How to save claims in a session in b2c custom policies

I am trying to save a set of claims in a Session Provider Technical Profile.

The documentation here states:

you need to ensure that any claims that need to be returned to the application or used by pre-conditions in subsequent steps, are stored in the session or augmented by a read from the users profile in directory

But gives no indication on how to save the claims in the session - I don't want to persist them permanently in AAD. Whenever the profile is used to populate the claims bucket, all of the output claims are empty, presumably because I'm not persisting them anywhere!

How can I save these claims in the user's session?

Thanks!

Here is my technical profile:

<TechnicalProfile Id="SM-AAD">

    <DisplayName>Session Mananagement Provider</DisplayName>

    <Protocol Name="Proprietary"

              Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>

    <PersistedClaims>

        <PersistedClaim ClaimTypeReferenceId="objectId"/>

        <PersistedClaim ClaimTypeReferenceId="signInName"/>

        <PersistedClaim ClaimTypeReferenceId="authenticationSource"/>

        <PersistedClaim ClaimTypeReferenceId="identityProvider"/>

        <PersistedClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <PersistedClaim ClaimTypeReferenceId="newUser"/>

        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input"/>

    </PersistedClaims>

    <OutputClaims>

        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>

        <OutputClaim ClaimTypeReferenceId="objectId"/>

        <OutputClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <OutputClaim ClaimTypeReferenceId="email"/>

        <OutputClaim ClaimTypeReferenceId="identityProvider"/>

        <OutputClaim ClaimTypeReferenceId="authenticationSource"/>

        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <OutputClaim ClaimTypeReferenceId="upnUserName"/>

        <OutputClaim ClaimTypeReferenceId="userPrincipalName"/>

    </OutputClaims>

</TechnicalProfile>

Here is my claims provider where I'm referencing SM-AAD:

<TechnicalProfile Id="scp-oidc">

  <DisplayName>HMRC SCP Account</DisplayName>

  <Protocol Name="OpenIdConnect"/>

  <Metadata>

      <Item Key="ProviderName">https://api.ete.access.tax.service.gov.uk</Item>

      <Item Key="METADATA">

          {{scp_metadata_url}}

      </Item>

      <!--<Item Key="METADATA">https://api.ete.access.tax.service.gov.uk/.well-known/openid-configuration</Item>-->

      <!--<Item Key="METADATA">https://defra-poc-demo.azurewebsites.net/metadataproxy/basreplacement</Item>-->

      <Item Key="response_types">code</Item>

      <Item Key="response_mode">query</Item>

      <Item Key="scope">openid</Item>

      <Item Key="UsePolicyInRedirectUri">0</Item>

      <Item Key="client_id">{{scp_client_id}}</Item>

      <Item Key="HttpBinding">POST</Item>

      <!--<Item Key="LocalAccountProfile">true</Item>-->

  </Metadata>

  <CryptographicKeys>

      <Key Id="client_secret" StorageReferenceId="B2C_1A_HmrcBasSecret"/>

  </CryptographicKeys>

  <!--<InputClaimsTransformations>-->

  <!--<InputClaimsTransformation ReferenceId="GetFirstBasRole"/>-->

  <!--</InputClaimsTransformations>-->

  <IncludeInSso>true</IncludeInSso>

  <OutputClaims>

      <OutputClaim ClaimTypeReferenceId="BasProfile" PartnerClaimType="profile"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupProfile" PartnerClaimType="bas:groupProfile"/>

      <OutputClaim ClaimTypeReferenceId="BasIdTokenVersion" PartnerClaimType="bas:idTokenVersion"/>

      <OutputClaim ClaimTypeReferenceId="BasRoles" PartnerClaimType="bas:roles"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupId" PartnerClaimType="bas:groupId"/>

      <OutputClaim ClaimTypeReferenceId="BasTrustFingerPrint"

                   PartnerClaimType="bas:trustFingerPrint"/>

      <OutputClaim ClaimTypeReferenceId="BasTokenIdentifier" PartnerClaimType="bas:token_identifier"/>

      <OutputClaim ClaimTypeReferenceId="BasGgLegacyRegistrationCompany"

                   PartnerClaimType="bas:gg-legacy:registrationCategory"/>

      <OutputClaim ClaimTypeReferenceId="BasDeviceId" PartnerClaimType="bas:deviceId"/>

