Calling secure REST API from Azure B2C custom policy to embed claims

Viewed 531

I am trying to consume a Azure B2C secured API as part of the user journey by creating custom policies. I have created a claims provider to procure a bearer token as below

<ClaimsProvider>
            <DisplayName>REST APIs</DisplayName>
            <TechnicalProfiles>
                <TechnicalProfile Id="SecureREST-AccessToken">
                    <DisplayName></DisplayName>
                    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
                    <Metadata>
                        <Item Key="ServiceUrl">https://***.b2clogin.com/***.onmicrosoft.com/B2C_1A_SignUpOrSignIn/oauth2/v2.0/authorize</Item>
                        <Item Key="AuthenticationType">Basic</Item>
                        <Item Key="SendClaimsIn">Form</Item>
                    </Metadata>
                    <CryptographicKeys>
                        <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_SecureRESTClientId" />
                        <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_SecureRESTClientSecret" />
                    </CryptographicKeys>
                    <InputClaims>
                        <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="client_credentials" />
                        <InputClaim ClaimTypeReferenceId="scope" DefaultValue="https://***.onmicrosoft.com/profileapi/profileapi-scope" />
                    </InputClaims>
                    <OutputClaims>
                        <OutputClaim ClaimTypeReferenceId="bearerToken" PartnerClaimType="access_token" />
                    </OutputClaims>
                    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
                </TechnicalProfile>
            </TechnicalProfiles>
        </ClaimsProvider>

And another claims provider to call my secure REST API as below

 <ClaimsProvider>
            <DisplayName>REST APIs</DisplayName>
            <TechnicalProfiles>
                <TechnicalProfile Id="AzureFunctions-GetRole">
                    <DisplayName>Get Roles </DisplayName>
                    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
                    <Metadata>
                        <Item Key="ServiceUrl">https://***.azurewebsites.net/api/UserProfiles/CheckAdminUser</Item>
                        <Item Key="AuthenticationType">Bearer</Item>
                        <Item Key="SendClaimsIn">Body</Item>
                        <Item Key="AllowInsecureAuthInProduction">false</Item>
                    </Metadata>


                    <InputClaims>
                        <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
                        <InputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email" />
                        <InputClaim ClaimTypeReferenceId="bearerToken"/>
                    </InputClaims>
                    <OutputClaims>
                        <OutputClaim ClaimTypeReferenceId="IsAdminUser" PartnerClaimType="IsAdminUser" />
                    </OutputClaims>
                    
                    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
                </TechnicalProfile>
            </TechnicalProfiles>
        </ClaimsProvider>

How do I tie these two up? Should these be two steps in the user journey?

1 Answers
Related