How to persist email, first and last names with HRD custom policy - azure-ad-b2c

Question

I have a modified version of the CP at https://github.com/azure-ad-b2c/samples/blob/master/policies/home-realm-discovery-modern/policy/SignIn_smart_HRD.xml running in a test directory, with our company AD federated as an IdP. When I attempt to login to an app with my AD email address and my account does not exist in the B2C dir, it creates it using UserWriteUsingAlternativeSecurityId in OrchestrationStep 8. However, the new user account has only a Display Name; no fname, no lname, and, worst of all, no email. How do I ensure these elements get persisted in that step? I am not sure how to "grab hold" of them.
Ideally, I'd like the federated identity to be automatically linked to an existing local account with the same email address, without the user having to do a local login. All the examples I have seen around account linking involve either the user logging in first with a local password account or having the user's OID prepopulated. I only have the new user email addresses.
-GBS

Answer 1

You “grab hold” of those claims by mapping them in as output claims within your identity provider technical profile.
By default, the following claims are persisted, based on this:
<PersistedClaims>
<!-- Required claims -->
<PersistedClaim ClaimTypeReferenceId="alternativeSecurityId" />
<PersistedClaim ClaimTypeReferenceId="userPrincipalName" />
<PersistedClaim ClaimTypeReferenceId="mailNickName" DefaultValue="unknown" />
<PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" />
<!-- Optional claims -->
<PersistedClaim ClaimTypeReferenceId="otherMails" />
<PersistedClaim ClaimTypeReferenceId="givenName" />
<PersistedClaim ClaimTypeReferenceId="surname" />
</PersistedClaims>
So, in your identity provider technical profile, you need to map claims into the above claim names, eg:
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
<OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
Here, family_name from the Idp’s token, is mapped into the claim name, surname. Which is then persisted later in WriteUsingAlternativeSecurityId technical profile.
You could map the IdP email claim into mailNickName. Or into an extension attribute and add it as a persisted claim.
If you want auto account linking:
https://github.com/azure-ad-b2c/samples/blob/master/policies/auto-account-linking
To prevent asking the user to prove they own the account on account linking execution, remove steps 1-7 (inclusive) in HandleLinkLocalToSocial subjourney.