oauth-2.0azure-active-directoryazure-ad-b2copenid-connectazure-ad-b2c-custom-policy

How To Add Query Params in ADB2C to ADB2C Federated Authentication Using OIDC protocol


I'm trying to Federate from one ADB2C tenant to another ADB2C tenant.

I'm following the doc:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-b2c?pivots=b2c-custom-policy

The identity provider tenant has a restriction that the authorization endpoint will work only if the authorization endpoint contains a list of specific query parameters. However, since the authorize endpoint is self constructed in ADB2C using Well-known openid config, I'm not sure how I would be able to add the query params to the authorize endpoint.

I tried to add the query params as Item Key as follows which isn't working: b2c to b2c federation with query params

I also tried to add the query params directly to Metadata which says incorrect xml format. Example: b2c to b2c federation with query params

Both the above approach aren't working. I'm thinking of using OAuth2 Protocol provider and test if I could do something with it. But I doubt that's even possible. Anyone else has any solution for this


Solution

  • You can add additional query string parameters to the /authorize request by adding them as additional input parameters to the OpenID Connect technical profile:

    <InputClaims>
      <InputClaim ClaimTypeReferenceId="domain_hint" DefaultValue="contoso.com" />
    </InputClaims>
    

    You can do the usual InputClaims things of mapping to claims that already have values or setting the name of the query string parameter as something separate to the name of the claim

    <!-- domainHint has been pre-populated, e.g. based on user's email domain -->
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="domainHint" PartnerClaimType="domain_hint" />
    </InputClaims>
    

    Your metadata XML issue is something slightly separate. There you need to escape the ampersands:

    <Item Key="METADATA">{base-path}/.well-known/openid-configuration?query_1=value&amp;query2=value&amp;query_3=value</Item>
    

    Though unless you need to pass fixed query string parameters to the OIDC metadata endpoint there's no need to do that at all.