For Azure B2C, is there a way to send the user principal name via claims?

user_16894838 0
Viewed 923

I'm having some issues with getting the currently signed-in user's username from Azure b2c to my Blazor web app. Essentially, I want to make a username account where a username is the User Principal Name. I was originally using an email sign-up policy with a display name as the username. However, b2c doesn't enforce display names to be unique, so there's an inherent issue with that. No claim comes back with a username in it, so I have no way in my Blazor app to keep tabs on who is signed in or display their username. There are a few options I can do, and I'm curious which one is the easiest to implement/how to implement it, cause I've been ripping my hair out with this the past few hours.

  • On b2c account creation, take User Principal Name and also make it the display name
  • Have the user principal name be sent via claims (Not sure how to do this)
  • Do Email sign up with Display Names, but somehow enforce b2c to ensure display names are unique
  • Some other way to have a unique display name for users from b2c

Thanks in advance!

azure-ad-b2c blazor azure c#
2 Answers

You need to use custom policies: https://aka.ms/ief. Username is not returned in the token with User Flows.

Using custom policies, you can sign up the user using username, and return their username (signInNames.username attribute, shown as userPrincipalName in the Azure Portal) into the token.

You can quick deploy custom policies using my tool here. And quick deploy the username sample using this page with the sample folder name username-signup-or-signin.

user_83573570

If you need any additional claim you need to enter in your Azure AD BC tenant and configure the Application Claims from your User Flow, in the following example the User flow is called B2C_1_signupsignin:

Application Claims

The above example, as you can see, lists all the other available claims, because dome claims are always returned, as the User Name.

You can configure the claim (mode) used to login in the Identity Provider:
Identity Provider config

Than the claims you receive are the following:

Claims list

But as you can see there isn't any userPrincipalName or signinNames.
This is a known issue in Azure AD B2C and including this claims from the user flow manifest doesn't work.
The only solution I've found is to upload your custom policy and add a:
<OutputClaim ClaimTypeReferenceId = "signInName" />

but this works only for local accounts.
If you want to add signin names also for external (social) accounts you need to map them, like:
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="upn" />

look at the base source XML here:
https://github.com/azure-ad-b2c/samples/tree/master/policies/sign-up-with-social-and-local-account

user_111099670
Related