Client Credentials Flow | How to read azp (application id) value and use it to get application name in Client Credentials flow?

Question

Hi Team,

We are generating a token with Client Credentials flow and custom policy.

We get application id as "azp" in the token. We also need application name in the token.

Is there any direct way to configure B2C custom policy to get application name in the token?

As per our discovery, there is no direct way to get application name in the token and that is why we are thinking to integrate REST endpoint to enrich token claims. This REST endpoint will be a GET endpoint which will accept application id i.e "azp" and return application name.

However, we are unable to read and pass "azp" to REST endpoint. Could you please help us to figure out what we would be missing here to read azp?

Token generation endpoint -

REST endpoint TechnicalProfile -

 <TechnicalProfile Id="REST-GetApplicationName">
            <DisplayName>Get portal user's extended profile details from Salesforce through rest api call</DisplayName>
            <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
            <Metadata>
              <Item Key="ServiceUrl">
                https://user-management-api/v1/b2capplication
              </Item>
              <Item Key="AuthenticationType">ApiKeyHeader</Item>
              <Item Key="SendClaimsIn">QueryString</Item>
              <Item Key="DebugMode">true</Item>
              <Item Key="DefaultUserMessageIfRequestFailed">Cannot process your request right now, please try again later.</Item>
              <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item>
            </Metadata>
            <CryptographicKeys>
              <Key Id="x-api-key" StorageReferenceId="B2C_1A_RESTConnectorXApiKey"/>
            </CryptographicKeys>
            <InputClaims> 
             <InputClaim ClaimTypeReferenceId="azp" PartnerClaimType="application_id" />
            </InputClaims>
            <OutputClaims>
              <OutputClaim ClaimTypeReferenceId="client_application_name" PartnerClaimType="application_name"/>
            </OutputClaims>
            <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/>
          </TechnicalProfile>

UserJourney -

<UserJourneys>
    <UserJourney Id="ClientCredentialsJourney">
      <OrchestrationSteps>
        <!-- Do the client credentials and emit some claims -->
        <OrchestrationStep Order="1" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="ClientCredSetupExchange" TechnicalProfileReferenceId="ClientCredentials_Setup" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="TrackAppInsights-ClientCredentials_LogA" TechnicalProfileReferenceId="AppInsights-ClientCredentials_LogA" />
          </ClaimsExchanges>
        </OrchestrationStep>        

        <!-- Call a REST API or claims transformation -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="RESTGetApplicationName" TechnicalProfileReferenceId="REST-GetApplicationName"/>
          </ClaimsExchanges>
        </OrchestrationStep>
       
        <!-- Send the claims -->
        <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />

        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="TrackAppInsights-ClientCredentials_LogB" TechnicalProfileReferenceId="AppInsights-ClientCredentials_LogB" />
          </ClaimsExchanges>
        </OrchestrationStep>
        
      </OrchestrationSteps>
    </UserJourney>

Thank you for the help in advance!

Answer 1

Hi @Kiran Zende ,

Thanks for reaching out.

You can use the claim resolver here https://learn.microsoft.com/en-us/azure/active-directory-b2c/claim-resolver-overview to get the claim value.

Firstly, declare an applicationId (or similar) claim type:

Then in the REST API technical profile, refer to this applicationId claim using the {OIDC:ClientId} claims resolver.

<InputClaim ClaimTypeReferenceId="applicationId" DefaultValue="{OIDC:ClientId}" AlwaysUseDefaultValue="true" />

Thanks,

Shweta