How to add additional claims to ID Token - Azure G

问题:

I'm trying to overload the OAuth ID Token by adding additional claims. I can already use the Graph API to get the claims that I need but I would like to understand if it's possible to add the additional claims directly into the ID Token? I've updated the manifest by adding the required claims in and then flipping "acceptMappedClaims" to true, however I still don't see these in the ID token. What am I missing?

"optionalClaims": {
    "idToken": [
      {
        "name": "employeeid",
        "source": "user",
        "essential": true,
        "additionalProperties": []
      },
      {
        "name": "mail",
        "source": "user",
        "essential": true,
        "additionalProperties": []
      }
    ],
    "accessToken": [],
    "saml2Token": []
  },
  "acceptMappedClaims": true,

回答1:

This depends on where the ID token is generated from. If it's on-premises AD and federated identity is used take a look at Customizing the OIDC id_token in ADFS 2016.

If it's just a cloud identity I'd take a look at the second link jwmiller5 posted or this one: how-to-set-claims-from-asp-net-openid-connect-owin-components.

Hope this helps, Bernie

回答2:

If you are trying to add additional claims into your AD token, you would need Azure AD premium and you can add the values as attributes. See Claim augmentation with Azure AD authentcation

If you just need the claims in one particular application, you can add the claims in the app itself. See Azure AD PostAuthentication add claims