      <OutputClaim ClaimTypeReferenceId="BasTransitionToken"

                   PartnerClaimType="bas:transition:ggToken"/>

      <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="sub"/>

      <OutputClaim ClaimTypeReferenceId="email"/>

      <OutputClaim ClaimTypeReferenceId="emailVerified" PartnerClaimType="email_verified"/>

      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>

      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="scp-123"/>

      <OutputClaim ClaimTypeReferenceId="authenticationSource"

                   DefaultValue="socialIdpAuthentication"/>

  </OutputClaims>

  <OutputClaimsTransformations>

      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>

      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>

      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>

  </OutputClaimsTransformations>

  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>

</TechnicalProfile>

edited Nov 20 '18 at 9:32

asked Nov 20 '18 at 8:37

Chrift

13317

You need to add it to your TrustFrameworkBase.xml.

– SunnySun
Nov 20 '18 at 9:00

Hi @SunnySun-MSFT. For now I have everything in one file, for ease of editing and uploading. I'll add where I'm referencing SM-AAD from my claims provider

– Chrift
Nov 20 '18 at 9:29

If you want to use the custom policy, you need the base file, extension file and the relying party file. For the details, you could read here.

– SunnySun
Nov 20 '18 at 9:39

Sorry @SunnySun-MSFT I don't think that's right. My flow works fine with all of the bits of the policy in one file, with using the Noop session manager. I generally only split my policies up when I'm done developing.

– Chrift
Nov 20 '18 at 10:29

I have my BuildingBlocks with my ClaimsSchema at the top, then my ClaimsProviders, then my RelyingParty definition then my UserJourney definition respectively, all in one file

– Chrift
Nov 20 '18 at 10:35

|
show 1 more comment

I am trying to save a set of claims in a Session Provider Technical Profile.

The documentation here states:

you need to ensure that any claims that need to be returned to the application or used by pre-conditions in subsequent steps, are stored in the session or augmented by a read from the users profile in directory

How can I save these claims in the user's session?

Thanks!

Here is my technical profile:

<TechnicalProfile Id="SM-AAD">

    <DisplayName>Session Mananagement Provider</DisplayName>

    <Protocol Name="Proprietary"

              Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>

    <PersistedClaims>

        <PersistedClaim ClaimTypeReferenceId="objectId"/>

        <PersistedClaim ClaimTypeReferenceId="signInName"/>

        <PersistedClaim ClaimTypeReferenceId="authenticationSource"/>

        <PersistedClaim ClaimTypeReferenceId="identityProvider"/>

        <PersistedClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <PersistedClaim ClaimTypeReferenceId="newUser"/>

        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input"/>

    </PersistedClaims>

    <OutputClaims>

        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>

        <OutputClaim ClaimTypeReferenceId="objectId"/>

        <OutputClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <OutputClaim ClaimTypeReferenceId="email"/>

        <OutputClaim ClaimTypeReferenceId="identityProvider"/>

        <OutputClaim ClaimTypeReferenceId="authenticationSource"/>

        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <OutputClaim ClaimTypeReferenceId="upnUserName"/>

        <OutputClaim ClaimTypeReferenceId="userPrincipalName"/>

    </OutputClaims>

</TechnicalProfile>

Here is my claims provider where I'm referencing SM-AAD:

<TechnicalProfile Id="scp-oidc">

  <DisplayName>HMRC SCP Account</DisplayName>

  <Protocol Name="OpenIdConnect"/>

  <Metadata>

      <Item Key="ProviderName">https://api.ete.access.tax.service.gov.uk</Item>

      <Item Key="METADATA">

          {{scp_metadata_url}}

      </Item>

      <!--<Item Key="METADATA">https://api.ete.access.tax.service.gov.uk/.well-known/openid-configuration</Item>-->

      <!--<Item Key="METADATA">https://defra-poc-demo.azurewebsites.net/metadataproxy/basreplacement</Item>-->

