►
From YouTube: Token Customization in Azure AD - November 2020
Description
The Microsoft identity platform issues openid connect compliant tokens by default. You can choose to surface up custom claims in the issued tokens, and use those custom claims to make various decisions in your applications, such as authorization, lighting up different parts of the UX etc. In this month's call, learn from Sahil Malik how easy it is to customize the claims issued by AAD, and how your applications can benefit from it.
For more information, please visit
https://developer.microsoft.com/en-us/identity
To join additional monthly calls, download the calendar series at
https://aka.ms/IDDevCommunityCalendar
Stay connected
Twitter https://twitter.com/microsoft365dev
YouTube https://aka.ms/M365DevYouTube
Blogs https://aka.ms/M365DevBlog
A
A
The
api
can
validate
it
and
then
it
can
use
the
claims
present
in
the
access
token,
and
it
can
allow
or
deny
access
to
something
right.
So
typically,
you're
calling,
let's
say
microsoft,
graph
microsoft
graph
is
basically
like
a
big,
huge
rest
api
and
the
access
token
coming
in
you
know
the
microsoft
graph
needs
to
be
able
to
validate
it.
Now,
in
the
access
token,
there
could
be
number
of
things.
One
of
the
things
is
the
validity
of
an
access
token.
You
want
to
match
the
signature
or
validate
the
signature
of
the
access
token.
A
A
Then
you
have
refresh
refresh
tokens.
Are
long
live
tokens,
so
the
thing
with
access
tokens
are:
there
is
they're
like
cash.
It's
a
10
bill
you
find
on
the
road
anybody
who
picks
up
that
that
ten
dollar
bill
it
belongs
to
them.
So
there
are
some
new
things,
we're
working
on
like
proof
of
possession
which
go
to
some
extent
in
solving
that
problem,
and
also
there
is
cae
that
we
rolled
out
recently,
which
also
allow
you
to
shorten
this
gap
with
what
happens
if
there
is
a
access,
token
leakage.
A
So
there
are
some
things
coming
that
improve
that
picture,
but,
generally
speaking
with
the
open
id
connect
oauth
model,
you
know
access
tokens
if
somebody
picks
them,
it's
it's
theirs
to
use.
That's
typically,
the
scenarios
that
in
the
world
we're
living
in
today
and
the
the
classic
workaround
to
that
is
that
we
keep
access
tokens
short
as
far
as
time.
Duration
goes
so
azure
daily
access
tokens
are
approximately
one
hour
in
duration,
but
it's
actually
one
hour
five
minutes.
A
A
We
only
include
if
you
ask
for
offline
access
scope
and
also
there's
a
lot
of
fine
print
on
how
long
the
refresh
token
remains
valid
for
so,
for
example,
if
it's
a
confidential
client
application,
where
you
have
you
know
where
you
have
the
ability
to
store
secrets
securely,
then
you
know
we're
a
little
bit
more
liberal
in
giving
you
refresh
tokens
that
last
longer,
so
you
use
it
it
renews
and
so
on
and
so
forth.
Public
client
we're
a
little
bit
more
tight
on
that
and
pixie.
A
A
Why
would
you
need
a
new
access
token?
Maybe
the
previous
stoker
is
expiring,
but
that's
not
the
only
situation.
Maybe
you
need
a
new
access
token
for
a
certain
different
scope
right.
So
there
are
various
situations
in
which
you
need
a
new
access
token
that
doesn't
invalidate
the
previous
access
token,
but
it
prevents
the
user
from
seeing
a
login
screen
again
then
the
third
kind
of
token
that
is
the
id
token
and
the
purpose
of
the
id
token
in
openid
connect,
is
that
it
identifies
who
the
user
is
right.
A
Now
you
may
say:
well
an
access
token.
Can
I
also
has
a
user's
identity.
It's
true.
An
access
token
can
contain
a
user's
identity.
Optionally,
not
always,
however,
an
id
token
is
say
for
a
web
application.
You
sign
into
the
web
application
that
needs
to
know
who
is
the
user
signing
in
and
maybe
some
other
characteristics
about
them
and
that
that
is
the
purpose
of
an
id
token.
A
Now,
in
all
of
these
tokens,
the
challenge
is
that
a
refresh
token
is
pretty
much
like
an
opaque
string.
So
let's
exclude
that
an
access
token
can
be
opaque
or
maybe
not
a
pick
right
so,
but
for
the
api
that
gets
the
access
token.
The
api
needs
to
be
able
to
decode
it
and
make
sense
out
of
it.
So
if
I
am
the
audience
of
the
access
token
I
it
is
okay
for
me
to
unpack
it,
but
nobody
else
should
unpack
it.
So
for
others
it
is
opaque.
A
What
that
means
is
that
when
I
get
this
token
and
for
the
open
id
connect
spec
this
token
contains
very
little
information.
So
one
of
the
challenges
we
try
to
fight
is
that
we
don't
want
to
do
token
block.
We
don't
want
to
give
you
huge
tokens
because
they
have
other
disadvantages
performances,
advantages,
browsers,
various
firewalls
network
searches,
etc,
have
issues
with
them.
So
we
don't
want
to
give
you
like.
A
really
huge
token
and
that's
a
good
standard
open
id
connect,
basically
mandates
that
you
must
have
certain
properties
in
a
token
right.
A
These
are
things
that
you
absolutely
must
have,
but
then
it
says
optionally,
you
can
have
these
other
things
and
then
it
leaves
the
door
open
for
you
saying
that
you
know
there
are
other
tokens
you
can
have
as
well,
so
you
need
to
customize.
