Lookup user by self-asserted email and redirect to user's social login provider if the user exists

Question

I'm trying to come up with a Azure AD B2C policy to lookup the user based on the email address provided in step 1.

How do I query AAD using the self asserted email address provided and then redirect the user to the social login provider they signed up with (if any)?

I have a rough draft for the Orchestration Step:

<OrchestrationStep Order="3" Type="ClaimsExchange">
    <ClaimsExchanges>
        <ClaimsExchange Id="AAD-UserReadIssuersUsingSignInName" TechnicalProfileReferenceId="AAD-UserReadIssuersUsingSignInName" />
        </ClaimsExchanges>
</OrchestrationStep>

and for the technical profile

                <TechnicalProfile Id="AAD-UserReadIssuersUsingSignInName">
                    <Metadata>
                        <Item Key="Operation">Read</Item>
                        <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">false</Item>
                        <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An account could not be found for the provided user ID.</Item>
                    </Metadata>
                    <IncludeInSso>false</IncludeInSso>
                    <InputClaims>
                        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.emailAddress" />
                    </InputClaims>
                    <OutputClaims>
                        <OutputClaim ClaimTypeReferenceId="issuers" />
                    </OutputClaims>
                    <OutputClaimsTransformations>
                        <OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
                    </OutputClaimsTransformations>
                    <IncludeTechnicalProfile ReferenceId="AAD-Common" />
                </TechnicalProfile>

When I upload the policy I get 1 validation error.

Validation failed: 1 validation error(s) found in policy " *** " of tenant "*** .onmicrosoft.com".Output Claim 'issuers' is not supported in Azure Active Directory Provider technical profile 'AAD-UserReadIssuersUsingSignInName' of policy ' *** '. If it is a claim with default value, add AlwaysUseDefaultValue="true" to the output claim mapping.Output Claim 'issuers' is not supported in Azure Active Directory Provider technical profile 'AAD-UserReadIssuersUsingSignInName' of policy 'B2C_1A_SignUpSignInLSG_Test'. If it is a claim with default value, add AlwaysUseDefaultValue="true" to the output claim mapping

Adam Stoffel Adam Stoffel · Accepted Answer · 2020-12-07T21:49:21

As explained in the error message: "issuers" is not a valid Azure AD claim that you can read from the directory. You must read a supported attribute. The list of supported claims is provided in this docs page: https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-profile-attributes

The information you are looking for can be found be reading the "alternateSecurityIds" claim. You would then need to use the GetIdentityProvidersFromAlternativeSecurityIdCollectionTransformation claim transformation in order to parse out the identity providers for that user.

Lookup user by self-asserted email and redirect to user's social login provider if the user exists

1 Answers