Azure Active Directory SAML2.0 身份验证的用户属性映射 web 应用程序

Question

I've deployed two app registrations in Azure for external sites that our organisation uses our Azure AD tenant as the identity provider for. I've got the SAML2.0 authentication working fine, but the only user profile attributes it's mapping are UID, UPN, FirstName and LastName. I'd like to try to map some additional AAD profile attributes - specifically jobTitle and physicalDeliveryOfficeName (which in MS Graph is officeLocation).

According to https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims#directory-extension-formatting , I thought I could modify the App manifest by using something similar to my screenshot below, but when I save it I look at the "Token configuration" and see those two claims with a warning " the claim is not supported and will not be returned in the token ".

My intention was that I'd then use http://schemas.microsoft.com/identity/claims/extn.officeLocation and http://schemas.microsoft.com/identity/claims/extn.jobTitle in the Attribute mapping settings of the apps we use, but this is not working either.

I need some help as this is out of my area of expertise and the app developers have not been able to assist.

Answer 1

You need to create the custom properties officeLocation and jobTitle in the Azure AD application (app registration) which you are trying to configure "Token configuration" in.

You get the warning "the claim is not supported and will not be returned in the token" because the custom properties are created in another Azure AD application.

You can create the extensionProperty through Microsoft Graph like this:

Post https://graph.microsoft.com/v1.0/applications/{object id of the Azure AD application}/extensionProperties

{"name":"jobTitle","dataType":"string","targetObjects":["User"]}

Then you will see the extn.jobTitle in Token configuration under your Azure AD app. You can directly select it by clicking Add optional claim .

You are also able to edit the manifest to add it now.