The
bare
minimum
set
of
tokens
may
not
contain
the
information
you
need.
So
the
question
is:
why
do
we
want
to
customize?
A
Maybe
you
want
to
include
certain
optional
claims,
for
example,
maybe
you
want
to
light
up
different
parts
of
your
application
depending
upon
who
the
customer
is
or
who
the
user
is
right,
or
maybe
I
mean
this-
this
can
get
really
crazy.
What
color
shirt
are
they
wearing
it's
very
contrived
scenario?
But
applications
are
you
know
they
are
very,
very
flexible,
and
sometimes
you
may
have
custom
information
in
a
custom
system
somewhere.
That
is
not
part
of
azure
id,
but
you
want
that
information
to
become
available
inside
the
token.
Why?
A
Because
then
you
can
drive
authorization
decisions
in
your
applications
now,
let's
think
of
this,
so
the
token
can
have
custom
claims
and
then
based
on
those
claims,
you
may
want
to
drive
authorization
decisions
or
maybe
you
want
to
light
up
different
parts
of
the
application.
For
example,
you
may
say
you
know
you
have
a
certain
claim
value
that
I
don't
so
you
will
be
shown
a
different
flow
that
I
won't
see.
Maybe
we
have
access
to
the
same
parts
of
the
application,
but
you
are
given
a
different
user
interface.
That's
quite
possible.
Perhaps.
B
A
User's
language
you
logged
in
from
let's
say
israel,
so
your
user
interface
will
automatically
change
to
hebrew
and
we
want
to
drive
that
decision
based
on
a
claim
value
that
you
have,
for
example
right.
So
there
are
different.
You
know
a
lot
of
examples
here
now
you
may
say
well.
Why
do
we
want
to
include
that
information
in
a
claim,
especially
authorization
decisions
should
be
done
just
in
time
right.
So
why
don't
I?
When
I'm
trying
to
light
up
a
button?
I
make
a
call
to
an
api,
and
then
I
get
authorization
decision.
A
You
know
that
server
may
not
be
available,
for
example,
that's
entirely
possible,
so
there
are
different
scenarios,
but
I
think
we
can
agree
that
there
is
value
in
being
able
to
put
custom
claims
inside
your
tokens,
so
naturally
this
is
an
ability
that
we
support,
and
this
is
what
I'm.
This
is
the
thrust
of
today's
presentation.
A
A
Very
clear,
so
claims
mapping
is
another
thing
that
we're
working
on
is
claims
transformation.
That's
generally
used
for,
like
saml
applications,
where
you
know
you're
moving
lob
apps
to
the
cloud,
and
you
want
certain
information
to
appear
somewhere.
So
that's
what
we
do
over
there,
but
when
we
talk
about
optional
claims,
it's
a
little
more
flexible
is
based
on
a
defined
schema
work
search.
Every
application
is
more
for
open
id
connect
and
that's
what
I'm
talking
about
today.
A
So
what
can
you
customize
when
it
comes
to
these
tokens
as
it
pertains
to
open
id
connect?
You
can
customize
the
id
token
and
you
can
customize
the
access
token.
Now.
The
user
interface
you'll
also
see
saml,
and
that
is
the
claims
mapping
part
that
I
was
talking
about.
So
yes,
technically
saml
tokens
are
also
customizable,
but
that's
not
a
new
capabilities.
We've
supported
saml
token
customization
through
policies
for
a
fairly
long
time.
Now,
today,
I'll
be
talking
about
customizing
id
tokens
and
access
tokens.
So
again,
an
id
token
is
intended
for
your
client
application.
A
Okay.
So
this
is
a
very
important
point
in
the
user
interface
of
azure
80.
You
have
to
tell
azure
ad
that
I
want
this
token
to
be
customized
right,
so
I
want
this
token
to
be
customized.
Where
do
I
specify
that
when
you
want
the
id
token
to
be
customized,
then
the
request
for
that
customization
goes
in
the
client
application.
A
A
In
this
token,
we
do
not
allow
that
change,
and
there
is
absolutely
no
reason
why
you
should
be
inserting
custom
claims
in
a
token
intended
for
microsoft
graph.
The
structure
of
this
token
is
the
decision
of
microsoft
graph
right,
so
microsoft
graph
is
the
audience.
For
this
token,
therefore,
the
aud
claim
has
the
guide
of
microsoft.
Graph
microsoft
graph
is
the
only
entity
that
should
be
unpacking
this
token
right.
Nobody
else,
everybody
else
should
treat
this
token
as
an
opaque
string.
A
This
is
a
very,
very
important
concept
that
I'm
talking
about
because
we
have
seen
over
and
over
again
where
people
customize
or
want
to
customize
this
token,
or
maybe
they
unpack
this
token
and
they
make
decisions
based
on
what
they
see.
In
this
token
now,
when
we
introduce
token
encryption,
which
is
a
best
practice
anyway,
actually
we
do
support
token
encryption
now,
but
at
some
point
we
will
turn
it
on
by
default.
Then
all
of
those
client
applications
that
are
unpacking
access
tokens
not
intended
for
them.
Those
applications
will
break
right.
A
A
How
do
you
customize?
It's
very
simple?
