Use extension attributes inside token generated for application

asosinski 5

Hi,

In a service-to-service scenario, I want to generate a token for App1, to be able to access App2, but within the token, I need to have a custom claim defined. Both applications are registered within the same Azure B2C.

I have gone through the documentation related to extension attributes and specifically to directory extension attributes. It is mentioned in the table that for directory extension target type can be set to application, which makes me assume I can potentially define an extension attribute with value on the application. But, I want to later have that value as one of the claims for an access token generated using Client Credentials which are application ClientId and Secret.

There is documentation on how to have such a claim when it is a User (not an application), that is, requesting a token but, was not able, to find specific instructions for my case. Can you provide me with some links or code snippets on how to achieve it?

3 answers

Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-05T17:13:45.62+00:00

Hi @asosinski

Based on the documentation, you can request an access token to B2C using a SP the same way as you do against an Entra ID tenant.

Since we clarified that, could you please confirm if the application in scope is the one that you changed the manifest to add the custom claim? I'm sharing a request example below:

grant_type=authorization_code

&client_id=<application-ID>

&scope=<application-ID-URI>/<scope-name> -> This should be the application ID URI from the resource application

&code=eyJraWQiOiJjcGltY29yZV8wOTI1MjAxNSIsInZlciI6IjEuMC...

&redirect_uri=https://jwt.ms

&client_secret=2hMG2-_:y12n10vwH...

Also, the documentation states that you need to set both acceptMappedClaims and allowPublicClient attributes to True on the resource application manifest, could you please confirm that?

Would it be possible for you to send me the manifest hiding any potential confidential information? It could be a screenshot only.

Thanks,

Fabio
Please sign in to rate this answer.

1 person found this answer helpful.
Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-09-22T21:26:18.09+00:00

Hi @asosinski ,

If I understand it correctly, you want to add custom claims to an access token for your B2C application.

The links below have more information about adding such claims and also its prerequisites.

https://learn.microsoft.com/en-us/azure/active-directory/external-identities/customers/how-to-add-attributes-to-token

https://learn.microsoft.com/en-us/azure/active-directory/external-identities/customers/how-to-define-custom-attributes

Let me know if I'm missing anything.

Thanks

asosinski 5 Reputation points

2023-09-23T09:52:36.7766667+00:00

Hi @Fabio Andrade

Thanks for a quick answer. I will give it a try with the first link as I haven't seen that one previously.

Just to confirm, documentation is mostly about additional user claims in, user authenticating for an app scenario. My scenario is a service-to-service, without a user involved. Will it work the same way? As I was not able to add an extension attribute to a Service Principal of the Enterprise Application, only was able to add it for the Application Registry object.

Thanks

asosinski 5 Reputation points

2023-09-26T05:55:14.24+00:00

Hi @Fabio Andrade

I have tried suggestions from the first link without luck. Please let me know if I'm doing something wrong.

I will put it in points to better track steps:

Register Client Application

Create extension attribute associated with Client Application with TargetObjects set to Application

Register a custom policy with such a definition: "{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\",\"ClaimsSchema\": [{\"Source\":\"application\",\"ExtensionID\":\"extension_433bb2b7073b464fa29b8fdeb08ee7a3_merchantId\",\"JwtClaimType\":\"merchantId\"}]}}"

Associate policy with ServicePrincipal of ClientApplication

Add value for extension attribute to the ClientApplication manifest

Make a get access token call (using client credentials) where ClientId is the ClientApplication ClientId, setting the scope to '.default'

I would expect the merchantId claim to be present with value defined within manifest.

Thanks

Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-02T22:05:45.1733333+00:00

Hi @asosinski

I'm really sorry about the delay, I totally overlooked the fact that you wrote a comment instead of an answer, will pay more attention to it next time.

I need to confirm if you could achieve that when using a service principal instead of a user. In the meantime, could you please share which are the claims that are present in the token requested by the SP? I just need the claim types, you can hide the values.

Thanks.

asosinski 5 Reputation points

2023-10-03T12:17:09.7133333+00:00

Hi @Fabio Andrade

I will use answers instead of comments if that helps.

Below is the list of claims I get from the access token

aud

is

iat

nbf

exp

aio

appid

appidacr

idp

oid

rh

sub

tid

uti

ver

I will be waiting for the response regarding using the service principal.