      <Item Key="response_types">code</Item>

      <Item Key="response_mode">query</Item>

      <Item Key="scope">openid</Item>

      <Item Key="UsePolicyInRedirectUri">0</Item>

      <Item Key="client_id">{{scp_client_id}}</Item>

      <Item Key="HttpBinding">POST</Item>

      <!--<Item Key="LocalAccountProfile">true</Item>-->

  </Metadata>

  <CryptographicKeys>

      <Key Id="client_secret" StorageReferenceId="B2C_1A_HmrcBasSecret"/>

  </CryptographicKeys>

  <!--<InputClaimsTransformations>-->

  <!--<InputClaimsTransformation ReferenceId="GetFirstBasRole"/>-->

  <!--</InputClaimsTransformations>-->

  <IncludeInSso>true</IncludeInSso>

  <OutputClaims>

      <OutputClaim ClaimTypeReferenceId="BasProfile" PartnerClaimType="profile"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupProfile" PartnerClaimType="bas:groupProfile"/>

      <OutputClaim ClaimTypeReferenceId="BasIdTokenVersion" PartnerClaimType="bas:idTokenVersion"/>

      <OutputClaim ClaimTypeReferenceId="BasRoles" PartnerClaimType="bas:roles"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupId" PartnerClaimType="bas:groupId"/>

      <OutputClaim ClaimTypeReferenceId="BasTrustFingerPrint"

                   PartnerClaimType="bas:trustFingerPrint"/>

      <OutputClaim ClaimTypeReferenceId="BasTokenIdentifier" PartnerClaimType="bas:token_identifier"/>

      <OutputClaim ClaimTypeReferenceId="BasGgLegacyRegistrationCompany"

                   PartnerClaimType="bas:gg-legacy:registrationCategory"/>

      <OutputClaim ClaimTypeReferenceId="BasDeviceId" PartnerClaimType="bas:deviceId"/>

      <OutputClaim ClaimTypeReferenceId="BasTransitionToken"

                   PartnerClaimType="bas:transition:ggToken"/>

      <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="sub"/>

      <OutputClaim ClaimTypeReferenceId="email"/>

      <OutputClaim ClaimTypeReferenceId="emailVerified" PartnerClaimType="email_verified"/>

      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>

      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="scp-123"/>

      <OutputClaim ClaimTypeReferenceId="authenticationSource"

                   DefaultValue="socialIdpAuthentication"/>

  </OutputClaims>

  <OutputClaimsTransformations>

      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>

      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>

      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>

  </OutputClaimsTransformations>

  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>

</TechnicalProfile>

edited Nov 20 '18 at 9:32

asked Nov 20 '18 at 8:37

Chrift

13317

You need to add it to your TrustFrameworkBase.xml.

– SunnySun
Nov 20 '18 at 9:00

Hi @SunnySun-MSFT. For now I have everything in one file, for ease of editing and uploading. I'll add where I'm referencing SM-AAD from my claims provider

– Chrift
Nov 20 '18 at 9:29

If you want to use the custom policy, you need the base file, extension file and the relying party file. For the details, you could read here.

– SunnySun
Nov 20 '18 at 9:39

Sorry @SunnySun-MSFT I don't think that's right. My flow works fine with all of the bits of the policy in one file, with using the Noop session manager. I generally only split my policies up when I'm done developing.

– Chrift
Nov 20 '18 at 10:29

I have my BuildingBlocks with my ClaimsSchema at the top, then my ClaimsProviders, then my RelyingParty definition then my UserJourney definition respectively, all in one file

– Chrift
Nov 20 '18 at 10:35

|
show 1 more comment

I am trying to save a set of claims in a Session Provider Technical Profile.

The documentation here states:

you need to ensure that any claims that need to be returned to the application or used by pre-conditions in subsequent steps, are stored in the session or augmented by a read from the users profile in directory

How can I save these claims in the user's session?

Thanks!

