Unable to set client claims when acquiring confidential client application token

Question

I am attempting to use the MSAL python library to call another custom api in Azure(Exposed through AppRegistration with an API scope exposed).

I am writing a daemon application that will make the request. Following Azure documentation here:

https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-app-configuration?tabs=python

The last example on this Azure docs suggests you can add assertions about custom claims such as client_ip that would be returned in the token.

Similarly, I would like the preferred_username claim to be set to Test as an example:

app = msal.ConfidentialClientApplication(
    config["client_id"], authority=config["authority"],
    client_credential={"thumbprint": config["thumbprint"], "private_key": open(
        config['private_key_file']).read()},
    client_claims={"preferred_username": "Test"}
)

However, When I acquire the token using the following code, the preferred_username claim is not within the Token.

result = app.acquire_token_for_client(scopes=config["scope"])

Within the app registration for the daemon app I have added preferred_username as an optional claim (for access tokens).

I am not sure what is wrong with my approach or if I have misinterpreted the intent of client_claims?

Answer 1

I tried to reproduce the same in my environment and got the results like below:

I created an Azure AD Application and configured custom preferred_username claim:

I generated the token via Postman by using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:https://graph.microsoft.com/.default
grant_type:client_credentials

Optional claims are not included in the token like below:

Note that: Getting optional claim is only possible with Authorization code flow, ROPC flow, Implicit flow. Currently, Client Credentials flow does not support adding any additional custom claims.

Client Credentials flow fetch the token in the application's context and won't have any user-related claims like preferred_username, given_name or email, etc. So, you have to generate the token in the user's context to get the claims.

Alternatively, I generated the Access Token using the endpoint like below:

https://login.microsoftonline.com/tenantID/oauth2/v2.0/authorize?client_id=ClientID&response_type=token&redirect_uri=redirecturi&scope=user.read&response_mode=fragment&state=12345&nonce=678910

Optional claims are included in the token like below:

Reference:

Client assertions (MSAL) - Microsoft Entra | Microsoft Learn