Pass an identity provider access token to your application in Azure Active Directory B2C

Azure AD B2C supports passing the access token of OAuth 2.0 identity providers. For all other identity providers, the claim is returned blank.

Azure AD B2C supports passing the access token of OAuth 2.0 and OpenID Connect identity providers. For all other identity providers, the claim is returned blank. For more details, check out the identity providers federation Live demo.

• Create a user flow so users can sign up and sign in to your application.
• Register a web application.

• Complete the steps in Get started with custom policies in Active Directory B2C. This tutorial guides you how to update custom policy files to use your Azure AD B2C tenant configuration.
• Register a web application.

Enable the claim

1. Sign in to the Azure portal as the External ID User Flow Administrator of your Azure AD B2C tenant.

2. If you have access to multiple tenants, select the Settings icon in the top menu to switch to your Azure AD B2C tenant from the Directories + subscriptions menu.

3. Choose All services in the top-left corner of the Azure portal, search for and select Azure AD B2C.

4. Select User flows (policies), and then select your user flow. For example, B2C_1_signupsignin1.

5. Select Application claims.

6. Enable the Identity Provider Access Token claim.

   

7. Click Save to save the user flow.

Test the user flow

When testing your applications in Azure AD B2C, it can be useful to have the Azure AD B2C token returned to https://jwt.ms to review the claims in it.

1. On the Overview page of the user flow, select Run user flow.

2. For Application, select your application that you previously registered. To see the token in the example below, the Reply URL should show https://jwt.ms.

3. Click Run user flow, and then sign in with your account credentials. You should see the access token of the identity provider in the idp_access_token claim.

   You should see something similar to the following example:

   

Add the claim elements

1. Open your TrustframeworkExtensions.xml file and add the following ClaimType element with an identifier of identityProviderAccessToken to the ClaimsSchema element:

   <BuildingBlocks>
     <ClaimsSchema>
       <ClaimType Id="identityProviderAccessToken">
         <DisplayName>Identity Provider Access Token</DisplayName>
         <DataType>string</DataType>
         <AdminHelpText>Stores the access token of the identity provider.</AdminHelpText>
       </ClaimType>
       ...
     </ClaimsSchema>
   </BuildingBlocks>
   

2. Add the OutputClaim element to the TechnicalProfile element for each OAuth 2.0 identity provider that you would like the access token for.

3. Save the TrustframeworkExtensions.xml file.

4. Open your relying party policy file, such as SignUpOrSignIn.xml, and add the OutputClaim element to the TechnicalProfile:

   <RelyingParty>
     <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
     <TechnicalProfile Id="PolicyProfile">
       <OutputClaims>
         <OutputClaim ClaimTypeReferenceId="identityProviderAccessToken" PartnerClaimType="idp_access_token"/>
       </OutputClaims>
       ...
     </TechnicalProfile>
   </RelyingParty>
   

5. Save the policy file.

Test your policy

When testing your applications in Azure AD B2C, it can be useful to have the Azure AD B2C token returned to https://jwt.ms to be able to review the claims in it.

Upload the files

1. Sign in to the Azure portal.
2. If you have access to multiple tenants, select the Settings icon in the top menu to switch to your Azure AD B2C tenant from the Directories + subscriptions menu.
3. Choose All services in the top-left corner of the Azure portal, and then search for and select Azure AD B2C.
4. Select Identity Experience Framework.
5. On the Custom Policies page, click Upload Policy.
6. Select Overwrite the policy if it exists, and then search for and select the TrustframeworkExtensions.xml file.
7. Select Upload.
8. Repeat steps 5 through 7 for the relying party file, such as SignUpOrSignIn.xml.

Run the policy

1. Open the policy that you changed. For example, B2C_1A_signup_signin.

2. For Application, select your application that you previously registered. To see the token in the example below, the Reply URL should show https://jwt.ms.

3. Select Run now.

   You should see something similar to the following example:

   

Pass the IDP refresh token (optional)

The access token the identity provider returns is valid for a short period of time. Some identity providers also issue a refresh token along with the access token. Your client application can then exchange the identity provider's refresh token for a new access token when needed.

Azure AD B2C custom policy supports passing the refresh token of OAuth 2.0 identity providers.

To pass the identity provider's refresh token, follow these steps:

1. Open your TrustframeworkExtensions.xml file and add the following ClaimType element with an identifier of identityProviderRefreshToken to the ClaimsSchema element.

   <ClaimType Id="identityProviderRefreshToken">
       <DisplayName>Identity provider refresh token</DisplayName>
       <DataType>string</DataType>
   </ClaimType>
   

2. Add the OutputClaim element to the TechnicalProfile element for each OAuth 2.0 identity provider that you would like the refresh token for. The following example shows the element added to the Facebook technical profile:

   <ClaimsProvider>
     <DisplayName>Facebook</DisplayName>
     <TechnicalProfiles>
       <TechnicalProfile Id="Facebook-OAUTH">
         <OutputClaims>
           <OutputClaim ClaimTypeReferenceId="identityProviderRefreshToken" PartnerClaimType="{oauth2:refresh_token}" />
         </OutputClaims>
         ...
       </TechnicalProfile>
     </TechnicalProfiles>
   </ClaimsProvider>
   

3. Some identity providers require you to include metadata or scopes to the identity provider's technical profile.

   • For Google identity provider, add two claim types access_type and prompt. Then add the following input claims to the identity provider's technical profile:

     <InputClaims>
         <InputClaim ClaimTypeReferenceId="access_type" PartnerClaimType="access_type" DefaultValue="offline" AlwaysUseDefaultValue="true" />
     
         <!-- The refresh_token is return only on the first authorization for a given user. Subsequent authorization request doesn't return the refresh_token.
             To fix this issue we add the prompt=consent query string parameter to the authorization request-->
         <InputClaim ClaimTypeReferenceId="prompt" PartnerClaimType="prompt" DefaultValue="consent" AlwaysUseDefaultValue="true" />
     </InputClaims>
     

   • Other identity providers may have different methods to issue a refresh token. Follow the identity provider's audience and add the necessary elements to your identity provider's technical profile.

4. Save the changes you made in your TrustframeworkExtensions.xml file.

5. Open your relying party policy file, such as SignUpOrSignIn.xml, and add the OutputClaim element to the TechnicalProfile:

   <RelyingParty>
     <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
     <TechnicalProfile Id="PolicyProfile">
       <OutputClaims>
         <OutputClaim ClaimTypeReferenceId="identityProviderRefreshToken" PartnerClaimType="idp_refresh_token"/>
       </OutputClaims>
       ...
     </TechnicalProfile>
   </RelyingParty>
   

6. Save the changes you made in your policy's relying party policy file.

7. Upload the TrustframeworkExtensions.xml file, and then the relying party policy file.

8. Test your policy