1

I have followed the Set up sign-up and sign-in with an Azure AD B2C account from another Azure AD B2C tenant article using the user flow policy type.

Everything works as expected until I try to customise the identity provider claims mapping in the Configure Azure AD B2C as an identity provider section.

I am attempting to map a custom user attribute to the User ID claim, the mapping works if I map it to a different claim e.g. Given Name.

For example, I have a custom user attribute named Clock Number in the Fabrikam B2C tenant, when I run the sign in/up user flow the sub claim is the ObjectID of the user and I can see the custom attribute in the token.

Custom claim appears in token

In the Contoso B2C tenant, I map extension_ClockNumber to Given Name and run the sign in/up user flow the clock number is correctly mapped to given_name however I am not sure what value is mapped to the sub claim – it is not the ObjectID of the user as it was in the previous example.

Wrong sub claim

When I map extension_ClockNumber to User ID and run the user flow it is not mapping as it did to Given Name, I would have expected the value of extension_ClockNumber to appear in the sub claim.

enter image description here

Newm
  • 1,313
  • 3
  • 16
  • 29

1 Answers1

0

For anybody that sees this in the future I am no longer attempting to map the custom attribute.

When signing in from one Azure AD B2C account from another Azure AD B2C account the "sub" claim contains the users object id from the root e.g. Contoso.

This means that I have to look for a federated identity to retrieve the IssuerAssignedId which will be the object id of the user in the other tenant e.g. Fabrikam. This can be achieved via:

GET https://graph.microsoft.com/v1.0/users?$select=id,displayName,identities&$filter=id eq '6fa2f184-e0cb-456d-9686-fffb2ef71441'

This article says about the oid payload cliam:

If a single user exists in multiple tenants, the user will contain a different object ID in each tenant - they are considered different accounts, even though the user logs into each account with the same credentials.

Newm
  • 1,313
  • 3
  • 16
  • 29