Azure Active Directory B2C SAML Integration

Question

I'm following the official MS guide Set up sign-in with a Salesforce SAML provider by using custom policies in Azure Active Directory B2C. I have completed all the configuration but when I try to run the application I receive a strange error which states Claim with id "userId" already exists in the claims collection. I was searching for userId in my custom policies:

TrustFrameworkBase.xml: in this file userid is NOT declared, a claim called issuerUserId is declared in ClaimsSchema as datatype string and it is used in the following claim transformation:

<ClaimsTransformation Id="CreateAlternativeSecurityId" TransformationMethod="CreateAlternativeSecurityId">
        <InputClaims>
          <InputClaim ClaimTypeReferenceId="issuerUserId" TransformationClaimType="key" />
          <InputClaim ClaimTypeReferenceId="identityProvider" TransformationClaimType="identityProvider" />
        </InputClaims>
        <OutputClaims>
          <OutputClaim ClaimTypeReferenceId="alternativeSecurityId" TransformationClaimType="alternativeSecurityId" />
        </OutputClaims>
      </ClaimsTransformation>

issuerUserId is then used in Facebook claim provider:

<ClaimsProvider>
    <Domain>facebook.com</Domain>
    <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="id" />
...
    </OutputClaims>
...
</ClaimsProvider>

TrustFrameworkExtension.xml: the claim userid is the output claim of the claim provider I'm using (salesforce):

<ClaimsProvider>
      <Domain>salesforce</Domain>
...
      <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="userid"/>
      </OutputClaims>
...
</ClaimsProvider>

SignUpOrSigninSalesforce.xml: the claim userid is the output claim of the relying party I'm using (salesforce):

<RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpSignInSalesforce" />
    <TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="issuerUserId" />
        ...
      </OutputClaims>
    </TechnicalProfile>
</RelyingParty>

Based on the error claim userid is defined twice, but I don't find a double definition, do you have any clue?

Thanks.

did you see your SAML assertion and there may be multiple claims with same attribute name. — Ramakrishna

Michele Michele · Accepted Answer · 2020-01-15T18:14:02

After 3 days of exhausting troubleshooting I have found five minutes ago the error. In my case I did not follow exactly microsoft steps, I wrongly changed SignUpSignInSalesforce UserJourney in the orchestration step 3 in TrustFrameworkExtensions.xml:

<UserJourney Id="SignUpSignInSalesforce">
....
    <OrchestrationStep Order="3" Type="ClaimsExchange">
              <ClaimsExchanges>
                <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="salesfoce" />
              </ClaimsExchanges>
            </OrchestrationStep>
...
</UserJourney>

The wrong value is TechnicalProfileReferenceId. When I changed the value from salesforce to AAD-UserReadUsingAlternativeSecurityId-NoError the solution started working. What I have done it was re-reading the documentation of Microsoft step by step looking for mistakes.

Azure Active Directory B2C SAML Integration

1 Answers