You
just
go
through
the
user
interface
there's
a
section
called
token
configuration
and
over
there
you
just
select
what
kind
of
token
and
what
claim
you
wish
to
see
and
you
check
that
checkbox
and
it
will
appear
in
the
output
claims
simple
as
that,
so
it's
not
complicated
to
customize
this
at
all.
Of
course,
this
can
be
done
through
the
api
as
well.
So
one
of
the
things
that
we
are
very
interested
in
now
I'd
love
your
feedback
on
this
as
well.
Is
that
going
forward?
A
If
there
are
scenarios
that
are
very
important
for
you,
that
you
think
you
need
apis
for
we
would
like
to
hear
from
you
so
before
I
dive
into
the
demos.
Let
me
quickly
go
through
the
questions.
The
first
question
was:
is
azure
access,
token
same
as
a
saml
2.0
token,
the
answer
is
no,
because
saml
2.0
is
entirely
different
flow.
A
It's
an
entirely
different
protocol.
Rather
so,
when
we
talk
a
modern
identity,
it's
a
little
bit
of
a
fuzzy
term
for
modern
identity,
you
can
say,
is
ws,
fed,
saml,
oauth
and
open
id
connect
right
and
maybe
down
the
road
distributed
identities.
So
ws
fan
and
saml
are
the
older
part
of
modern
identity.
Again,
this
word
modern
identity
is
is:
is
a
little
fuzzy,
samuel
and
wsfed
work
on
so
they're
intended
for
browsers
and
they're.
A
They
work
on
redirect
flows
and
saml
is
a
little
bit
more
flexible
and
both
of
these
protocols
have
been
arm
twisted
to
fit
in
native
applications,
mobile
applications
as
well.
The
way
both
of
these
protocols
work
is
that
there
is
a
concept
of
saml
claims
and
sample
token
format
and
the
application
or
the
identity
provider
communicate
with
each
other
say
hey.
A
I
think
you
are
such
and
such
person-
and
here
is
a
saml
token
to
prove
this
is
who
you
are
right
and
after
login
you
get
such
a
such
a
saml
token,
and
you
work
with
it
now
that
samuel
token,
the
format
of
that
is
entirely
different
from
what
an
access
token
is
supposed
to
be,
and
the
purpose
of
that
is
different
as
well.
Now
we
do
have
a
particular
flow
where
you
can
trade
in
a
saml
token
and
get
an
access
token
in
return.
A
So
obviously
there
are
a
lot
of
applications
that
have
a
lot
of
parallel.
They
say
I
want
to
log
in
using
saml,
but
I
want
to
call
microsoft
graph
and
in
scenarios
like
that
in
other
scenarios,
you
know
there
is
way
to
go
from
a
sample
token
to
an
access
token,
but
yeah
saml
token
and
access
tokens
are
essentially
different.
A
Okay,
so
I
think
the
next
question
also
answered
that,
so
we
have
a
use
case
for
an
application
to
validate
an
already
issued
access
token
on
multiple
workstations.
The
application
is
a
thick
client
and
available
on
multiple
stations.
Again,
the
application
is
not
an
api.
So
it
should
not
be
validating
an
access
token
right.
This
is
an
important
point
I
want
to
drive
home
today.
Is
that
an
access
token
should
be
validated
by
who
the
access
token
is
intended,
for
you
know
we're
happy
to
talk
further
into
the
specific
scenario
you
have
for
your
application.
A
Why
do
you
think
you
need
to
validate
it
on
multiple
workstations?
That
sounds
like
an
anti-pattern
to
me.
The
workstations,
the
client
applications
should
treat
that
access
token
as
an
opaque
string.
You
should
not
be
unpacking
it.
You
should
not
be
validating
it,
okay,
so
next
so
azure
tokens
are
used
by
oauth
or
open
id.
Okay,
you
can
think
of
open
id
as
sort
of
a
mature
next,
more
standardized
version
of
oauth.
So
oauth
is
not
an
authentication
protocol.
It's
a
it's
an
authorization
delegation
protocol
right.
A
So
what
I
mean
by
that
you
know
like
if
you've
ever
gone
through
one
of
these
new
sites-
and
you
know
you
see
an
article
that
has
an
incendiary
headline
and
there's
a
comment
section
down
there
and
and
you're
like
well.
I
must
share
my
valuable
comment
and
you
just
can't
type.
The
comment
there,
the
site
wants
you
to
log
in,
but
they
have
delegated
that
login
to
a
social
identity
like
twitter
or
facebook
right.
A
So
these
consent
screens
are
a
problem,
but
essentially
they
are
being
abused,
but
this
protocol
is
used
as
a
pseudo
authentication
protocol.
What
I
mean
by
that
is
they
ask
you
for
your
name:
okay,
that's
identity,
but
then
they
ask
for
a
whole
bunch
of
things.
They
don't
really
need
to
know
like
hey
we're
going
to
give
you
100
gigabytes
of
free
storage
in
our
fantastic
cloud
storage,
except
we
can
read
all
your
files.
So
it's
really
not
free
right.
A
So
my
point
is
that
oauth
had
a
way
to
you
know
tell
who
the
user
was,
but
every
identity
provider
had
a
different
way
of
doing
it.
What
open
id
connect
connected
is
that
it
sort
of
standardized
that
it's
it
introduced
the
concept
of
a
standard
claim
and
an
id
token,
which
must
have
the
user's
identity
in
a
certain
place,
so
different
applications
didn't
have
to
guess
like
live
used
to
have
something
called
as
pre
pid.
Pretty
id
facebook
had
fbi
d
right
so
and
they
were
literally
products
written
to
you
know
denormalize.
