B2C 的 givenName 和 surname 声明有什么特别之处吗？ 无法从 OIDC ClaimsProvider 读取它们

Question

My OIDC claims provider (Okta) provides the given_name and family_name values to my OIDC test harness app.

My Azure B2C claims provider uses the same scopes as my test app, but I can't get the given_name and family_name to be added to the B2C claim,

Scopes used when calling Okta CP:

<Item Key="scope">openid profile email</Item>

OutputClaims mapping in Okta CP:

<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" DefaultValue="default value from input ClaimsProvider: email"/>
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" DefaultValue="default value from input ClaimsProvider: givenName"/>
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="family_name" DefaultValue="default value from input ClaimsProvider: surname"/>

This configuration doesn't seem to get the values for these two claims. It does get the "name" and "email" values, so I feel confident the scopes are being honored. Using DefaultValues to debug, I see this in the Azure SAML test app.

SAML Login Success
Attribute   Value
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress  JoeBlow@xyz.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name  Joe Blow
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname default value from input ClaimsProvider: givenName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname   default value from input ClaimsProvider: surname
http://schemas.microsoft.com/identity/claims/userprincipalname  JoeBlow@xyz.com

Answer 1

Might be to late for the OP, but we just ran into this as well. It took us quite a while to find a solution.

• Problem was not (in our case) the Azure AD B2C policy.
• But instead the issue was with the Azure AD app registration (used for Ms + AAD accounts).
• family_name + given_name are optional claims

For those claims to be returned two things need to happen:

• profile scope must be requested
• configure the Azure AD app registration to return these 2 optional claims
  • This was the step we were missing

Here is the link to the doc explaining how to ensure an Azure AD app registration returns optional claims (its straight forward and only took 1min todo):
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims?WT.mc_id=AZ-MVP-5003445#configuring-optional-claims