0

When I request an OAuth token from Azure AD for an application user (using a client_id and client_secret) targeting the correct resource audience (target application), I don't know how to get Azure AD to populate a claim for the client's DisplayName attribute (primarily for an application client, but also users should work too) in Azure AD.

POST /<tenant_id>/oauth2/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=<client_id>&resource=<target_aud_app_uri>&client_secret=<client_secret>

{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "xxx",
  "kid": "xxx"
}.{
  "aud": "<target_aud_app_uri>",
  "iss": "https://sts.windows.net/<tenant_id>/",
  "iat": 1619676176,
  "nbf": 1619676176,
  "exp": 1619680076,
  "aio": "xxx",
  "appid": "<client_id>",
  "appidacr": "1",
  "idp": "https://sts.windows.net/<tenant_id>/",
  "idtyp": "app",
  "oid": "xxx",
  "rh": "xxx",
  "roles": [
    "XXX"
  ],
  "sid": "xxx",
  "sub": "xxx",
  "tenant_ctry": "AU",
  "tenant_region_scope": "OC",
  "tid": "xxx",
  "uti": "xxx",
  "ver": "1.0"
}.[Signature]

In the target application configuration in Azure AD, I've added all the optional claims it allows in the UI, and even tried adding 'display_name' via the manifest but it doesn't know how to pick it up. Is there a way to do this?

Azure Portal Azure AD Application Token configuration screenshot

Adam Coulter
  • 28
  • 6
  • This is possible under the `Microosft.graph` namespace only cannot be used for any custom app. – Carl Zhao Apr 29 '21 at 06:36
  • If my answer is helpful to you, you can [accept](https://meta.stackexchange.com/questions/5234/how-does-accepting-an-answer-work) it to end the thread, thanks！ – Carl Zhao Apr 30 '21 at 01:52

1 Answers1

1

This question has been asked before.

This is possible under the Microosft.graph namespace only cannot be used for any custom app. In other words, only the ms graph api token has app_displayname claim. For the token of the application custom api, it is currently not possible to add the app_displayname claim, at least for now this is impossible.

I suggest you submit user voice, and I will vote for it.

Carl Zhao
  • 8,543
  • 2
  • 11
  • 19
  • 1
    I have created a UserVoice for this: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/43337229-optionally-populate-all-azure-ad-attributes-in-oau – Adam Coulter May 03 '21 at 03:47