Thanks

asosinski 5 Reputation points

2023-10-06T08:37:37.27+00:00

Hi @Fabio Andrade

Below is the manifest from the resource application. As a note for the OptionalClaims source, I have tried setting it to null as well.

{ "id": "5739812b-adfd-4cb8-8fd0-38c6194468c8", "acceptMappedClaims": true, "accessTokenAcceptedVersion": null, "addIns": [], "allowPublicClient": true, "appId": "dd5512bb-2789-4bcb-8b3e-de974abf578a", "appRoles": [ { "allowedMemberTypes": [ "User" ], "description": "Gives access to API", "displayName": "Access", "id": "72d189e1-a313-4f63-a675-033275050740", "isEnabled": true, "lang": null, "origin": "Application", "value": "Access" } ], "oauth2AllowUrlPathMatching": false, "createdDateTime": "2023-06-16T09:39:24Z", "description": null, "certification": null, "disabledByMicrosoftStatus": null, "groupMembershipClaims": null, "identifierUris": [ "https://ascodingpoland.onmicrosoft.com/dd5512bb-2789-4bcb-8b3e-de974abf578a" ], "informationalUrls": { "termsOfService": null, "support": null, "privacy": null, "marketing": null }, "keyCredentials": [], "knownClientApplications": [], "logoUrl": null, "logoutUrl": null, "name": "backend", "notes": null, "oauth2AllowIdTokenImplicitFlow": false, "oauth2AllowImplicitFlow": false, "oauth2Permissions": [ { "adminConsentDescription": "Test", "adminConsentDisplayName": "Test", "id": "84c00d2c-c272-491c-bfdc-5a4bac02bf0e", "isEnabled": true, "lang": null, "origin": "Application", "type": "Admin", "userConsentDescription": null, "userConsentDisplayName": null, "value": "Test" } ], "oauth2RequirePostResponse": false, "optionalClaims": { "idToken": [], "accessToken": [ { "name": "extension_308efd53c19f4f6586a412ec43c15255_merchantId", "source": "User", "essential": false, "additionalProperties": [] } ], "saml2Token": [] }, "orgRestrictions": [], "parentalControlSettings": { "countriesBlockedForMinors": [], "legalAgeGroupRule": "Allow" }, "passwordCredentials": [], "preAuthorizedApplications": [], "publisherDomain": "ascodingpoland.onmicrosoft.com", "replyUrlsWithType": [], "requiredResourceAccess": [ { "resourceAppId": "00000003-0000-0000-c000-000000000000", "resourceAccess": [ { "id": "37f7f235-527c-4136-accd-4a02d197296e", "type": "Scope" }, { "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182", "type": "Scope" } ] } ], "samlMetadataUrl": null, "signInUrl": null, "signInAudience": "AzureADMyOrg", "tags": [], "tokenEncryptionKeyId": null, "extension_308efd53c19f4f6586a412ec43c15255_merchantId": "abc123" }

I would appreciate a walkthrough on how to configure applications and associated service principals so that I will be able to see the custom claim.

Thakns

Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-11T23:24:36.0366667+00:00

Hi @asosinski ,

Thanks for sensing the manifest.

I just wanted to take two steps back and try to understand what would you like to achieve with the custom attribute. I came up with 2 options but let me know if I'm missing something,

1 - You want to use your Service Principal to get an access / ID token from AAD B2C in order to read the user directory extended attribute Merchant ID?

2 - You want to use your Service Principal to get an access / ID token from AAD B2C that contains a claim the directory extended attribute Merchant ID assuming that your application will need that claim to make an authorization decision.

The reason why I'm asking about that is because so far, I'm inclined to believe that your main goal is what's described in the option number 2, and even though you can use Directory Extensions to application resource, Azure B2C tenants will follow what's in the user / custom policy, working differently than a regular Entra ID tenant.

Sorry for the constant back and forth on this thread, but I just wanted to make sure that I understood 100% of your request.

Thanks,

Fabio

asosinski 5 Reputation points

2023-10-12T06:43:48.88+00:00

Hi @Fabio Andrade

I'm pretty sure option two is what I need, but let me precise it a little.

Assuming there is an application, that is the core of a business. We are registering a client application for every individual integrator with our business application. That property merchantId is unique for each integrator and contains information required for further processing of any of the requests made to the business application, so we would like to have it as part of the access token generated by the integrator application to access our business application.