A
It's
a
future
moving
interaction
and
when
you
use
m
cell,
you
are
targeting
v2
endpoints,
and
that
is
why
we're
deprecating
it
l,
let's
see
so
in
oauth,
do
we
have
ssl
as
a
requirement?
Absolutely
you
must
have
ssl.
Otherwise,
some
a
man
in
the
middle
can
read
your
tokens
and
that
would
be
really
bad,
so
I
mean
we
can
have
redirect
url,
which
is
only
http,
but
we
should
use
https
redirect
uri.
Is
this
correct
approach?
Okay?
A
A
A
A
A
A
So
next
question
is,
but
this
claims
mapping
policies
application
specific.
Can
we
have
these
claims
available
for
all
apps?
The
answer
is
yeah.
You
would
run
a
script
and
you
can
easily,
through
a
script,
affect
all
your
applications.
What
we
don't
have
is
a
default
setting
where
you
say
any
new
application.
Your
in
your
tenant
will
automatically
get
such
and
such
claim.
We
don't
support
that,
but
you
can
build
it.
What
you
can
do
is
that
you
can
push
your
aad
logs
to
event
hub
and
through
event
hub.
A
A
So
in
short,
you
request
token
for
graph,
then
your
claims
mapping
won't
work
as
requested
when
the
token
is
for
graph
and
not
your
app.
If
you
want
custom
claims.
In
the
token,
you
should
request
the
token
for
your
api
right.
So
your
client
application
can
request
custom
claims
in
the
id
token,
but
it
cannot
request
custom
claims
in
an
access
token
intended
for
microsoft
graph,
but
it
can
request
custom
claims
in
an
access
token
intended
for
your
api.
A
Can
you
add
the
company
name?
Yes,
can
customizations
of
idea
access
tokens
be
done
for
multi-tenant
clients?
Yes,
so
if
you're
building
software
for
multiple
customers
across
multiple
azure
tents
with
this
approach
still
work.
Yes,
you
it's
just
an
application,
it'll
work
for
that
as
well.
In
fact,
you
can
do
even
one
step
further
say
I
will
request
a
custom
claim
from
only
this
tenant
and
this
other
tenant.
A
I
have
a
different
set
of
custom
claims,
so
you
have
that
option
as
well
is
token
configuration
available
in
the
app
registration
screens,
it's
not
during
the
app
registration,
but
it's
in
the
same
area.
I'll
show
you
the
demo
where
that
is
so.
I
can
share
my
use
case
offline.
That's
great,
just
email
me
please
and
yes
for
localhost
http
is
allowed
because
that's
for
dev
purposes
we're
not
aware
of
any
exploits
that
localhost
http
may
cause.
A
If
you
think
that's
a
matter
of
concern,
please
email
me,
but
localhost
http
is
something
we
allow
as
of
now,
because
if
you
did
https
will
make
developers
lives
a
little
harder
does
oitc
support
sso.
The
answer
is
yes,
so
there
is
nothing
baked
into
oidc,
which
says
this
is
how
you
do
sso.
It's
not
part
of
the
oitc
standard,
but
at
the
end
of
the
day
you
are
redirected
to
an
identity
provider
where
you're
expected
to
log
in
so
it's
a
web
page
that
shows
up
now.
A
A
B
A
This
link
over,
but
I
think
the
next
conversation
is
about
b2c,
some
that
may
be
a
better
place
for
that,
but
I'll
follow
up
on
that
stack
overflow
link.
How
can
I
implement
an
app
to
call
apis
of
different
audiences?
Do
I
need
different
tokens?
The
answer
is
yes,
you
need
different
tokens
because
the
token
has
an
audience
in
it.
So
when
you
request
a
token,
you've
asked
what
audience
you're
requesting
this
token
for
so
it's
in
the
process
of
asking
the
token.
A
So
it
would
be
great
if
you
can
change
the
sub
mapping
attribute
ob
in
b2c,
specifically
instead
of
having
down
okay,
so
sub
might
be
one
of
those
restricted
claims,
because
sub
is
subject.
I'd
love
to
know
why
you
want
to
change
the
subject
right.
So
please
share
your
use
case
with
me
on
why
you
want
the
sub
claim
to
be
modified,
but
that's
actually
one
of
the
things
that
you
know
I've.
I
I
have
some
mixed
feelings
about
like.
Why
do
why
do
you
want
to
change
that?
A
Could
you
request
only
part
of
custom
claims
defined
in
no,
when
you
say
that
an
id
token
has
these
five
claims
and
you
get
those
five
claims.
The
only
situation
in
which
you
won't
get
that
claim
is
if
there
is
no
value
there.
For
example,
I
ask
for
a
country
claim,
but
for
some
reason
a
certain
user
doesn't
have
a
country,
then
maybe
they're
from
the
international
space
station.
I
know,
but
then
we
won't
include.
That
particular
claim.
A
Does
ms
support
pacito,
I
don't
like
jar,
as
you
cannot
invalidate
it.
How
will
cae
invalidate
the
jar
token?
Okay,
we
have
some
very
good
guidance
on
cae.
It
works
in
parallel
with
conditional
access,
I'd
love
for
you
to
read
a
little
bit
more
on
that
and
give
us
some
feedback.
Why
do
you
think
that
won't
work
for
you
or
how
does
it
fall
short
of
positive
or
if
it
meets
your
needs?
