Claim not found in custom policy for Azure B2C - Saml

Question

I've uploaded my custom policy starting from SocialAndLocalAccounts template in my Azure AD B2C. I've changed the policy to get authentication with SAML protocol as documented in MS Documentation

This is the claim provider added in TrustFrameworkExtensions.xml file

<ClaimsProvider>
  <DisplayName>Token Issuer</DisplayName>
  <TechnicalProfiles>

  <!-- SAML Token Issuer technical profile -->
  <TechnicalProfile Id="Saml2AssertionIssuer">
    <DisplayName>Token Issuer</DisplayName>
    <Protocol Name="SAML2"/>
    <OutputTokenFormat>SAML2</OutputTokenFormat>
    <Metadata>
      <Item Key="IssuerUri">http://localhost:8080/spring-security-saml2-sample</Item>
    </Metadata>
    <CryptographicKeys>
      <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      <Key Id="MetadataSigning" StorageReferenceId="B2C_1A_SamlIdpCert" />
    </CryptographicKeys>
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="subject" />
    </InputClaims>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="issuerUserId" />
      <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="first_name" />
      <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="last_name" />
      <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
      <OutputClaim ClaimTypeReferenceId="email"  />
      <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="myIDPName" />
      <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
    </OutputClaims>
    <OutputClaimsTransformations>
      <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
      <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
      <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
      <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
    </OutputClaimsTransformations>
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer"/>
  </TechnicalProfile>

  <!-- Session management technical profile for SAML-based tokens -->
  <TechnicalProfile Id="SM-Saml-issuer">
    <DisplayName>Session Management Provider</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.SamlSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
  </TechnicalProfile>

  </TechnicalProfiles>
</ClaimsProvider>

And this is the RelyingParty in my B2C_1A_signup_signin_saml policy.

<RelyingParty>
<DefaultUserJourney ReferenceId="SignUpOrSignIn" />
<TechnicalProfile Id="PolicyProfile">
  <DisplayName>PolicyProfile</DisplayName>
  <Protocol Name="SAML2"/>
  <Metadata>
    <Item Key="PartnerEntity">https://mydomainurl.url/spring_saml_metadata.xml</Item>
  </Metadata> 
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="displayName" />
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="surname" />
    <OutputClaim ClaimTypeReferenceId="email"/>
    <OutputClaim ClaimTypeReferenceId="identityProvider"/>
    <OutputClaim ClaimTypeReferenceId="objectId"/>
    <OutputClaim ClaimTypeReferenceId="issuerUserId"/>
  </OutputClaims>
  <SubjectNamingInfo ClaimType="objectId" ExcludeAsClaim="true"/>
</TechnicalProfile>

When I try to login with a spring-saml application that I use for test I've got this error:

Caused by: org.opensaml.common.SAMLException: Response has invalid status code urn:oasis:names:tc:SAML:2.0:status:Responder, status message is Id:d5cae994-9df6-44a2-9044-ed1c108152dc; Message: A claim with id 'issuerUserId' was not found, which is required by ClaimsTransformation 'CreateAlternativeSecurityId' with id 'CreateAlternativeSecurityId' in policy 'B2C_1A_signup_signin_saml' of tenant 'supplauthtestcom.onmicrosoft.com'. at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:113) at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:82)... 31 more

I've thought the problem was issuerUserId mapping, but when I've added the setting nothing changed.

Any suggestion on how resolve this error?

Answer 1

Change Saml2AssertionIssuer technical profile to

    <TechnicalProfile Id="Saml2AssertionIssuer">
      <DisplayName>Token Issuer</DisplayName>
      <Protocol Name="SAML2"/>
      <OutputTokenFormat>SAML2</OutputTokenFormat>
      <Metadata>
        <Item Key="IssuerUri">http://localhost:8080/spring-security-saml2-sample</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
        <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      </CryptographicKeys>
      <InputClaims/>
      <OutputClaims/>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-Saml-issuer"/>
    </TechnicalProfile>

Remove this from <RelyingParty> section:

<OutputClaim ClaimTypeReferenceId="issuerUserId"/>

Add this to before the <RelyingParty> section, if not already present:

<UserJourneys>
  <UserJourney Id="SignUpOrSignIn">
    <OrchestrationSteps>
      <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="Saml2AssertionIssuer"/>
    </OrchestrationSteps>
  </UserJourney>
</UserJourneys>

Answer 2

After several attemps I found the solution in a wrong configuration of another ClaimProvider configuration that the custom policy uses to connect to an external IDP to obtain the authentication. After changing issuerUserId mapping to of that ClaimProvider, my app started to work fine.

I think that the problem was that Saml2AssertionIssuer was getting the wrong value of issuerUserId