Entra External Id > Utilize external Claims Service (REST API) with ability to stop token issuance

Question

I have gone through the documentation on setting up a custom authentication extension, and have built a function app and configured all the parts for making a call into my function app endpoint for the On Token Issuance Start event.

Everything works correctly, but I want to be able to decide whether a token shall be created and issued to the calling client or not.

How can I prevent Entra from creating an ID-Token?

Answer 1

Hi @Jens Thirmeyer ,

Thanks for reaching out.

To prevent Entra from creating an ID-Token, you can add a custom claim to the token that is not recognized by Entra. This will cause Entra to reject the token and not issue an ID-Token.

Reference - https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-tokenissuancestart-configuration?tabs=azure-portal%2Cworkforce-tenant#step-3-assign-a-custom-claims-provider-to-your-app

Hope this will help.

Thanks,

Shweta

Please "Accept the answer" if above answer helps you.

Answer 2

I've tried it and added a claim unknown to Entra. It just ignored it and used the known claims to put them into the token.

Basically, I'd like to go with a dedicated event or status code, like it was with Azure Active Directoy B2C. The REST API back in the days sent a 409 status code which clearly indicates a problem and was not causing an error in order to break the process chain. Furthermore, in ADB2C, I was able to define the behavior via a custom policy.

What I want to achieve is that the REST API can decide, whether the login process continues or stops for a certain reason.

Many thanks for further support.