A
So
I'd
highly
recommend
that
you
read
that
there
are
some
demos
we've
put
out
there
when
we
invalidate
a
user
sign
in
and
immediately
that
act,
their
access
is
revoked
like
in
a
matter
of
seconds.
So
I
think
it's
a
very
compelling
it's
it's
a
very
compelling
argument.
Now,
there's
a
point
c
only
works
a
few
apps.
That
is
correct.
A
However,
we
do
have
every
intention
of
expanding
that
set
of
apps,
including
through
your
custom
apps
at
some
point,
but
yes
pulled
it
out
to
first
party
apps
for
now
so,
but
stay
tuned
on
that
cae
will
move
very
fast.
I
think
you'll
see
in
the
next
six
months,
there'll
be
a
lot
of
good
changes
coming
there
awesome,
okay.
So
let's
move
into
demo.
A
So
let's
talk
about
adding
a
custom
claim
in
an
id
token,
so
with
this
I'll
switch
into
demo
mode
and
let's
go
into
my
azure
portal,
so
here's
my
azure
portal
you've
seen
this
before
it's
my
azure
ada
app
registration
area.
As
you
see
here,
I
went
to
azure
active
directory
app
registrations
and
I
have
a
few
apps
here
for
the
purposes
of
this
demo.
These
are
the
two
apps
I'll
be
talking
about
token
cost
web
app
token
cost
api,
and
this
is
my
backup,
just
in
case
murphy
loss
kicks
in.
A
But
let's
hope
that
doesn't
happen.
So
this
here
is
my
web
application.
What
I
went
is,
you
know,
just
created
a
new
registration
and
then
I
went
to
the
authentication
tab
and
I
went
ahead
and
specified
a
redirect.
Uri
added
a
platform
web,
so
it'll
be
a
web
application
I'll
use,
although
this
will
work
with
any
kind
of
application.
A
A
Then
we
go
to
token
configuration
and
this
let
me
go
ahead
and
this
for
now
so
by
default
like
when
you
create
a
new
web
application,
it'll
look
like
this.
There
will
be
no
optional
claims
here
right.
So
with
that,
let
me
go
ahead
and
run
this
web
application,
so
I
already
have
written
this
code,
but
this
code
is
basically
something
I've
downloaded
from
our
samples
and
it
is
just
a
web
application.
So
there
are
two
projects
in
here.
B
A
Is
using.net
3x,
although
it'll
work
with
net
5x
as
well?
So
this
is
a
to-do
list.
Client,
and
this
is
a
to-do
list
service
it.
It's
calling
the
world's
most
important
application,
which
is
a
list
of
to-do's
right,
and
it
has
a
controller
that
I've
added
here
called
to-do
list
controller
where
we'll
actually
make
a
call
to
the
api,
but
for
the
first
demo,
I'm
interested
in
only
id
token.
A
So
what
I
did
is
that
we
don't
need
to
worry
about
to-do
list
controller
yet,
but
what
I
did
is
that
I
went
to
views
and
I
went
into
index.html-
and
I
added
this
section
here
which
says
if
the
user
is
authenticated,
then
iterate
through
their
claims
and
just
write
out
the
claim
values
I
see
here
right.
So
whatever
azure
id
is
returning
me
in
the
id
token.
I
am
writing
out
the
claims
for
the
user
that
I
see
simple
as
that.
A
So
let
me
go
ahead
and
run
this,
so
let
me
run
the
project
and
give
it
a
second
now
for,
for
my
demos,
I'm
going
to
use
a
different
browser,
so
we
can
see
exactly
who
we
are
signing
in
as
so.
This
is
chrome
edge
and
let
me
visit
the
url
for
the
application
and,
as
you
may
expect,
it'll
ask
me
to
sign
in
so
I'll
go
ahead
and
sign
in
so
I'm
signing
in
as
a
live
account.
So
no-
and
these
are
the
claims
I
see
right
so
aio,
name,
etc,
etc,
etc.
A
Right
now,
I
don't
see
a
country
claim
in
here
ctry.
I
don't
see
that
yet.
So
what
I'm
going
to
do
now
is
that
I'm
going
to
go
back
into
my
app
registration
here
for
the
same
application
and
I'm
going
to
add
an
optional
claim.
So
I
add
an
optional
claim
now,
which
one
should
I
pick
it'll
be
the
id
token,
because
I
am
requesting
a
new
token
for
this
application.
So
the
user's
identity
must
have
this
new
claim,
so
I'll
click
id
token
and
I'll,
say
country
I'll
hit.
A
A
Because
I
in
in
just
refreshing
I
am
just
re-establishing
working
on
the
session
that
is
established
between
my
browser
and
the
web
server,
I'm
not
going
back
to
azure
ad,
so
I
have
to
go
through
a
full
sign
sign
out
process
to
get
a
new
claim,
because
that
is
what
will
give
me
a
new
id
token.
So
let
me
go
ahead
and
hit
sign
out.
A
A
A
A
So
let's
go
look
at
my
app
registrations
again
and
in
my
app
registrations
I
have
a
token
cast
web
app
and
a
token
cast
api,
so
this
web
app
is
going
to
call
this
api
and
if
I
look
here
in
the
tokencast
api,
I
have
an
exposing
api
section
in
which
I've
set
up
an
app
id
uri
and
I
have
set
up
a
scope
access
as
user.
It's
a
delegated
scope
and
inside
of
my
web
application
under
api
permissions.
