Is your question related to a specific version? If so, please specify:
v4 Out-of-process (isolated)
What language does your question apply to? (e.g. C#, JavaScript, Java, All)
C#
Question
I'm running a function app with EasyAuth enabled and set up to use B2C AD as an OpenID provider. In case of server-directed sign-in after the user has completed the authentication, I check X-MS-CLIENT-PRINCIPAL header and get access to the token containing claims collection, including B2C userId and emails. But when using client-directed sign-in flow the same header contains a different set of claims (actually there is only sid that is somehow related to the user). It looks like the token in the second case is based on X-ZUMO-AUTH header, but not on the id_token I had provided earlier during the authentication flow.
I found previously there was a similar issue #4212. There was mentioned a feature that properly filled in the ClaimsPrincipal disregarding which flow (client-directed or server-directed) had been selected. However, the same comment mentions the feature was rolled back somewhen in 2019.
The actual question is: is there a way to get access to the client id token and its claims from the functions app code after the client completed the client-directed sign-in?
The token I get from the header in case of client-directed sing-in:
Is your question related to a specific version? If so, please specify:
v4 Out-of-process (isolated)
What language does your question apply to? (e.g. C#, JavaScript, Java, All)
C#
Question
I'm running a function app with EasyAuth enabled and set up to use B2C AD as an OpenID provider. In case of server-directed sign-in after the user has completed the authentication, I check
X-MS-CLIENT-PRINCIPAL
header and get access to the token containing claims collection, including B2C userId and emails. But when using client-directed sign-in flow the same header contains a different set of claims (actually there is only sid that is somehow related to the user). It looks like the token in the second case is based onX-ZUMO-AUTH
header, but not on the id_token I had provided earlier during the authentication flow.I found previously there was a similar issue #4212. There was mentioned a feature that properly filled in the ClaimsPrincipal disregarding which flow (client-directed or server-directed) had been selected. However, the same comment mentions the feature was rolled back somewhen in 2019.
The actual question is: is there a way to get access to the client id token and its claims from the functions app code after the client completed the client-directed sign-in?
The token I get from the header in case of client-directed sing-in: