1

We have configured an App Registration for the SPA in Azure, for Auth Code flow.

We have added email under optional claims as per below: enter image description here

The manifest file is configured as below:

{
    "id": "<redacted>",
    "acceptMappedClaims": true,
    "accessTokenAcceptedVersion": 1,
    "addIns": [],
    "allowPublicClient": null,
    "appId": "<redacted>",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": false,
    "createdDateTime": "2020-12-03T10:30:07Z",
    "disabledByMicrosoftStatus": null,
    "groupMembershipClaims": "None",
    "identifierUris": [],
    "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": null,
    "logoutUrl": null,
    "name": "<redacted>",
    "oauth2AllowIdTokenImplicitFlow": false,
    "oauth2AllowImplicitFlow": false,
    "oauth2Permissions": [],
    "oauth2RequirePostResponse": false,
    "optionalClaims": {
        "idToken": [],
        "accessToken": [
            {
                "name": "email",
                "source": null,
                "essential": false,
                "additionalProperties": []
            }
        ],
        "saml2Token": []
    },
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "preAuthorizedApplications": [],
    "publisherDomain": "<redacted>",
    "replyUrlsWithType": [
        {
            "url": "https://localhost:44338",
            "type": "Spa"
        }
    ],
    "requiredResourceAccess": [
        {
            "resourceAppId": "<redacted>",
            "resourceAccess": [
                {
                    "id": "<redacted>",
                    "type": "Scope"
                },
                {
                    "id": "<redacted>",
                    "type": "Scope"
                },
                {
                    "id": "<redacted>",
                    "type": "Scope"
                }
            ]
        },
        {
            "resourceAppId": "<redacted>",
            "resourceAccess": [
                {
                    "id": "<redacted>",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": null,
    "signInAudience": "AzureADMyOrg",
    "tags": [],
    "tokenEncryptionKeyId": null
}

We have added the email to the permissions: enter image description here

And finally on the client side I use MSAL browser to initiate authentication with the following scopes supplied:

enter image description here

However, I can't for the life of me figure out why the email claim is not appearing in the access_token

k29
  • 641
  • 6
  • 26
  • Have you verified the id_token..? Can you please confirm if the email claim is missing in both access token and id_token or only with Access token – Raghavendra beldona Dec 03 '20 at 15:16
  • @Raghavendra-MSFTIdentity It does appear in the id_token. Only the access_token is the issue – k29 Dec 03 '20 at 15:18

1 Answers1

3

Please see v1.0 and v2.0 optional claims set.

When adding claims to the access token, the claims apply to access tokens requested for the application (a web API), not claims requested by the application.

It means that you email claim apply to the scene that you call your own web API, not call Microsoft Graph API.

You can see details from Protected web API: App registration.

You should configure the email optional claim in the Azure AD app which represents the web API, not the Azure AD app which represents the client end. Then when you request the access token for that API, the email claim will exist in the access token.

Set scope=api://{app id of the AAD app which represents the web api}/.default openid instead of scope=http://graph.microsoft.com/.default openid in the request.

So for calling Microsoft Graph API, you cannot use the built-in email optional claim directly. You need to query the email by calling Microsoft Graph GET https://graph.microsoft.com/v1.0/me/ or use another claim upn in access token.

Allen Wu
  • 15,529
  • 1
  • 9
  • 20
  • 1
    This was correct. All I needed to do to fix the problem was remove the claim and permission from the SPA client app registration and add the email claim to the API app registration, as well as add the email graphapi permission to that registration – k29 Dec 07 '20 at 07:03