Here is my technical profile:

<TechnicalProfile Id="SM-AAD">

    <DisplayName>Session Mananagement Provider</DisplayName>

    <Protocol Name="Proprietary"

              Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>

    <PersistedClaims>

        <PersistedClaim ClaimTypeReferenceId="objectId"/>

        <PersistedClaim ClaimTypeReferenceId="signInName"/>

        <PersistedClaim ClaimTypeReferenceId="authenticationSource"/>

        <PersistedClaim ClaimTypeReferenceId="identityProvider"/>

        <PersistedClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <PersistedClaim ClaimTypeReferenceId="newUser"/>

        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input"/>

    </PersistedClaims>

    <OutputClaims>

        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>

        <OutputClaim ClaimTypeReferenceId="objectId"/>

        <OutputClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <OutputClaim ClaimTypeReferenceId="email"/>

        <OutputClaim ClaimTypeReferenceId="identityProvider"/>

        <OutputClaim ClaimTypeReferenceId="authenticationSource"/>

        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <OutputClaim ClaimTypeReferenceId="upnUserName"/>

        <OutputClaim ClaimTypeReferenceId="userPrincipalName"/>

    </OutputClaims>

</TechnicalProfile>

Here is my claims provider where I'm referencing SM-AAD:

<TechnicalProfile Id="scp-oidc">

  <DisplayName>HMRC SCP Account</DisplayName>

  <Protocol Name="OpenIdConnect"/>

  <Metadata>

      <Item Key="ProviderName">https://api.ete.access.tax.service.gov.uk</Item>

      <Item Key="METADATA">

          {{scp_metadata_url}}

      </Item>

      <!--<Item Key="METADATA">https://api.ete.access.tax.service.gov.uk/.well-known/openid-configuration</Item>-->

      <!--<Item Key="METADATA">https://defra-poc-demo.azurewebsites.net/metadataproxy/basreplacement</Item>-->

      <Item Key="response_types">code</Item>

      <Item Key="response_mode">query</Item>

      <Item Key="scope">openid</Item>

      <Item Key="UsePolicyInRedirectUri">0</Item>

      <Item Key="client_id">{{scp_client_id}}</Item>

      <Item Key="HttpBinding">POST</Item>

      <!--<Item Key="LocalAccountProfile">true</Item>-->

  </Metadata>

  <CryptographicKeys>

      <Key Id="client_secret" StorageReferenceId="B2C_1A_HmrcBasSecret"/>

  </CryptographicKeys>

  <!--<InputClaimsTransformations>-->

  <!--<InputClaimsTransformation ReferenceId="GetFirstBasRole"/>-->

  <!--</InputClaimsTransformations>-->

  <IncludeInSso>true</IncludeInSso>

  <OutputClaims>

      <OutputClaim ClaimTypeReferenceId="BasProfile" PartnerClaimType="profile"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupProfile" PartnerClaimType="bas:groupProfile"/>

      <OutputClaim ClaimTypeReferenceId="BasIdTokenVersion" PartnerClaimType="bas:idTokenVersion"/>

      <OutputClaim ClaimTypeReferenceId="BasRoles" PartnerClaimType="bas:roles"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupId" PartnerClaimType="bas:groupId"/>

      <OutputClaim ClaimTypeReferenceId="BasTrustFingerPrint"

                   PartnerClaimType="bas:trustFingerPrint"/>

      <OutputClaim ClaimTypeReferenceId="BasTokenIdentifier" PartnerClaimType="bas:token_identifier"/>

      <OutputClaim ClaimTypeReferenceId="BasGgLegacyRegistrationCompany"

                   PartnerClaimType="bas:gg-legacy:registrationCategory"/>

      <OutputClaim ClaimTypeReferenceId="BasDeviceId" PartnerClaimType="bas:deviceId"/>

      <OutputClaim ClaimTypeReferenceId="BasTransitionToken"

                   PartnerClaimType="bas:transition:ggToken"/>

      <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="sub"/>

      <OutputClaim ClaimTypeReferenceId="email"/>

      <OutputClaim ClaimTypeReferenceId="emailVerified" PartnerClaimType="email_verified"/>

      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>

      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="scp-123"/>

      <OutputClaim ClaimTypeReferenceId="authenticationSource"

                   DefaultValue="socialIdpAuthentication"/>

  </OutputClaims>

  <OutputClaimsTransformations>

      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>

      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>

      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>

  </OutputClaimsTransformations>

  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>

</TechnicalProfile>

edited Nov 20 '18 at 9:32

asked Nov 20 '18 at 8:37

Chrift

13317

I am trying to save a set of claims in a Session Provider Technical Profile.

The documentation here states:

you need to ensure that any claims that need to be returned to the application or used by pre-conditions in subsequent steps, are stored in the session or augmented by a read from the users profile in directory

How can I save these claims in the user's session?

