Azure B2C SAML metadata is showing incorrect attribute names
Darren Mason
21
Reputation points
Can someone confirm if I'm missing something or is this a bug in B2C?
My Replying Party with SAML2 protocol lists OutputClaims with PartnerClaimType.
<RelyingParty>
<DefaultUserJourney ReferenceId="SignInSuper"/>
<TechnicalProfile Id="PolicyProfile">
<DisplayName>PolicyProfile</DisplayName>
<Protocol Name="SAML2"/>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName"/>
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName"/>
The actual SAML assertion includes said attributes with the expected name.
<saml:AttributeStatement xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml:Attribute Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Given Name">
<saml:AttributeValue xsi:type="xs:string">John</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="lastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Surname">
<saml:AttributeValue xsi:type="xs:string">Smith</saml:AttributeValue>
</saml:Attribute>
However the SAML metdata file, located at https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/Samlp/metadata, lists the wrong attribute names. It displays the internal claim names instead of the PartnerClaimType values.
<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Name="givenName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Given Name"/>
<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Name="surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Surname"/>
What's the story here? I'd log a bug if I knew where to do it.
Microsoft Security | Microsoft Entra | Microsoft Entra External ID
3,289 questions
Microsoft Security | Microsoft Entra | Microsoft Entra ID
25,180 questions
Sign in to answer