login_hint as optional claim

testuser7 206 Reputation points
2022-06-28T12:27:34.4+00:00

Hello,

I have simple but annoying question.

I want couple of extra claims in the JWT token that is created by AAD for the app.
I have added two "optional claims" in the registered app in my tenant through portal.
Those are ctry and login_hint

ctry is properly coming in the id-token but login_hint is not at all part of the token.
As per doc, both claims are allowed for both versions of id-token. So no confusion about it.
I see both claims properly added in the manifest of the app.
Any idea why login_hint is not added in the token when I hit following

https://login.microsoftonline.com/

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
13,466 questions

4 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. testuser7 206 Reputation points
    2022-06-30T12:36:20.797+00:00

    hello

    Any update from MSFT around above query is appreciated.

    Thanks.

  2. James Hamil 12,901 Reputation points Microsoft Employee
    2022-06-30T21:23:14.457+00:00

    Hi @testuser7 , sorry for the delay in response. Have you had the chance to review this thread?

    "You need to configure the optional claims on the access token for the API, not the ID token."

    Please let me know if this works for you. If not I can help you further!

    If this answer helped you please mark it as "Verified" so other users can reference it.

    Thank you,
    James

  3. testuser7 206 Reputation points
    2022-07-06T13:00:59.837+00:00

    Agree with @Mark Kaplan

    Besides, @James Hamil if you check my request URL, you will notice that I am not asking any scope that leads to access-token. It is just simple ID-TOKEN

    https://login.microsoftonline.com/<tenand-id>/oauth2/v2.0/authorize?client_id=80e41c80-2d17-42c7-a172-059ca30afe9f
    &response_type=id_token&scope=openid&rhedirect_uri=https://jwt.ms&nonce=27927924

    Really unusual and interesting use-case.

    Thanks.

  4. testuser7 206 Reputation points
    2022-07-09T13:17:55.853+00:00

    Hi @James Hamil How is it looking ? Interesting. Isn't it ??
    I am wondering how did I miss this last so many years working on AAD

    Logically login-hint was always something that should come from the app.
    The only usecase where AAD packs it in token is when 2 apps wants to do SSO seamlessly.
    It can be passed between applications to help them silently SSO as well