active directory - How to add a custom claim and retrieve the same as part of access_token, when the scope is not Graph API in Azure AD?

Question

I have created a Azure AD web application. Now I am getting my access_token using following API,

POST https://login.microsoftonline.com/{Directory (tenant) ID }/oauth2/v2.0/token

password:pass 
client_id:id
resource:https://graph.microsoft.com 
grant_type:password 
client_secret:secret 
sername:userName 
scope: https://rbsessence.onmicrosoft.com/0a7c94a0-0c4e-4f95-ba06-XXXX/.default

The response looks like,

"token_type": "Bearer",
    "scope": "https://rbsessence.onmicrosoft.com/0a7c94a0-0c4e-4f95-ba06-XXXXX/myTestRole https://rbsessence.onmicrosoft.com/0a7c94a0-0c4e-4f95-ba06-XXXXXX/user_impersonation https://rbsessence.onmicrosoft.com/0a7c94a0-0c4e-4f95-ba06-XXXXX/.default",
    "expires_in": 3599,
    "ext_expires_in": 3599, "access_token": "acessToken"

Now I am passing the access_token to a third party application which is configured with the same Azure AD client. Now that third party is expecting a custom claim by the name "policy":"readwrite", to be passed as part of access_token. How can I achieve the same?

Answer 1

Please refer to the following steps (You can do the Microsoft Graph operation in Microsoft Graph Explorer for saving time.):

Create an extensionProperty (you could use a new created Azure AD application here):

Post https://graph.microsoft.com/v1.0/applications/{object id of the Azure AD application}/extensionProperties

{"name":"policy","dataType":"string","targetObjects":["User"]}

It will generate an extension property named extension_{client id of the Azure AD application}_policy.

Secondly, you can update the extension property for your account:

Patch https://graph.microsoft.com/v1.0/me

{"extension_6d8190fbf1fe4bc38a5a145520221989_policy":"readwrite"}

Then create a claimsMappingPolicy:

Post https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies

{"definition":["{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true", "ClaimsSchema": [{"Source":"user","ExtensionID":"extension_6d8190fbf1fe4bc38a5a145520221989_policy","JwtClaimType":"policy"}]}}"],"displayName":"ExtraClaimsAllen1Example","isOrganizationDefault":true}

Assign the claimsMappingPolicy to a servicePrincipal. Please Note that the servicePrincipal here is the enterprise application which represents your third party application. In your case it is 0a7c94a0-0c4e-4f95-ba06-XXXX.

Post https://graph.microsoft.com/v1.0/servicePrincipals/{obeject id of the servicePrincipal which represents your third party application}/claimsMappingPolicies/$ref

{"@odata.id":"https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/{policy id from the previous step}"}

You could find the servicePrincipal from Azure Portal -> Azure Active Directory -> App registrations -> find your third party Azure AD app -> Overview -> click on the name of its associated service principal.

Now go back to the manifest file of the third party Azure AD app. Set acceptMappedClaims to true and accessTokenAcceptedVersion to 2.

Then when we request an access token for the third party application with ROPC grant flow, we can get the custom claim.