Skip to content

Commit 0c7e918

Browse files
v-aljev-alje
committed
Bringing even with master.
2 parents 35a4850 + 1458923 commit 0c7e918

File tree

130 files changed

+1891
-1147
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

130 files changed

+1891
-1147
lines changed

‎articles/active-directory-b2c/TOC.yml

+2
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,8 @@
143143
href: active-directory-b2c-reference-kmsi-custom.md
144144
- name: Reference
145145
items:
146+
- name: Claim resolvers
147+
href: claim-resolver-overview.md
146148
- name: Identity Experience Framework schema
147149
items:
148150
- name: TrustFrameworkPolicy

‎articles/active-directory-b2c/active-directory-b2c-custom-guide-eventlogger-appins.md

+44-135
Large diffs are not rendered by default.

‎articles/active-directory-b2c/claim-resolver-overview.md

+166
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: About claim resolvers in Azure Active Directory B2C custom policies | Microsoft Docs
3+
description: Learn about how claims resolvers are used in a custom policy in Azure Active Directory B2C.
4+
services: active-directory-b2c
5+
author: davidmu1
6+
manager: mtillman
7+
8+
ms.service: active-directory
9+
ms.workload: identity
10+
ms.topic: reference
11+
ms.date: 10/08/2018
12+
ms.author: davidmu
13+
ms.component: B2C
14+
---
15+
16+
# About claim resolvers in Azure Active Directory B2C custom policies
17+
18+
Claim resolvers in Azure Active Directory (Azure AD) B2C [custom policies](active-directory-b2c-overview-custom.md) provide context information about an authorization request, such as the policy name, request correlation ID, user interface language, and more.
19+
20+
To use a claim resolver in an input or output claim, you define a string **ClaimType**, under the [ClaimsSchema](claimsschema.md) element, and then you set the **DefaultValue** to the claim resolver in the input or output claim element. Azure AD B2C reads the value of the claim resolver and uses the value in the technical profile.
21+
22+
In the following example, a claim type named `correlationId` is defined with a **DataType** of `string`.
23+
24+
```XML
25+
<ClaimType Id="correlationId">
26+
<DisplayName>correlationId</DisplayName>
27+
<DataType>string</DataType>
28+
<UserHelpText>Request correlation Id</UserHelpText>
29+
</ClaimType>
30+
```
31+
32+
In the technical profile, map the claim resolver to the claim type. Azure AD B2C populates the value of the claim resolver `{context:corelationId}` into the claim `correlationId` and sends the claim to the technical profile.
33+
34+
```XML
35+
<InputClaim ClaimTypeReferenceId="correlationId" DefaultValue="{context:corelationId}" />
36+
```
37+
38+
## Claim resolver types
39+
40+
The following sections list available claim resolvers.
41+
42+
### Culture
43+
44+
| Claim | Description | Example |
45+
| ----- | ----------- | --------|
46+
| {Culture:LanguageName} | The two letter ISO code for the language. | en |
47+
| {Culture:LCID} | The LCID of language code. | 1033 |
48+
| {Culture:RegionName} | The two letter ISO code for the region. | US |
49+
| {Culture:RFC5646} | The RFC5646 language code. | en-US |
50+
51+
### Policy
52+
53+
| Claim | Description | Example |
54+
| ----- | ----------- | --------|
55+
| {Policy:PolicyId} | The relying party policy name. | B2C_1A_signup_signin |
56+
| {Policy:RelyingPartyTenantId} | The tenant ID of the relying party policy. | your-tenant.onmicrosoft.com |
57+
| {Policy:TenantObjectId} | The tenant object ID of the relying party policy. | 00000000-0000-0000-0000-000000000000 |
58+
| {Policy:TrustFrameworkTenantId} | The tenant ID of the trust framework. | your-tenant.onmicrosoft.com |
59+
60+
### OpenID Connect
61+
62+
| Claim | Description | Example |
63+
| ----- | ----------- | --------|
64+
| {OIDC:AuthenticationContextReferences} |The `acr_values` query string parameter. | N/A |
65+
| {OIDC:ClientId} |The `client_id` query string parameter. | 00000000-0000-0000-0000-000000000000 |
66+
| {OIDC:DomainHint} |The `domain_hint` query string parameter. | facebook.com |
67+
| {OIDC:LoginHint} | The `login_hint` query string parameter. | [email protected] |
68+
| {OIDC:MaxAge} | The `max_age`. | N/A |
69+
| {OIDC:Nonce} |The `Nonce` query string parameter. | defaultNonce |
70+
| {OIDC:Prompt} | The `prompt` query string parameter. | login |
71+
| {OIDC:Resource} |The `resource` query string parameter. | N/A |
72+
| {OIDC:scope} |The `scope` query string parameter. | openid |
73+
74+
### Context
75+
76+
| Claim | Description | Example |
77+
| ----- | ----------- | --------|
78+
| {Context:BuildNumber} | The Identity Experience Framework version (build number). | 1.0.507.0 |
79+
| {Context:CorrelationId} | The correlation ID. | 00000000-0000-0000-0000-000000000000 |
80+
| {Context:DateTimeInUtc} |The date time in UTC. | 10/10/2018 12:00:00 PM |
81+
| {Context:DeploymentMode} |The policy deployment mode. | Production |
82+
| {Context:IPAddress} | The user IP address. | 11.111.111.11 |
83+
84+
85+
### Non-protocol parameters
86+
87+