Thanks!

Here is my technical profile:

<TechnicalProfile Id="SM-AAD">

    <DisplayName>Session Mananagement Provider</DisplayName>

    <Protocol Name="Proprietary"

              Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>

    <PersistedClaims>

        <PersistedClaim ClaimTypeReferenceId="objectId"/>

        <PersistedClaim ClaimTypeReferenceId="signInName"/>

        <PersistedClaim ClaimTypeReferenceId="authenticationSource"/>

        <PersistedClaim ClaimTypeReferenceId="identityProvider"/>

        <PersistedClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <PersistedClaim ClaimTypeReferenceId="newUser"/>

        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input"/>

    </PersistedClaims>

    <OutputClaims>

        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>

        <OutputClaim ClaimTypeReferenceId="objectId"/>

        <OutputClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <OutputClaim ClaimTypeReferenceId="email"/>

        <OutputClaim ClaimTypeReferenceId="identityProvider"/>

        <OutputClaim ClaimTypeReferenceId="authenticationSource"/>

        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <OutputClaim ClaimTypeReferenceId="upnUserName"/>

        <OutputClaim ClaimTypeReferenceId="userPrincipalName"/>

    </OutputClaims>

</TechnicalProfile>

Here is my claims provider where I'm referencing SM-AAD:

<TechnicalProfile Id="scp-oidc">

  <DisplayName>HMRC SCP Account</DisplayName>

  <Protocol Name="OpenIdConnect"/>

  <Metadata>

      <Item Key="ProviderName">https://api.ete.access.tax.service.gov.uk</Item>

      <Item Key="METADATA">

          {{scp_metadata_url}}

      </Item>

      <!--<Item Key="METADATA">https://api.ete.access.tax.service.gov.uk/.well-known/openid-configuration</Item>-->

      <!--<Item Key="METADATA">https://defra-poc-demo.azurewebsites.net/metadataproxy/basreplacement</Item>-->

      <Item Key="response_types">code</Item>

      <Item Key="response_mode">query</Item>

      <Item Key="scope">openid</Item>

      <Item Key="UsePolicyInRedirectUri">0</Item>

      <Item Key="client_id">{{scp_client_id}}</Item>

      <Item Key="HttpBinding">POST</Item>

      <!--<Item Key="LocalAccountProfile">true</Item>-->

  </Metadata>

  <CryptographicKeys>

      <Key Id="client_secret" StorageReferenceId="B2C_1A_HmrcBasSecret"/>

  </CryptographicKeys>

  <!--<InputClaimsTransformations>-->

  <!--<InputClaimsTransformation ReferenceId="GetFirstBasRole"/>-->

  <!--</InputClaimsTransformations>-->

  <IncludeInSso>true</IncludeInSso>

  <OutputClaims>

      <OutputClaim ClaimTypeReferenceId="BasProfile" PartnerClaimType="profile"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupProfile" PartnerClaimType="bas:groupProfile"/>

      <OutputClaim ClaimTypeReferenceId="BasIdTokenVersion" PartnerClaimType="bas:idTokenVersion"/>

      <OutputClaim ClaimTypeReferenceId="BasRoles" PartnerClaimType="bas:roles"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupId" PartnerClaimType="bas:groupId"/>

      <OutputClaim ClaimTypeReferenceId="BasTrustFingerPrint"

                   PartnerClaimType="bas:trustFingerPrint"/>

      <OutputClaim ClaimTypeReferenceId="BasTokenIdentifier" PartnerClaimType="bas:token_identifier"/>

      <OutputClaim ClaimTypeReferenceId="BasGgLegacyRegistrationCompany"

                   PartnerClaimType="bas:gg-legacy:registrationCategory"/>

      <OutputClaim ClaimTypeReferenceId="BasDeviceId" PartnerClaimType="bas:deviceId"/>

      <OutputClaim ClaimTypeReferenceId="BasTransitionToken"

                   PartnerClaimType="bas:transition:ggToken"/>

      <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="sub"/>

      <OutputClaim ClaimTypeReferenceId="email"/>

      <OutputClaim ClaimTypeReferenceId="emailVerified" PartnerClaimType="email_verified"/>

      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>

      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="scp-123"/>

      <OutputClaim ClaimTypeReferenceId="authenticationSource"