A
I
have
already
added
and
granted
consent
for
that
particular
scope
right,
so
the
permissions
are
already
set
up.
I
have
also
set
up
a
secret
here
because
I
need
the
secret
as
a
confidential
client,
to
ask
for
an
access
token,
so
that
I'll
be
asking
for
an
access
token,
for
this
token
cost
api,
and
if
I
go
into
token
configuration
this
is.
This
was
just
me
rehearsing
the
demo.
So
let's
remove
this
so
here
we
go
so
right
now,
I'm
not
asking
for
any
optional
claims.
A
So
now
I'm
going
to
go
back
into
my
project
here,
which
is
still
running
and
I'm
going
to
go
back
into
the
browser
and
if
I
click
this
to
do
list,
what
it
will
do
is
that
it
will
run
this
to-do
list
controller
and
eventually
it
is
going
to
run
this
service
to-do
list
service
and
there's
a
whole
bunch
of
code
here.
But
this
is
the
line
we're
interested
in
is
that
it
will
get
an
access
token
for
the
to-do
list,
scope
right.
A
So
when
I
ask
for
an
access
token,
I
specify
what
scope
that
answers.
Your
previous
question
of
you
know
if
I
want
to
ask
for
an
access
token
for
graph.
I
would
just
put
a
graph
scope
in
here,
so
I'm
going
to
ask
for
an
access
token,
and
then,
when
we
get
the
access
token
it'll
be
a
string.
We
will
hit
this
breakpoint
and
then
we
can
examine
what
that
token
looks
like.
A
So
that's
the
access
token
and
let
me
go
ahead
and
decode
it.
So
there's
a
site
we
have.
There
are
many
ways
to
decode
it,
but
here's
a
site
we
have
which
allows
you
to
decode
it.
And
if
I
look
at
this
access
token
so
again,
because
I
had
already
signed
in,
let
me
sign
in
and
sign
out,
you
know
like
this
was
sorry
the
democrats
playing.
I
should
have
deleted
those
customizations,
so
let
me
go
ahead
and
hit
play
and
I'm
gonna
go
ahead
and
sign
and
sign
out.
A
A
A
Let
me
actually
do
that,
let's
one
more
try
and
if
it
doesn't
work
we'll
move
along,
I
think
the
m
cell
cache
is
messing
things
up
like
we
have
caching
build
on
the
server
in
msl,
and
that
is
causing
this.
But
it's
okay.
Like
can
we
see
these
problems
and
if
you
ever
run
into
these
in
your
dev
environment,
you'll
know
why
so,
let's
go
ahead
and
visit
that
same
url
again,
google
hosts
44321.
A
A
Record
this,
oh
so
something's
wrong
with
my
demo
I'll
explore
that
offline
later.
But
the
idea
over
here
is
that
in
the
api
you
know,
if
I
don't
request
for
an
ip
address,
I
shouldn't
see
one.
I'm
not
sure
why
we're
getting
one.
Let
me
just
do
one
last
try
here,
I
said:
don't
fix
things
on
the
fly,
but
let's
do
it
anyway.
Let
me
sign
in
as
a
different
user.
Maybe
that
that'll
invalidate
the
cache
there's
a
cache
that
is
causing
this
problem,
so
let
me
sign
in
as
an
entirely
different
user.
A
Sign
in
and
to-do
list
access
token
hold
on,
let's
copy
this.
This
should
be
a
it's
like
a
I
test
to
try
and
copy
this
access
token,
and
if
you
don't
move
that
fast
enough,
the
tooltip
gets
in
the
way
so
access
token
and
let's
go
ahead
and
decode
it
paste
and
I
still
see
ip
address.
So
I'm
not
sure
why
it's
going.
It
might
be
some
caching
built
in
there,
but
I
did
remove
it
so,
but
that's
that's
the
theory
that
I
think
something's
wrong.
A
It
might
be
some
caching
built
in
there,
but
that's
the
theory
that
checking
that
check
box
here.
So
I
go
to
optional
claims
in
the
api
and
choose
access
token
here.
That
should
include
that.
Actually,
okay,
let's
see
how
much
time
we
have
because
there's
one
more
demo
I
want
to
go
through,
but
we
could
just
check
another
token
here
so
for
okay,
let's,
let's
just
do
it
so
id
type
token,
so
whether
this
is
an
app
only
token
right,
so
that's
a
new
one.
We
introduced
recently
so
just
introduce
a
brand
new
claim.
B
A
A
A
No,
it
doesn't
show
because
not
yeah.
So
sorry,
this
demo
didn't
work,
but
the
the
theory
here
is
that
the
ip
address
claim,
if
I
just
gave
it
some
time,
it'll
it'll
go
away,
but
it's
a
caching
issue
on
a
d
side.
So
that's
what's
going
on.
Okay,
let's
move
to
the
next
demo.
So
there's
some
comments
here:
let's
quickly
read
through
them.
A
So
if
the
ad
application
is
delegating
permissions
to
another
application
which
of
the
two
applications,
should
we
add
the
optional
claims,
so
I
believe
you're
talking
about
here
for
the
api,
so
I
mean
I
think
you
need
a
little
more
clarification
on
the
question
as
in.
Are
you
talking
about
on
behalf
of
flow?
A
There
is
no
user
endpoint
in
aadb
to
see
why
can't
microsoft
make
it
simple
to
call
graphapp
from
b2c
for
such
simple
things,
you
have
to
struggle
so
okay,
so
we
don't
have
the
ability
right
now
that
you
log
into
aadb
to
c
and
call
graph
under
delegated
permissions
right,
because
the
idps
are
different.
