Azure Active Directory B2C：如何查询 MS Graph 以获得用户的备用安全 ID？

Question

B2C uses an alternative security ID to uniquely identify users from social accounts. We have a problem where a user enters credentials for a user, but somehow B2C authenticates the user as someone else. I suspect the IDP is returning bad claims data or the alternative security IDs are the same. How do I view the alternative security ID of a user in Active Directory?

I tried the following MS Graph query trying all the attributes I can think of (including the ones listed in this article ), but graph doesn't return data for these attributes.

https://graph.microsoft.com/v1.0/users/<userId>?$select=id,alternativeSecurityId,alternativeSecurityIds,extension_<b2cExtensionAppId>_alternativeSecurityId,extension_<b2cExtensionAppId>_alternativeSecurityIds

Thanks in advance!

Answer 1

AlternativeSecurityId for a B2C user is found in the Identities collection via MS Graph API.

The AlternativeSecurityId claim used in the B2C policy maps to the Identities: issuerAssignedId value for the corresponding issuer.

Eg, for issuerAssignedId: 123 (id from google token) from issuer: google.com

  "identities": [
    {
      "signInType": "federated",
      "issuer": "google.com",
      "issuerAssignedId": "123"
    }
  ],

You can return the identities collection by calling the /users endpoint of MS Graph API. https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http