How to get group/role claim in ID token from Azure B2C?

Shubham Singh 1 Reputation point
2021-04-13T11:19:04.937+00:00

I followed these steps to get a custom claim in ID token with name 'extension_6de6a54XXXXX4560b9d65731ce869be4_Role'. But, my expected output is 'groups' claim or 'role' claim information.

I tried customMappingPolicies to map this ID token claim 'extension_6de6a54XXXXX4560b9d65731ce869be4_Role' with the 'groups' claim. But, following this documentation steps does not seem to affect the issued ID token from B2C.

When I found this answer that explains getting group membership using custom policies. I got stuck on the step where entering below details for microsoft graph in file TrustFrameworkExtensions.xml. I don't have answer to question like

  1. Should I enter a microsoft graph endpoint in ServiceUrl?
  2. How will AccessToken be supplied?
  3. How will JSON response be fetched and output be passed in token?

<TechnicalProfile Id="REST-RBAC">
<DisplayName>Read and validate user's groups</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<!-- Demo: Change the service URL with your REST API location -->
<Item Key="ServiceUrl">https://graph.microsoft.com/v1.0/users/{objectId}/getMemberGroups</Item>
Demo: Change the AuthenticationType to basic or ClientCertificate.
For more information, see: https://video2.skills-academy.com/en-us/azure/active-directory-b2c/active-directory-b2c-custom-rest-api-netfw-secure-cert
<Item Key="AuthenticationType">Bearer</Item>
<Item Key="SendClaimsIn">Url</Item>
</Metadata>
<InputClaims>
<InputClaim ClaimTypeReferenceId="objectId" />
<!--Demo: set the DefaultValue to empty string or comma delimiter list
of security groups to validate-->
<!-- <InputClaim ClaimTypeReferenceId="onlyMembersOf" DefaultValue="admins" /> -->
</InputClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="groups" />
</OutputClaims>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

NOTE: I don't want my application to handle https request just for one piece of information that I can get in token.

Thanks In Advance.

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
808 questions
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,874 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,700 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.