So
graph
is
an
api
secured
by
azure
80,
whereas
azure
ad
b2c
is
for
all
practical
purposes,
a
different
idp.
So
that's
why
we
don't
accept
those
tokens.
A
So
I
like
the
fact
that
b2c
customers
have
no
permissions
in
the
directory.
Yeah
keeps
things
clean.
What
consideration
should
be
kept
in
mind
when
doing
sign
in
sign
out
in
the
same
browser
session?
Tab
with
sign
out
so
sign
up
is
a
pretty
involved
topic
because
you
have
to
think
of
it.
This
way,
am
I
signing
out
of
my
application,
or
am
I
signing
out
of
all
the
applications
right?
Am
I
also
invalidating
your
refresh
token?
A
A
When
will
msl
libraries
support
pc
ground
flow,
we
already
do
so
m
cell
browser
already
supports
pixi,
mcel,
angular
and
m
cell
react
are
in
preview.
Currently
we
call
it
private
preview,
but
the
github
wrapper
is
open
and
they
do
support
pixi
they're,
not
something
that
we
bless
for
production
use
right
now,
because
they
are
preview
but
you're
welcome
to
go
and
try
those
as
well.
A
A
A
Okay,
let's
go
to
the
the
last
demo
here
now.
One
of
the
challenges
we've
seen
so
far
is,
if
I
go
into
portal.azure.com
and
I
try
to
add-
let's
go
ahead
and
get
rid
of
this
and
let's
go
back
to
the
token
cost
web
app.
If
I
go
to
token
configuration
and
thank
you
so
there's
a
so
there's
a
partial
way.
Yes,
that's
a
way
to
do
it,
but
if
an
application
wants
to
do
it,
then
you
can
there's
a
microsoft
graph
call
as
well.
A
So
certainly
the
powershell
wave
will
work,
but
there's
a
microsoft
graph
call
as
well.
So
if
I
add
an
optional
claim,
let's
pick
id
token,
what
do
I
see
here?
It's
a
bunch
of
check
boxes
right,
there's
a
whole
bunch
of
check
boxes
here
and
what,
if
I
wanted
to
introduce
a
completely
custom
claim
like
user's
preferred
cuisine?
A
A
Maybe
you
have
a
huge
sql
server
database
that
has
authorization
decisions
in
it
and
you
want
to
drive
those
authorization
decisions
from
that
sql
server
database
and
but
you'd
like
those
claim
values
to
show
up
here.
How
can
we
do
that?
The
answer
for
that
yeah.
So
thanks
the
link
is
user
revoked
sign-in
sessions
yeah
there
you
go
so
and
I'll
get
to
that
other
question
in
a
second
neil.
A
A
There
are
two
ways
to
set
up
extension
attributes
either
you
can
send
it
through
point
and
click
in
azure
ad
connect.
Why
would
that
be
useful?
Hey
we
have
this
attribute
in
our
active
directory
and
we
want
that
claim
to
appear
in
azure
ad
issued
tokens
so
through
aedconnect.
You
can
do
this
mapping
to
an
extension
attribute
and
it'll
show
up
here
or
another
way
to
do
it
is.
If
you
want
more
programmatic
control,
then
we
also
support
setting
up
extension
attributes
on
using
microsoft
graph.
A
A
So
I
need
to
create
an
extension
and
for
the
the
first
thing
I'm
going
to
need
is
an
access
token.
So
let
me
fire
up
my
terminal
and
grab
access
token.
So
I'm
just
going
to
use
azure
cli
to
get
me
an
access
token
and
this
little
script
that
I
have
will
will
give
me
an
access
token.
If
you're
interested
in
what
this
script
looks
like
it
looks
like
this
get
token.sh,
so
basically
there's
a
command
in
azure
cli.
That
gets
me
an
access
token.
I
am
logged
into
azure,
cli
and
azure.
A
Cli
is
an
app,
so
this
access
token
is
okay
to
be
used
under
my
credentials
for
all
the
apps
that
this
particular
azure
cli
app
registration
has
access
to
and
if
you're
interested
in
what
that
access
token
looks
like
and
what
is
the
scope
for
that?
Obviously
graph
is
part
of
that,
but
this
is
what
my
access
token
looks
like
right,
so
I'm
going
to
call
graph.
So
this
token
will
work
for
graph.
So
that's
great!
Now
I'm
going
to
save
this
access
token,
because
I
will
use
it
multiple
places.
A
So
let
me
go
ahead
and
put
this
in
notepad
and
put
it
on
the
side
here.
Let's
dive
back
into
postman-
and
there
is
a
you
know-
call
we
support
where
we
go
to
microsoft
graph.
We
want
auto
applications.
This
needs
to
be
the
object,
id
not
client
id
of
the
application
where
I'm
making
this
modification.
A
So
let
me
grab
that
object
id.
So
that's
the
object
id,
let's
put
it
here
and
slash
extension
properties,
hopefully
no
typos,
and
if
I
go
to
body
this
is
the
body
I'm
sending
now.
I
just
need
to
put
authorization
information,
which
was
my
access
token.
So
let
me
drop
the
access
token
that
I
just
got
and
hit
send
now
when
I
get
this
output.
This
is
sort
of
confirming
for
me
that
a
new
extension
property
or
attribute
has
been
created
for
me.
Now,
I'm
going
to
need
this,
do
it
shortly.