Did I understand correctly that even though, there is no user involved, generating an access token will somehow take into consideration user policy, as I have none policy defined?

Thanks

Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-13T00:12:16.94+00:00

Hi @asosinski

Thanks for sharing more details about your request.

Since you have no user involved, it doesn't seem that B2C would be the best solution for your since it's more targeted for consumers where you can integrate other IDPs like Facebook, Google, etc.

One last thing that I'd test is to create an extension to the application object using the documentation below. Since the doc is not from B2C I'm not sure if it would work but I think it worth the test:

https://learn.microsoft.com/en-us/graph/api/application-post-extensionproperty?view=graph-rest-1.0&tabs=http

https://learn.microsoft.com/en-us/graph/api/resources/application?view=graph-rest-1.0

If it doesn't work either, I strongly recommend you using the Entra ID tenant instead of B2C since it does not depend on any user or custom flow for the sign in.

Thanks,

Fabio

asosinski 5 Reputation points

2023-10-13T07:41:25.06+00:00

Hi @Fabio Andrade

I have already tried that as mentioned in the comment under your initial response on the 26th of September, where I described all the steps I did in terms of configuration following the documentation.

We need to use B2C as we are also planning to have users, using external IDP integrations as you mentioned, to be able to access the business applications.

Also, I would assume that for service-to-service access_token we are using the default EntraID mechanism as we are calling https://login.microsoftonline.com/[b2cTenantId]/oauth2/v2.0/token and not a b2c endpoint. Am I wrong on that?

Can you provide me with a step-by-step guide on how to achieve that for EntraID registered applications, as I understand it is possible for that kind of tenant?

Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-16T22:07:02.6866667+00:00

Hi @asosinski

Yes, you will be using the B2C tenant since its Tenant ID is the one present in the login URL, this is a complete separate tenant from the Entra ID one.

To customize the claims on an EntraID tenant is basically the same process as with the B2C one, but the main change is that there will be no user flow policies in place for each sign in as this type of tenant is more focused for consumer sign in. the document below has more information about customizing JWT, ID and Access tokens: https://learn.microsoft.com/en-us/azure/active-directory/develop/jwt-claims-customization

If it does not work either, I'd suggest you to open a support ticket with our B2C team. If you do not have that option available to you, let me know as we can work on another way for you to open it.

Thanks,

Fabio
Please sign in to rate this answer.
asosinski 5 Reputation points

2023-10-17T07:35:03.3066667+00:00

Hi @Fabio Andrade

I haven't at any point mentioned customization of a JWT claim, so do not know why you provided me with this documentation.

Once again, what I need is to be able to have an additional claim (not customized) within access_token, and the source of the value for it should be an application that is requesting the token using this URL https://login.microsoftonline.com/[myTenantId]/oauth2/v2.0/token.

This image also shows where I took the TenantId from (this is my B2C tenant).

If you are not able to provide me with a step-by-step guide on how to achieve this, please point me to someone who can do that, as I have lost a few weeks already waiting for this information from you.

Thanks

Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-17T21:34:53.19+00:00

Hi @asosinski

What we call "custom claim" is any claim that is not available to be added to the JWT token by default, I'm sorry if I made any confusion about it.

In order to speed up the process, I strongly recommend you open an Azure Support case with our B2C team. If you do not have an Azure Support plan, please email me with the info below and I'll go ahead and enable a one-time free technical support request for your subscription so you can work with our support engineers to get this issue resolved.

Email: AzCommunity@microsoft.com

Subject: ATTN - Fabio Andrade

Body:

Azure Subscription ID

Link to this issue

Thanks,

Fabio
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Fabio Andrade 1,665 Reputation points Microsoft Employee

2023-10-26T20:41:48.64+00:00

Hi @asosinski

I just wanted to check if you want me to help you with opening a support case with Microsoft for your B2C query.

Thanks,

Fabio
Please sign in to rate this answer.
asosinski 5 Reputation points

2023-10-27T06:12:57+00:00

Hi @Fabio Andrade

I've managed to open a support ticket through the company.

Thanks

linda123998 0 Reputation points

2024-05-15T13:03:45.0433333+00:00

I also have this same issue, although I'm using Entra ID. I have added a directory extension with the "targetObjects": [ "Application"] and I am not able to propagate this to the access token.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Use extension attributes inside token generated for application

3 answers

Your answer