azureblazorauthorizationmicrosoft-entra-idclaims

Entra optional claim of login_hint seems to always be blank

I'm currently working on a blazor webassembly app, to which users get to authenticate themself using Microsoft Entra ID. This all works fine and dandy, but I'm trying to optimise the experience. Currently, on logout the user gets prompted to select the user they're logging out. I've figured out you can bypass this by configuring the acces or ID token to pass the optional claim "login_hint". When logging out, this can then be used to fill in the "logout_hint" parameter, and thus skipping this step.

Aparantly, easier said than done, as I've currently configured the claim to be returned for both ID and acces token, just to be sure, but it's still absent. Is there anything else I should be checking? If it's of any importance, the requestAccessTokenVersion in the manifest is currently 2 and I could confirm this was in the manifest:

{
    "additionalProperties": [],
    "essential": false,
    "name": "login_hint",
    "source": null
}
Solution

  • To get the optional claim in the access and ID token, check the below:

    Created a Microsoft Entra ID application and updated Manifest:

    "acceptMappedClaims": true,
"requestedAccessTokenVersion": 2

    enter image description here

    Note : To get the optional claim in access token, you need pass scope as API not Microsoft Graph. If the scope is custom API, then only the optional claim will be displayed in access token. Refer this MsDoc

    Configured optional claims:

    enter image description here

    Granted below API permissions:

    enter image description here

    Used the below endpoint to sign-in the user:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=User.Read openid offline_access profile api://ClientID/access_as_user
&state=12345

    enter image description here

    Generated access and ID tokens:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id: ClientID
grant_type: authorization_code
scope: api://ClientID/access_as_user offline_access openid
redirect_uri: RedirectURL
code: xxx
client_secret: Secret

    enter image description here

    Access Token:

    enter image description here

    ID Token:

    enter image description here

    If you don't want to get the optional claim in access token, then no need to pass scope as API.

    Make use of below request to logout from Microsoft Entra ID application without prompt:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/logout?id_token_hint=IDTOKEN&post_logout_redirect_uri=REDIRECTURL&logout_hint=LoginHintValueFromIDToken

    he user logged out successfully without any account selection prompt:

    enter image description here

    And the user will be redirected to the redirect URL page without any prompt to select account to logout.