Azure AD B2C Add Claims to id_token in custom policy

Question

I have created custom policies for social and local accounts based on the example from the Active Directory B2C custom policy starter pack for social and local accounts. I have enabled the login with Microsoft and Google and tested that both work, I have also enabled logging in with a local account.

When I log in with google I get the following claims

exp,nbf,ver,iss,sub,aud,acr,nonce,iat,auth_time,email,given_name,family_name,name,idp,at_hash

When I log into a custom Azure AD tenant the set of claims is missing 'email', but the email is listed in the 'name' claim

exp,nbf,ver,iss,sub,aud,acr,nonce,iat,auth_time,given_name,family_name, name,idp,at_hash

When I log in as a local account the set of claims is missing 'email' and there is no email listed in any of the fields.

exp,nbf,ver,iss,sub,aud,acr,nonce,iat,auth_time,given_name, family_name,name,at_hash

Finally, when I look at the list of users in the B2C admin, these are all different user entries...even though the email address is the same. So I have 2 questions,

1. How do I get a consistent set of claims in the id_token
2. How do I link all these accounts together at registration time (Same UPN)

I believe these may be related, which is why I am asking them together. You probably want to see the policies, but I assure you they are exactly the same as the policies in the starter pack, all I've done is change the tenant names and added google and azure in the trust framework extensions file.

Answer 1

For the Azure AD email claim, add the following <OutputClaim /> to the Azure AD OpenID Connect technical profile:

<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="unique_name" />

For the local account email claim, add the following <OutputClaim /> to the AAD-UserReadUsingObjectId technical profile:

<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />