Add claims into token Azure B2C

Question

What are ways to include custom claims (user subscriptions or roles list as example) in a token before issuing it in Azure AD B2C, provided that claims are stored somewhere on own server (not available in B2C)? Goal to have claims in the token to avoid additional round trip to the storage on every request.

Investigation on the topic brought me to following ways:

1. Add custom attribute via Graph API, configure to include in JWT. Attribute values should be kept in sync with our datastorage.

2. Custom Sign-In Policy like in this article https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-rest-api-step-custom but if I got it right, additional Step 6 is a user journey to publicly available API in non restricted way (request not secured by secret, might be used to get user claims by presented UserId)?

3. IdentityServer4 Federation gateway http://docs.identityserver.io/en/release/topics/federation_gateway.html that will allow to add any claims before issuing.

Answer 1

The first two mechanisms you outlined are the most common and recommended ways to include custom claims in an Azure AD B2C issued token:

1. Add a custom attribute and include it in the JWT. You can enable the custom attribute via the B2C UI or via the Graph API. You'd need to build your own mechanism to keep the value of this attribute in B2C in sync with your external source via the Graph API.

2. You can use a custom policy to add a step in your authentication flow to call a Rest API to obtain the claim and include it in the token. This call to the Rest API will be performed by the Azure AD B2C service and NOT the user's browser, so it'll be a service-to-service call (versus a client-to-service call), keeping any secrets you use for authentication with your Rest API safe (such as a Azure function code).

Answer 2

Another option is now available for built-in user flows.

Built-in User Flows

API connectors are now available in Azure AD B2C. This allows retrieving additional data from an API and including it in the JWT sent to the application. In this case, Before sending the token (preview) would be the API connector type to use.

Custom Policies

Add an orchestration step in your user journey to call a Rest API to obtain the claim(s) and include it in the token.

This call to the Rest API will be performed by the Azure AD B2C service and NOT the user's browser, so it'll be a service-to-service call (versus a client-to-service call), keeping any secrets you use for authentication with your Rest API safe (such as a Azure function code).

Updated documentation on how to implement this is available on the API Connectors for custom policies documentation.

Available in both

Add a custom attribute and include it in the JWT. You can add the custom attribute via the B2C UI or via the Graph API.

You'd need to build your own mechanism to keep the value of this attribute in B2C in sync with your external source via the Graph API.

Note: Adding custom attributes via the Graph API results in a bug that it is not shown in the User Attributes blade.

---

This answer builds on the information previously provided by saca in their answer