在 Azure AAD oauth 身份验证中使用 saml 令牌

Question

I have an application that authenticates users agains Azure AD using OAuth and I want to provide the ability to setup certain information associated to each user by his admin in Azure AD, so I can read it as part of the authentication process. I would also like to be able to use the claims functionality provided by Azure ActiveDirectory so the admin can define custom mappings between user attributes in his AD and what I am going to read, as explained here .

Apparently those claims can only be read from a SAML token that would be the result of a SAML authentication, but since I am already authenticating using OAuth I would like to avoid having to do that. My question therefore is: can those SAML tokens or the information contained in them be obtained somehow either as part of the OAuth authentication process or afterwards?

Answer 1

When you say "provided by ActiveDirectory" you mean Azure AD not on-premises AD?

There is no way currently to add claims to the token in Azure AD. They are "canned".

That link you refer to is for SaaS application in Azure.

The way to get information out of Azure AD is via the Graph API.