B2C Custom Policy Claims "emails" and "email"

Question

Dear Team

I have created a B2C tenant to facilitate our customers accessing our Dynamics 365 portal. This works well if I use user flows for local users, google, facebook, etc.

However, unfortunately, I have to use custom policies for enabling Azure AD multi-tenant with B2C. I have created custom policies for both Azure AD and google tenant following guides provided here.

The flow is working good i.e. if I click run endpoint now link of the custom flow on an existing browser session [logged in with Azure AD credential or google credential], user journeys are working as they should. I can register an account with B2C, change password etc.

However, the claims in the token [issued by B2C] does not map to the attribute that Dynamics 365 expects to match the B2C user to contacts in portal app[Dynamics 365].

In order to test if this is something to do with claims in the token, I have created a user flow for Google iDP and a local account [B2C]. This user flow is working fantastic i.e. mapping B2C email to contacts in the portal app [Dynamics 365]. So I thought this could be an issue with claims in the token.

I have published tokens from the google Idp [userflow and custom policy], here for your reference. The only difference between this token that may correspond to the user mapping [in my opinion] is between claims "emails" [userflow] and "email"[custom policy] apart from "tfp" and "acr"

Could you tell me how to change email claim in user policy to emails?
Also, In order to make custom policies work with Dynamcis 365 portal apps, do I have to change from "acr" to "tfp"

Answer 1

I figured it out. Though it didn't resolve my original issue, I managed to add "emails" collection token to the custom policy

To add "emails" collection claim to a token, I did the following to the custom policy

Added this to Claim Providers --> Technical Profiles -->Output Claims [on TrustFrameworkExtenstion.xml]

<OutputClaim ClaimTypeReferenceId="othermails" />

and then in SignUporSignin Policy, added below

<OutputClaim ClaimTypeReferenceId="otherMails" PartnerClaimType="emails" />

Regards

Answer 2

Depending upon what TrustFrameworkBase.xml file you started from (since they vary by sample), and depending upon whether you just want the email that the user is using to log-in vs. all their email addresses, another option can be to add the following to the RelyingParty section of the user journey:

<OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email"/>

What claims are available to you reference depends on what OutputClaims are defined in the AAD-UserReadUsingEmailAddress technical profile of TrustFrameworkBase.xml.

Answer 3

This doesn't work, can any one explain full steps with custom policy.