login_hint as optional claim

testuser7 271 Reputation points
2022-06-28T12:27:34.4+00:00

Hello,

I have simple but annoying question.

I want couple of extra claims in the JWT token that is created by AAD for the app.
I have added two "optional claims" in the registered app in my tenant through portal.
Those are ctry and login_hint

ctry is properly coming in the id-token but login_hint is not at all part of the token.
As per doc, both claims are allowed for both versions of id-token. So no confusion about it.
I see both claims properly added in the manifest of the app.
Any idea why login_hint is not added in the token when I hit following

https://login.microsoftonline.com/

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,392 questions
0 comments No comments
{count} votes

5 answers

Sort by: Most helpful
  1. testuser7 271 Reputation points
    2022-06-30T12:36:20.797+00:00

    hello

    Any update from MSFT around above query is appreciated.

    Thanks.

    0 comments No comments

  2. James Hamil 21,546 Reputation points Microsoft Employee
    2022-06-30T21:23:14.457+00:00

    Hi @testuser7 , sorry for the delay in response. Have you had the chance to review this thread?

    "You need to configure the optional claims on the access token for the API, not the ID token."

    Please let me know if this works for you. If not I can help you further!

    If this answer helped you please mark it as "Verified" so other users can reference it.

    Thank you,
    James


  3. testuser7 271 Reputation points
    2022-07-06T13:00:59.837+00:00

    Agree with @Mark Kaplan

    Besides, @James Hamil if you check my request URL, you will notice that I am not asking any scope that leads to access-token. It is just simple ID-TOKEN

    https://login.microsoftonline.com/<tenand-id>/oauth2/v2.0/authorize?client_id=80e41c80-2d17-42c7-a172-059ca30afe9f
    &response_type=id_token&scope=openid&rhedirect_uri=https://jwt.ms&nonce=27927924

    Really unusual and interesting use-case.

    Thanks.

    0 comments No comments

  4. testuser7 271 Reputation points
    2022-07-09T13:17:55.853+00:00

    Hi @James Hamil How is it looking ? Interesting. Isn't it ??
    I am wondering how did I miss this last so many years working on AAD

    Logically login-hint was always something that should come from the app.
    The only usecase where AAD packs it in token is when 2 apps wants to do SSO seamlessly.
    It can be passed between applications to help them silently SSO as well

    0 comments No comments

  5. Scott, Steven 0 Reputation points
    2024-04-08T16:35:29.71+00:00

    I am trying to use login_hint for promptless logout described here But the dev team says the optional claim is coming across as undefined.

    Using Terraform provider below against the azure ad application defined in the module here is how I am configuring the login_hint. Should it be assigned to the access token?

    azuread_application_optional_claims
    
    id_token {
        name      = "login_hint"
        source    = "user"
        essential = false
      }
    
    0 comments No comments