AD B2C in .net core 6 api - How to save custom user attributes and return as claims in token?

Question

Hi All, I'm kind of new to this ecosystem so I'm not sure if I'm asking the right questions or going about things the correct way, but I'm trying to find some documentation on how to set custom user attributes for a user, and then return that information as claims within a token to a front-end when logging in. My flow looks like this:

• Front-End (Angular with MSAL.js) creates account
• Azure calls API Connector on my API before user is created.
• API Connector method creates a new user on MY database and returns the id like so: return (ActionResult)new OkObjectResult(new ResponseContent()
  {
  extension_AppUserId = newUserId.ToString(),
  });
• When the call is completed, the token passed back to the front-end includes extension_AppUserId, but when logging in in the future it does not, and when I try to use GraphAPI to query that user, (Using Microsoft.Graph.GraphServicesClient), that value does not appear. var results = await graphClient
  .Users
  .Request()
  .Select("extension_[clientId]_AppUserId,extension_AppUserId,AppUserId")
  .GetAsync();

Questions:

1. Is my workflow to store user info in Azure and return via token to the front-end (and therefore, API also) viable? Or should it be done some other way?
2. Is the API Connector actually saving data to the User in Azure? or is it just returning added claims without any persistence?
3. If not, do I need to save data to a user via Graph? And how can I do that in the API connector, if the user is not even actually created yet?

Thanks for your help! I've read a ton of documentation and tried a bunch of things over the past month and I'm still having trouble with this so I'd love for some more experienced insight.

Answer 1

Hi @Matthew Cheah,

Thanks for reaching out.

Your understating is correct, and we can enrich token with claims using API connectors.

I am assuming you are using user flow to add custom attribute. Could you please confirm below:

1. Did you add the extension attribute extension_AppUserId through portal or through Graph API?
2. Are you enabling the API connector before creating the user or before including application claims in token? Is my workflow to store user info in Azure and return via token to the front-end (and therefore, API also) viable? Or should it be done some other way? Yes, your approach seems to be correct. You need to create custom claim in user attributes, enable the API connector and select the same in application claims to return the custom claim in the token.
   1. Is the API Connector actually saving data to the User in Azure? or is it just returning added claims without any persistence? As in your case, API connector is calling before creating the user which will invoke API connector after the attribute collection page if any and query external API about the user to return it in the application token and store it in Azure AD B2C.
   2. If not, do I need to save data to a user via Graph? And how can I do that in the API connector, if the user is not even actually created yet? Using Graph API, you can retrieve custom attribute using
   3. https://graph.microsoft.com/v1.0/users/?$select=extension_{b2c-extensions-app-id-without-dashes}_AppUserId
   4. Custom attributes (directory extensions) in the Microsoft Graph API are named by using the convention extension_{appId-without-hyphens}_{extensionProperty-name} where {appId-without-hyphens} is the stripped version of the appId (called Client ID on the Azure AD B2C portal) for the b2c-extensions-app.
   5. When you create an extension attribute using Graph API, it is not added to the policy and usually created on an application other than b2c-extensions-app. When you create an extension attribute using Graph API, it is not added to the policy and usually created on an application other than b2c-extensions-app. You can use these properties directly in custom policies, but they will not appear in the portal and cannot be used in the policies created through the portal.
   Also, Extensions are not returned by default. You need specify the extension in Select

   var user = await graphClient.Users["{GUID HERE}"]
           .Request()
           .Select("extension_extensionAppId_AppUserId")
           .GetResponseAsync();
   The value should be available through AdditionalData.
   var extValue = user.AdditionalData["extension_extensionAppId_AppUserId"];

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.