...,
    ...
}

Access Token

{
    "<name of custom claim I cannot retrieve>": "custom claim value",
    "iss": ...,
    ...
}

I can successfully retrieve claims from the ID token by mapping from the partner claim type:

<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="<name of claim containing email in ID token>" />

However this same method doesn't work for claims in the access token. If I reference the name of the custom claim in the access token in PartnerClaimType then B2C omits the claim (presumably because it fails to retrieve it).

I've tried retrieving the access token itself as a claim using the method described here and that works (token in claim matches token seen in Application Insights logs), however I'm not sure if it's possible to decode this token in B2C policy and subsequently pull claims from it (or even if one would want to do that).

While I could let the downstream applications retrieve what they need from the access token, I have business logic in my user journey that needs this claim prior to providing the final token to the applications.

Upvotes: 1

Views: 882

Answers (1)

Reysic
Reysic

Reputation: 11

Following up here for anyone else trying to do the same, according to Microsoft Support it isn't possible to extract a claim from an access token in B2C policy. I ended up crafting a workaround involving calling an external REST API from B2C to retrieve the needed info for the user journey.

Upvotes: 0

Related Questions