                   DefaultValue="socialIdpAuthentication"/>

  </OutputClaims>

  <OutputClaimsTransformations>

      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>

      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>

      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>

  </OutputClaimsTransformations>

  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>

</TechnicalProfile>

<TechnicalProfile Id="SM-AAD">

    <DisplayName>Session Mananagement Provider</DisplayName>

    <Protocol Name="Proprietary"

              Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>

    <PersistedClaims>

        <PersistedClaim ClaimTypeReferenceId="objectId"/>

        <PersistedClaim ClaimTypeReferenceId="signInName"/>

        <PersistedClaim ClaimTypeReferenceId="authenticationSource"/>

        <PersistedClaim ClaimTypeReferenceId="identityProvider"/>

        <PersistedClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <PersistedClaim ClaimTypeReferenceId="newUser"/>

        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input"/>

    </PersistedClaims>

    <OutputClaims>

        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>

        <OutputClaim ClaimTypeReferenceId="objectId"/>

        <OutputClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <OutputClaim ClaimTypeReferenceId="email"/>

        <OutputClaim ClaimTypeReferenceId="identityProvider"/>

        <OutputClaim ClaimTypeReferenceId="authenticationSource"/>

        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <OutputClaim ClaimTypeReferenceId="upnUserName"/>

        <OutputClaim ClaimTypeReferenceId="userPrincipalName"/>

    </OutputClaims>

</TechnicalProfile>

<TechnicalProfile Id="SM-AAD">

    <DisplayName>Session Mananagement Provider</DisplayName>

    <Protocol Name="Proprietary"

              Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>

    <PersistedClaims>

        <PersistedClaim ClaimTypeReferenceId="objectId"/>

        <PersistedClaim ClaimTypeReferenceId="signInName"/>

        <PersistedClaim ClaimTypeReferenceId="authenticationSource"/>

        <PersistedClaim ClaimTypeReferenceId="identityProvider"/>

        <PersistedClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <PersistedClaim ClaimTypeReferenceId="newUser"/>

        <PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input"/>

    </PersistedClaims>

    <OutputClaims>

        <OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true"/>

        <OutputClaim ClaimTypeReferenceId="objectId"/>

        <OutputClaim ClaimTypeReferenceId="socialIdpUserId"/>

        <OutputClaim ClaimTypeReferenceId="email"/>

        <OutputClaim ClaimTypeReferenceId="identityProvider"/>

        <OutputClaim ClaimTypeReferenceId="authenticationSource"/>

        <OutputClaim ClaimTypeReferenceId="alternativeSecurityId"/>

        <OutputClaim ClaimTypeReferenceId="upnUserName"/>

        <OutputClaim ClaimTypeReferenceId="userPrincipalName"/>

    </OutputClaims>

</TechnicalProfile>

<TechnicalProfile Id="scp-oidc">

  <DisplayName>HMRC SCP Account</DisplayName>

  <Protocol Name="OpenIdConnect"/>

  <Metadata>

      <Item Key="ProviderName">https://api.ete.access.tax.service.gov.uk</Item>

      <Item Key="METADATA">

          {{scp_metadata_url}}

      </Item>

      <!--<Item Key="METADATA">https://api.ete.access.tax.service.gov.uk/.well-known/openid-configuration</Item>-->

      <!--<Item Key="METADATA">https://defra-poc-demo.azurewebsites.net/metadataproxy/basreplacement</Item>-->

      <Item Key="response_types">code</Item>

      <Item Key="response_mode">query</Item>

      <Item Key="scope">openid</Item>

      <Item Key="UsePolicyInRedirectUri">0</Item>

      <Item Key="client_id">{{scp_client_id}}</Item>

      <Item Key="HttpBinding">POST</Item>

      <!--<Item Key="LocalAccountProfile">true</Item>-->

  </Metadata>

  <CryptographicKeys>

      <Key Id="client_secret" StorageReferenceId="B2C_1A_HmrcBasSecret"/>

  </CryptographicKeys>

  <!--<InputClaimsTransformations>-->

  <!--<InputClaimsTransformation ReferenceId="GetFirstBasRole"/>-->

  <!--</InputClaimsTransformations>-->

  <IncludeInSso>true</IncludeInSso>

  <OutputClaims>

      <OutputClaim ClaimTypeReferenceId="BasProfile" PartnerClaimType="profile"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupProfile" PartnerClaimType="bas:groupProfile"/>

