Adding On-prem SAM account name in JWT access token

Question

I am getting error like "C:\azureclitaskscript17057276.sh: line 13: $'={\n "accessToken": [\n {\n "name": "On-premises SAM account name",\n "source": null,\n "essential": false,\n "additionalProperties": []\n\n }\n ] \n}': command not found

ERROR: Unsupported or invalid query filter clause specified for property 'identifierUris' of resource 'Application'."

Answer 1

@Anonymous

Thank you for posting this in Microsoft Q&A.

As I understand you are trying to configure a claim to get on-prem SAM account name as claim in JWT access token.

You can configure this by using AzureADserviceprincipalpolicy. This will link a policy with the service principal in Azure AD. Whenever this service principal is accessed, it will emit claims which are configured for this application.

You can follow the steps mentioned below:

• Create an AzureADPolicy.

New-AzureADPolicy -Definition @('{
"ClaimsMappingPolicy": {
"Version": 1,
"IncludeBasicClaimSet": "true",
"ClaimsSchema": [{

"Source": "user",
"ID": "onpremisessamaccountname",
"SamlClaimType": "samaccountname",
"JwtClaimType": "samAccountName"
}

]
}
}') -DisplayName "CustomClaimsPolicy1" -Type "ClaimsMappingPolicy"

• Post this you will have to attach the newly created AzureADPolicy to a specific AzureAD App's Serviceprincipal for which the token would be requested for.

Add-AzureADServicePrincipalPolicy -Id {object id of service principal} -RefObjectId {object id of policy}

• To check if the policy is successfully added to the ServicePrincipal or not:

Get-AzureADServicePrincipalPolicy -Id "{object id of service principal}"

• Next you can use the Authorization Code flow of OAuth2.0 and request for a code from AAD.
• Once you have the code, use the code to request for an access token from AAD for the above app on whose ServicePrincipal the AzureADPolicy was added. [I used POSTMAN tool to test the same]

• Once you get the Access Token use https://jwt.ms to see the decoded JWT and you should see the SamAccountName listed in it as claims.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.