unable to get given_name and family_name from azure v2 token endpoint

0
votes

In the manifest of my application registration I've configured to retrieve the given_name and family_name claims (through the UI, the resulting manifest looks like this):

        "idToken": [
            {
                "name": "family_name",
                "source": "user",
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "given_name",
                "source": "user",
                "essential": false,
                "additionalProperties": []
            }
        ],

During the redirect I add the profile scope along with the given_name and family_name scopes, which results in the following error.

Message contains error: 'invalid_client', error_description: 'AADSTS650053: The application 'REDACTED' asked for scope 'given_name' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor.

Any ideas? As I understand that is what is required to configure these optional claims on the v2.0 endpoint as described here: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims#v20-specific-optional-claims-set

2
oauth-2.0azure-active-directory

2 Answers

0
votes

Once you configure optional claims for your application through the UI or application manifest. you need to provide profile Delegated permissions for the application.

enter image description hereenter image description here

1
votes

You should only use the profile 'scope', which should result in you receiving the given_name and family_name 'claims'. That's standard behaviour for an Authorization Server, which will then either:

  • Return the name details directly in the id token
  • Or allow you to send an access token to the user info endpoint to get the name details

However, Azure v2 is very Microsoft specific, and user info lookup can be painful and involve sending a separate type of token to the Graph user info endpoint. Hopefully you won't have to deal with that and you will get the name details directly in the id token.

I had a scenario where my API (which only received an access token) needed to get user info, and I solved it via steps 14 - 18 of this write up, but it's a convoluted solution.