      <OutputClaim ClaimTypeReferenceId="BasIdTokenVersion" PartnerClaimType="bas:idTokenVersion"/>

      <OutputClaim ClaimTypeReferenceId="BasRoles" PartnerClaimType="bas:roles"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupId" PartnerClaimType="bas:groupId"/>

      <OutputClaim ClaimTypeReferenceId="BasTrustFingerPrint"

                   PartnerClaimType="bas:trustFingerPrint"/>

      <OutputClaim ClaimTypeReferenceId="BasTokenIdentifier" PartnerClaimType="bas:token_identifier"/>

      <OutputClaim ClaimTypeReferenceId="BasGgLegacyRegistrationCompany"

                   PartnerClaimType="bas:gg-legacy:registrationCategory"/>

      <OutputClaim ClaimTypeReferenceId="BasDeviceId" PartnerClaimType="bas:deviceId"/>

      <OutputClaim ClaimTypeReferenceId="BasTransitionToken"

                   PartnerClaimType="bas:transition:ggToken"/>

      <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="sub"/>

      <OutputClaim ClaimTypeReferenceId="email"/>

      <OutputClaim ClaimTypeReferenceId="emailVerified" PartnerClaimType="email_verified"/>

      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>

      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="scp-123"/>

      <OutputClaim ClaimTypeReferenceId="authenticationSource"

                   DefaultValue="socialIdpAuthentication"/>

  </OutputClaims>

  <OutputClaimsTransformations>

      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>

      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>

      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>

  </OutputClaimsTransformations>

  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>

</TechnicalProfile>

<TechnicalProfile Id="scp-oidc">

  <DisplayName>HMRC SCP Account</DisplayName>

  <Protocol Name="OpenIdConnect"/>

  <Metadata>

      <Item Key="ProviderName">https://api.ete.access.tax.service.gov.uk</Item>

      <Item Key="METADATA">

          {{scp_metadata_url}}

      </Item>

      <!--<Item Key="METADATA">https://api.ete.access.tax.service.gov.uk/.well-known/openid-configuration</Item>-->

      <!--<Item Key="METADATA">https://defra-poc-demo.azurewebsites.net/metadataproxy/basreplacement</Item>-->

      <Item Key="response_types">code</Item>

      <Item Key="response_mode">query</Item>

      <Item Key="scope">openid</Item>

      <Item Key="UsePolicyInRedirectUri">0</Item>

      <Item Key="client_id">{{scp_client_id}}</Item>

      <Item Key="HttpBinding">POST</Item>

      <!--<Item Key="LocalAccountProfile">true</Item>-->

  </Metadata>

  <CryptographicKeys>

      <Key Id="client_secret" StorageReferenceId="B2C_1A_HmrcBasSecret"/>

  </CryptographicKeys>

  <!--<InputClaimsTransformations>-->

  <!--<InputClaimsTransformation ReferenceId="GetFirstBasRole"/>-->

  <!--</InputClaimsTransformations>-->

  <IncludeInSso>true</IncludeInSso>

  <OutputClaims>

      <OutputClaim ClaimTypeReferenceId="BasProfile" PartnerClaimType="profile"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupProfile" PartnerClaimType="bas:groupProfile"/>

      <OutputClaim ClaimTypeReferenceId="BasIdTokenVersion" PartnerClaimType="bas:idTokenVersion"/>

      <OutputClaim ClaimTypeReferenceId="BasRoles" PartnerClaimType="bas:roles"/>

      <OutputClaim ClaimTypeReferenceId="BasGroupId" PartnerClaimType="bas:groupId"/>

      <OutputClaim ClaimTypeReferenceId="BasTrustFingerPrint"

                   PartnerClaimType="bas:trustFingerPrint"/>

      <OutputClaim ClaimTypeReferenceId="BasTokenIdentifier" PartnerClaimType="bas:token_identifier"/>

      <OutputClaim ClaimTypeReferenceId="BasGgLegacyRegistrationCompany"