A
So
what
I'm
going
to
do
is
that
this
output,
I'm
going
to
save
it
in
another
instance
of
notepad,
and
you
know
this.
You
can
obviously
execute
another
get
request
and
find
what
extension
attributes
you
have.
But
since
I
have
this
information
right
here,
I'll
just
save
this
keyword.
So
let's
put
this
on
the
side.
A
So
that
particular
extension
attribute
that
I
created
I'm
going
to
get
the
right
name
for
it
here
like
this,
and
here
is
the
value
I'm
setting
and
I'm
making
a
call
to
graph.microsoft.com
v1
users,
and
this
is
the
user
I'm
setting
this
value
on.
I
need
to
pass
in
an
access
token
as
usual.
So
let
me
go
ahead
and
put
the
right
access
token
there
and
hit
send.
Now
I
get
a
204,
no
content.
A
A
Now
that
I
have
created
this
extension
attribute
now
I
go
into
token
configuration
and
add
an
optional
claim.
Choose
id
token.
That
extension
attribute
automatically
shows
up
here
right.
That's
how
simple
it
is.
So
I
just
created
an
extension
attribute.
It
shows
up
here,
let's
go
ahead
and
check
this
checkbox
and
hit
add
right,
and
if
you
notice
that
when
I
executed
the
value
here,
what
value
did
I
specify
the
value
was
just
some
value
right.
A
So
now
I'm
going
to
sign
in
as
the
user
on
which
I
created
this
value
and
let's
see
if
that
shows
up,
because
I
I
have
put
that
customization
in
so
let's
go
ahead
and
hit
this
play
button
here
I
can
share
all
the
code
with
you,
so
all
the
postman
collection
this
code-
I
can
share
all
of
that,
so
I'll
just
share
with
steven
he'll
he'll
find
a
way
to
get
it
to
you.
So
let
me
go
ahead
and
sign
in
here
and
sign
out.
Let's
request
a
new
access,
toke
id.
A
Token,
so
that's
the
user.
I
had
created
that
particular
extension
attribute
on
and
there
you
go,
and
this
is
how
you
can
insert
literally
any
arbitrary
value
inside.
Of
course,
we
don't
do
things
like
support
multi-valued
extension
attributes
because
we
don't
want
token
blur
right,
but
this
is
very
powerful,
as
you
can
imagine.
A
A
What
should
be
considered
b2b
versus
multi-tenant
apps,
on
designing
solutions
with
microsoft,
iot
any
pros
and
cons
a
multi-standard
app.
Is
you
know
when
you
you
write
an
app?
You
want
it
to
be
available
in
not
just
your
tenant,
but
other
tenants.
That's
the
scenario
for
that.
So
I'm
again,
I
highly
suspect.
I'm
missing
some
finer
detail
here,
but
again,
please,
you
know,
feel
free
to
elaborate
on
your
question.
A
A
I
can
send
you
the
open
source
repo
that
we
reference
so
that
that'll
work
when
to
use
the
dot
default
scope.
I
think
you're
talking
about
dot
default
scope
when
requesting
access
token
there's
a
documentation
page.
We
have
on
that.
We
are
we're
trying
to
make
it
a
little
bit
better,
but
you
know
again
shoot
me
an
email,
I'll
email,
you,
the
document
page
that
we
have
in
there
is
the
postman
collection
available
anyway.
So,
yes,
we
will
make
it
available.
Is
it
a
plan
to
build
a
ui
for
managing
extension
attributes?
A
There
is
a
plan.
I
don't
know
where
it
is
in
the
priority
list,
but
there
is
a
plan.
I
don't
have
an
etf
for
you.
However,
I
I
think,
if
you
look
at
the
postman
collection,
it's
not
hard
to
do
it
through
the
api
as
well
and
I'll
share
all
the
code
with
you.
So
even
if
you
have
to
build
a
ui
on
this
yourself,
it's
a
matter
of
it
I
mean
depends
on
the
developer.
You
should
be
able
to
do
it
in
a
few
hours
in
my
multi-tenant
web
application.
A
A
So
in
my
multi-tenant
web
app,
I
can
only
inject
my
custom
claims
into
the
claims
principle
as
a
part
of
oidc
token
validated
login
event.
I
sometimes
need
to
do
this
after
the
login
event.
Okay,
after
you
request
for
a
new
id
token
and
you
do
a
single
sign-in.
So
that's
the
that's
the
only
way.
Unfortunately
so
do
I
need
to
be
effectively
a
tenant
admin
to
create
an
extension
attribute.
A
So
I
don't
know
what
the
permissions
are.
But
here
is
a
here's,
an
easy
trick
to
find
out
what
permissions
you
need.
So,
for
example,
I'll
show
you
this
generically,
so
you
go
to
microsoft,
so
let's
go
to
graph
explorer
aka
dot,
ms
slash
ge
and
you
just
basically
paste
in
any
api
you're
interested
in
here,
for
example,
create
extension
attributes.
A
So
I'm
going
to
paste
this
here
and
when
I
do
that
and
I
go
to
modify
permissions,
it
tells
you
what
permissions
you
need.
So
this
is
not
based
on
your
our
back
role.
It
is
based
on
these
permissions
unless
you
use
delegated
permission
and
here
you'll
see
that
it
also
ranks
these
permissions
in
a
low
to
high.
So
just
pick
the
least
available
permission,
it
also
tells
you
which
one
needs
admin
concerns.