Question 103208 in Azure Question posted in
The official documentation to get you started can be found here.

family_name and given_name not included in AzureAD token claims

I have successfully connected an OIDC flow with AzureAD, but unfortunately I’m unable to get family_name and given_name claims included in the token. I am requesting the following scopes: { "openid", "profile", "email", "offline_access" }

In the Azure App Registration page I have added the family_name and given_name to the manifest under optionalClaims both in idToken and accessToken, and even set them as essential – but they’re still not being returned:

"optionalClaims": {
        "idToken": [
            {
                "name": "email",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "family_name",
                "source": null,
                "essential": true,
                "additionalProperties": []
            },
            {
                "name": "given_name",
                "source": null,
                "essential": true,
                "additionalProperties": []
            }
        ],
        "accessToken": [
            {
                "name": "email",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "family_name",
                "source": null,
                "essential": true,
                "additionalProperties": []
            },
            {
                "name": "given_name",
                "source": null,
                "essential": true,
                "additionalProperties": []
            }

This Microsoft page says "These claims are always included in v1.0 Azure AD tokens, but not included in v2.0 tokens unless requested".

I’m using v2 and so I’ve also tried adding family_name and given_name to the scopes that I’m requesting in my OIDC call, but it fails and says those scopes don’t exist.

Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:
‘invalid_client’, error_description: ‘AADSTS650053: The application ‘REMOVED’ asked for scope ‘given_name’ that doesn’t exist on the resource ‘00000003-0000-0000-c000-000000000000’.

Any suggestions on how I can get AzureAD to include those claims for me?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    The family_name and given_name claims actually were being included in the token issued by AzureAD - I was only inspecting the final token issued by my local identity server.

    When I debugged the Callback method and inspected the AzureAD token, not the final token issued locally, I could access the claims from there.


  2. 0

    In azure ad app registration , I have following optional claims added:

    enter image description here

    Manifest:

    "optionalClaims": {
        "idToken": [],
        "accessToken": [
            {
                "name": "upn",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "family_name",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },
            {
                "name": "given_name",
                "source": null,
                "essential": false,
                "additionalProperties": []
            },

    enter image description here

    I recieved the error:
    AADSTS650053%3a+The+application+%27kavyarepo%27+asked+for+scope+%27given_name%27+that+doesn%27t+exist+on+the+resource+%2xxx0-000000000000%27.+Contact+the+app+vendor.%0d%0a

    When i gave scope as given_name

    enter image description here

    It must be either api://clientid/given_name or api://clinetid/.default .

    But generally users profile can be fetched with microsoft graph permissions:

    check below steps:

    With authorize endpoint: https://login.microsoftonline.com/xxx/oauth2/v2.0/authorize and client credentials,

    and scope for microsoft graph, i.e; https://graph.microsoft.com/.default
    Received code with below endpoint after the user logged in:

    https://login.microsoftonline.com/x/oauth2/v2.0/authorize?Client_id=xxxd-xx350c02de9247&client_secret="sdxxx"&redirect_uri=https://jwt.ms&scope=https://graph.microsoft.com/.default&grant_type=authorization_code&response_type=code

    Then after, I used the code in token endpoint to receive access token :

    https://login.microsoftonline.com/xxx/oauth2/v2.0/token?Client_id=9xx-4xxx7&client_secret=”xxx”&redirect_uri=https://jwt.ms&scope=https://graph.microsoft.com/.default&code=””

    enter image description here

    When decoded the token at https://jwt.ms, received the claims along with optional claims

    enter image description here

    Make sure the scopes include: profile User.Read openid email which are microsoft graph permissions.

    These should be granted admin consent to user while authenticating or through the portal:

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search