We implemented openid connect authentication in a web application. A customer uses Azure AD as the identity provider, we need to get the "sub"(subject) claim value in the ID Token that is being sent to our web application from Azure AD for mapping with web application user. May I know where could we find this "sub" claim value for user on Azure AD portal? Please advice, thanks.
On Azure AD portal, where to find "sub" claim value for user that is included in ID Token for authentication
Viewed 1051
1 Answers
I don't think you can find it. The sub claim contains a unique, immutable identifier for the user for that one app. Its value is different in other apps for the same user. So it is possibly computed based on some other identifiers but I am not sure. But I have never seen it in any API responses or pages in the portal.
If you want to a unique, immutable id that you can look up in the portal, you need to use the oid claim. This claim contains the objectId for the user, which you can see in the portal when looking at the user details. It is also the user's id in the Graph API if you need to look them up.
The sub claim works for identifying a user uniquely in an app, but if you need to link them to the user in Azure AD, you should use the oid claim.
More info in the docs: https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#payload-claims
Related