Azure B2C UserIsNew attribute is missing when logged in with external identity providers

user_2896495 0
Viewed 753

I use UserIsNew attribute for my Azure B2C user flow. Users log in with Angular app and I get this attribute/claim on the front-end. Also, I get an access token which is used as a bearer to access ASP.NET Core 3.1 web API.

And here's the problem - the access token works (contains the UserIsNew claim) when the user is Local (Email signup). But when it's an external user (Microsoft account in my case) I get the claim in the Angular app only. The access token does not have the custom attribute, thus web API returns access denied!

What am I missing?

UPDATE

These are the claims I'm getting in the angular app:

angular b2c claims

And these are from server side (web API):

"claims": [
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "type": "exp",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "type": "nbf",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "type": "aud",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "idp"
        },
        "type": "http://schemas.microsoft.com/identity/claims/identityprovider",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "type": "name",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "oid"
        },
        "type": "http://schemas.microsoft.com/identity/claims/objectidentifier",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "sub"
        },
        "type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "given_name"
        },
        "type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "family_name"
        },
        "type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {},
        "type": "emails",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {},
        "type": "tfp",
        "value": "B2C_1_susi",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {},
        "type": "nonce",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "scp"
        },
        "type": "http://schemas.microsoft.com/identity/claims/scope",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {},
        "type": "azp",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {},
        "type": "ver",
    },
    {
        "issuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "originalIssuer": "https://[mytenant].b2clogin.com/[guid]/v2.0/",
        "properties": {},
        "type": "iat",
    }
],

newUser is missing.

UPDATE 1

These are used flow User Attributes set up:

enter image description here

And this is App Claims set up:

enter image description here

Also, keep in mind - I'm testing the scenario when the user signs up, so UserIsNew is expected every time.

msal azure-ad-b2c azure-active-directory asp.net-core
1 Answers

The reason why (Display Name, Email Address, Job Title, PhoneNumber, Postal Code) claims were not returned in the token was because the user was added as an external (guest) user. The user didn't go through the signup process and the value for these attributes were not collected. The attributes with no value are not returned in the token.

Once we signed-up with a new user account and provided values to these attributes, we were able to get the claims in the token. For existing users, if these attributes are not captured, you can use profile editing policy to populate values for these attributes.

In order to get these claims, you need to navigate to your User Flow and select below:

User attributes: Display Name, Email Address, Job Title, PhoneNumber(custom), Postal Code.

Application claims: Display Name, Email Address, Job Title, PhoneNumber(custom), Postal Code, Identity Provider Access Token, User is new, User's Object ID.

Note:

  1. idp_access_token will only be returned if you signup/signin using a Social IDP.
  2. newUser claim is returned at signup only.
  3. In case of built-in policy, you can get either acr or tfp claim. Both these claims have policy name as value. To choose which claim should be returned in the token, you need to go to the properties blade of the user flow > Token compatibility settings > Claim representing user flow > use toggle button to either select tfp or acr.
user_133234600
Related