Azure B2C SAML metadata is showing incorrect attribute names

Darren Mason 21 Reputation points
2022-03-10T23:36:25.67+00:00

Can someone confirm if I'm missing something or is this a bug in B2C?

My Replying Party with SAML2 protocol lists OutputClaims with PartnerClaimType.

<RelyingParty>
        <DefaultUserJourney ReferenceId="SignInSuper"/>
        <TechnicalProfile Id="PolicyProfile">
            <DisplayName>PolicyProfile</DisplayName>
            <Protocol Name="SAML2"/>
            <OutputClaims>
                <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="firstName"/>
                <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lastName"/>

The actual SAML assertion includes said attributes with the expected name.

<saml:AttributeStatement xmlns:xs="http://www.w3.org/2001/XMLSchema">
         <saml:Attribute Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Given Name">
            <saml:AttributeValue xsi:type="xs:string">John</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute Name="lastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Surname">
            <saml:AttributeValue xsi:type="xs:string">Smith</saml:AttributeValue>
         </saml:Attribute>

However the SAML metdata file, located at https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/Samlp/metadata, lists the wrong attribute names. It displays the internal claim names instead of the PartnerClaimType values.

<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Name="givenName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Given Name"/>
<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Name="surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="Surname"/>

What's the story here? I'd log a bug if I knew where to do it.

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.