                   PartnerClaimType="bas:gg-legacy:registrationCategory"/>

      <OutputClaim ClaimTypeReferenceId="BasDeviceId" PartnerClaimType="bas:deviceId"/>

      <OutputClaim ClaimTypeReferenceId="BasTransitionToken"

                   PartnerClaimType="bas:transition:ggToken"/>

      <OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="sub"/>

      <OutputClaim ClaimTypeReferenceId="email"/>

      <OutputClaim ClaimTypeReferenceId="emailVerified" PartnerClaimType="email_verified"/>

      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name"/>

      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="scp-123"/>

      <OutputClaim ClaimTypeReferenceId="authenticationSource"

                   DefaultValue="socialIdpAuthentication"/>

  </OutputClaims>

  <OutputClaimsTransformations>

      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>

      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>

      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>

  </OutputClaimsTransformations>

  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD"/>

</TechnicalProfile>

azure azure-ad-b2c

edited Nov 20 '18 at 9:32

asked Nov 20 '18 at 8:37

Chrift

13317

edited Nov 20 '18 at 9:32

asked Nov 20 '18 at 8:37

Chrift

13317

edited Nov 20 '18 at 9:32

asked Nov 20 '18 at 8:37

Chrift

13317

asked Nov 20 '18 at 8:37

Chrift

13317

asked Nov 20 '18 at 8:37

Chrift

13317

You need to add it to your TrustFrameworkBase.xml.

– SunnySun
Nov 20 '18 at 9:00

Hi @SunnySun-MSFT. For now I have everything in one file, for ease of editing and uploading. I'll add where I'm referencing SM-AAD from my claims provider

– Chrift
Nov 20 '18 at 9:29

If you want to use the custom policy, you need the base file, extension file and the relying party file. For the details, you could read here.

– SunnySun
Nov 20 '18 at 9:39

Sorry @SunnySun-MSFT I don't think that's right. My flow works fine with all of the bits of the policy in one file, with using the Noop session manager. I generally only split my policies up when I'm done developing.

– Chrift
Nov 20 '18 at 10:29

I have my BuildingBlocks with my ClaimsSchema at the top, then my ClaimsProviders, then my RelyingParty definition then my UserJourney definition respectively, all in one file

– Chrift
Nov 20 '18 at 10:35

|
show 1 more comment

You need to add it to your TrustFrameworkBase.xml.

– SunnySun
Nov 20 '18 at 9:00

Hi @SunnySun-MSFT. For now I have everything in one file, for ease of editing and uploading. I'll add where I'm referencing SM-AAD from my claims provider

– Chrift
Nov 20 '18 at 9:29

If you want to use the custom policy, you need the base file, extension file and the relying party file. For the details, you could read here.

– SunnySun
Nov 20 '18 at 9:39

Sorry @SunnySun-MSFT I don't think that's right. My flow works fine with all of the bits of the policy in one file, with using the Noop session manager. I generally only split my policies up when I'm done developing.

– Chrift
Nov 20 '18 at 10:29

I have my BuildingBlocks with my ClaimsSchema at the top, then my ClaimsProviders, then my RelyingParty definition then my UserJourney definition respectively, all in one file

– Chrift
Nov 20 '18 at 10:35

You need to add it to your TrustFrameworkBase.xml.

– SunnySun
Nov 20 '18 at 9:00

Hi @SunnySun-MSFT. For now I have everything in one file, for ease of editing and uploading. I'll add where I'm referencing SM-AAD from my claims provider

– Chrift
Nov 20 '18 at 9:29

If you want to use the custom policy, you need the base file, extension file and the relying party file. For the details, you could read here.

– SunnySun
Nov 20 '18 at 9:39

Sorry @SunnySun-MSFT I don't think that's right. My flow works fine with all of the bits of the policy in one file, with using the Noop session manager. I generally only split my policies up when I'm done developing.

– Chrift
Nov 20 '18 at 10:29

I have my BuildingBlocks with my ClaimsSchema at the top, then my ClaimsProviders, then my RelyingParty definition then my UserJourney definition respectively, all in one file

– Chrift
Nov 20 '18 at 10:35

|
show 1 more comment

0

active

oldest

votes

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53389055%2fhow-to-save-claims-in-a-session-in-b2c-custom-policies%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

0

active

oldest

votes

0

active

oldest

votes

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu