Azure B2C SAML Custom Policy Assert Email

Question

I have setup Azure B2C as IDP via SAML successfully and I am getting back the assertion for givenName, objectId, surname, userPrincipalName correctly.

When a user goes through sign-up process say with a email address [email protected], a upn is auto-generated in B2C in the format [email protected].

I would like to get the actual sign-in email address, in this case [email protected] in SAML Assertion.

I have tried all the below options but the SAML Assertion doesn't have the email address.

<OutputClaim ClaimTypeReferenceId="givenName" />
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
<OutputClaim ClaimTypeReferenceId="surname" />
<OutputClaim ClaimTypeReferenceId="email"/>
<OutputClaim ClaimTypeReferenceId="signInNames.emailAddress"/>
<OutputClaim ClaimTypeReferenceId="otherMails"/>

Changed after Chris Padgett's response. but still no email.

<ClaimType Id="email">
 <DisplayName>Email Address</DisplayName>
 <DataType>string</DataType>
 <DefaultPartnerClaimTypes>
   <Protocol Name="OAuth2" PartnerClaimType="email" />
   <Protocol Name="OpenIdConnect" PartnerClaimType="email" />
   <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email" />
  </DefaultPartnerClaimTypes>


<TechnicalProfile Id="AAD-UserReadUsingObjectId">
 ...
 <OutputClaims>
 <OutputClaim ClaimTypeReferenceId="displayName" />
 <OutputClaim ClaimTypeReferenceId="otherMails" />
 <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
 <OutputClaim ClaimTypeReferenceId="givenName" />
 <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
 <OutputClaim ClaimTypeReferenceId="surname" />


<UserJourney Id="SignInSaml">
    <OrchestrationSteps>
    <OrchestrationStep Order="1" Type="ClaimsExchange">
        <ClaimsExchanges>
        <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
        </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="2" Type="ClaimsExchange">
        <Preconditions>
        <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
            <Value>authenticationSource</Value>
            <Value>socialIdpAuthentication</Value>
            <Action>SkipThisOrchestrationStep</Action>
        </Precondition>
        </Preconditions>
        <ClaimsExchanges>
        <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
        </ClaimsExchanges>
    </OrchestrationStep>
    <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer" />
    </OrchestrationSteps>
    <ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>


<RelyingParty>
<DefaultUserJourney ReferenceId="SignInSaml" />
<UserJourneyBehaviors>
    <JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="key" DeveloperMode="true" ClientEnabled="true" ServerEnabled="true" TelemetryVersion="1.0.0" />
</UserJourneyBehaviors>
<TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="SAML2" />
    <SubjectAuthenticationRequirements TimeToLive="40000" ResetExpiryWhenTokenIssued="false" />
    <Metadata>
    <Item Key="PartnerEntity"><![CDATA[<md:EntityDescriptor 
        xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2026-12-27T23:42:22.079Z" entityID="someentityid" 
        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sptest.iamshowcase.com/acs" index="0" isDefault="true"/></md:SPSSODescriptor></md:EntityDescriptor>]]></Item>
    </Metadata>
    <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
    <OutputClaim ClaimTypeReferenceId="surname" />
    <OutputClaim ClaimTypeReferenceId="email" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
</TechnicalProfile>
</RelyingParty>

Chris Padgett Chris Padgett · Accepted Answer · 2018-08-07T08:36:23

1) Ensure the email claim is declared with a claim type for the SAML2 protocol:

<ClaimType Id="email">
  <DisplayName>Email Address</DisplayName>
  <DataType>string</DataType>
  <DefaultPartnerClaimTypes>
    <Protocol Name="OAuth2" PartnerClaimType="email" />
    <Protocol Name="OpenIdConnect" PartnerClaimType="email" />
    <Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email" />
  </DefaultPartnerClaimTypes>
  ...
</ClaimType>

2) Ensure the email claim is read as an output claim by the AAD-UserReadUsingObjectId technical profile:

<TechnicalProfile Id="AAD-UserReadUsingObjectId">
  ...
  <OutputClaims>
    ...
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
  </OutputClaims>
  ...
</TechnicalProfile>

Azure B2C SAML Custom Policy Assert Email

1 Answers