Any parameter name included as part of an OIDC or OAuth2 request can be mapped to a claim in the user journey. For example, the request from the application might include a query string parameter with a name of `app_session`, `loyalty_number`, or any custom query string.
88+
89+
| Claim | Description | Example |
90+
| ----- | ----------------------- | --------|
91+
| {OAUTH-KV:campaignId} | A query string parameter. | hawaii |
92+
| {OAUTH-KV:app_session} | A query string parameter. | A3C5R |
93+
| {OAUTH-KV:loyalty_number} | A query string parameter. | 1234 |
94+
| {OAUTH-KV:any custom query string} | A query string parameter. | N/A |
95+
96+
97+
## How to use claim resolvers
98+
99+
### RESTful technical profile
100+
101+
In a [RESTful](restful-technical-profile.md) technical profile, you may want to send the user language, policy name, scope, and client ID. Based on these claims the REST API can run custom business logic, and if necessary raise a localized error message.
102+
103+
The following example shows a RESTful technical profile:
104+
105+
```XML
106+
<TechnicalProfile Id="REST">
107+
<DisplayName>Validate user input data and return loyaltyNumber claim</DisplayName>
108+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
109+
<Metadata>
110+
<Item Key="ServiceUrl">https://your-app.azurewebsites.net/api/identity</Item>
111+
<Item Key="AuthenticationType">None</Item>
112+
<Item Key="SendClaimsIn">Body</Item>
113+
</Metadata>
114+
<InputClaims>
115+
<InputClaim ClaimTypeReferenceId="userLanguage" DefaultValue="{Culture:LCID}" />
116+
<InputClaim ClaimTypeReferenceId="policyName" DefaultValue="{Policy:PolicyId}" />
117+
<InputClaim ClaimTypeReferenceId="scope" DefaultValue="{OIDC:scope}" />
118+
<InputClaim ClaimTypeReferenceId="clientId" DefaultValue="{OIDC:ClientId}" />
119+
</InputClaims>
120+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
121+
</TechnicalProfile>
122+
```
123+
124+
### Direct sign-in
125+
126+
Using claim resolvers, you can prepopulate the sign-in name or direct sign-in to a specific social identity provider, such as Facebook, LinkedIn, or a Microsoft account. For more information, see [Set up direct sign-in using Azure Active Directory B2C](direct-signin.md).
127+
128+
### Dynamic UI customization
129+
130+
Azue AD B2C enables you to pass query string parameters to your HTML content definition endpoints so that you can dynamically render the page content. For example, you can change the background image on the Azure AD B2C sign-up or sign-in page based on a custom parameter that you pass from your web or mobile application. For more information, see [Dynamically configure the UI by using custom policies in Azure Active Directory B2C](active-directory-b2c-ui-customization-custom-dynamic.md). You can also localize your HTML page based on a language parameter, or you can change the content based on the client ID.
131+
132+
The following example passes in the query string a parameter named **campaignId** with a value of `hawaii`, a **language** code of `en-US`, and **app** representing the client ID:
133+
134+
```XML
135+
<UserJourneyBehaviors>
136+
<ContentDefinitionParameters>
137+
<Parameter Name="campaignId">{OAUTH-KV:campaignId}</Parameter>
138+
<Parameter Name="language">{Culture:RFC5646}</Parameter>
139+
<Parameter Name="app">{OIDC:ClientId}</Parameter>
140+
</ContentDefinitionParameters>
141+
</UserJourneyBehaviors>
142+
```
143+
144+
As a result Azure AD B2C sends the above parameters to the HTML content page:
145+
146+
```
147+
/selfAsserted.aspx?campaignId=hawaii&language=en-US&app=0239a9cc-309c-4d41-87f1-31288feb2e82
148+
```
149+
150+
### Application Insights technical profile
151+
152+
With Azure Application Insights and claim resolvers you can gain insights on user behavior. In the Application Insights technical profile, you send input claims that are persisted to Azure Application Insights. For more information, see [Track user behavior in Azure AD B2C journeys by using Application Insights](active-directory-b2c-custom-guide-eventlogger-appins.md). The following example sends the policy ID, correlation ID, language, and the client ID to Azure Application Insights.
153+
154+
```XML
155+
<TechnicalProfile Id="AzureInsights-Common">
156+
<DisplayName>Alternate Email</DisplayName>
157+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.Insights.AzureApplicationInsightsProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
158+
...
159+
<InputClaims>
160+
<InputClaim ClaimTypeReferenceId="PolicyId" PartnerClaimType="{property:Policy}" DefaultValue="{Policy:PolicyId}" />
161+
<InputClaim ClaimTypeReferenceId="CorrelationId" PartnerClaimType="{property:CorrelationId}" DefaultValue="{Context:CorrelationId}" />
162+
<InputClaim ClaimTypeReferenceId="language" PartnerClaimType="{property:language}" DefaultValue="{Culture:RFC5646}" />
163+
<InputClaim ClaimTypeReferenceId="AppId" PartnerClaimType="{property:App}" DefaultValue="{OIDC:ClientId}" />
164+
</InputClaims>
165+
</TechnicalProfile>
166+
```

‎articles/active-directory-b2c/media/active-directory-b2c-custom-guide-eventlogger-appins/app-ins-key.png

-80.8 KB
Binary file not shown.

‎articles/active-directory-b2c/media/active-directory-b2c-custom-guide-eventlogger-appins/app-insights.PNG

51.5 KB
Loading

0 commit comments

Comments
 (0)