How to pass refresh token of a third party IDP to the application via Azure AD B2C? - azure-ad-b2c

Question

I’m working on an application which can read files of a given OneDrive account.
We use Azure AD B2C as the identity provider. Users can login to the application using their Microsoft account. For that we have enabled Microsoft as an Identity Provider in my AAD B2C tenant.
When a given user is login using their Microsoft account, application should be able to get both access_token and refresh_token which enables us to communicate with MS Graph API, in order to fetch file details.
Using custom polices we were able to fetch access_token. However, we cannot fetch the refresh_token.
This is how ClaimsSchema is defined in TrustFrameworkExtensions.xml :
<ClaimsSchema>
<ClaimType Id="ms_access_token">
<DisplayName>MS access token</DisplayName>
<DataType>string</DataType>
<DefaultPartnerClaimTypes>
<Protocol Name="OAuth2" PartnerClaimType="{oauth2:access_token}" />
<Protocol Name="OpenIdConnect" PartnerClaimType="{oauth2:access_token}" />
</DefaultPartnerClaimTypes>
<UserHelpText>access token form 3rd party MS AD.</UserHelpText>
</ClaimType>
<ClaimType Id="ms_refresh_token">
<DisplayName>MS Refresh token</DisplayName>
<DataType>string</DataType>
<DefaultPartnerClaimTypes>
<Protocol Name="OAuth2" PartnerClaimType="{oauth2:refresh_token}" />
<Protocol Name="OpenIdConnect" PartnerClaimType="{oauth2:refresh_token}" />
</DefaultPartnerClaimTypes>
<UserHelpText>refresh token form 3rd party MS AD.</UserHelpText>
</ClaimType>
</ClaimsSchema>
Also in the same file, under the TechnicalProfile of Microsoft login, following OutputClaims node is added (some child nodes are removed for clarity):
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="ms_access_token" DefaultValue="" />
<OutputClaim ClaimTypeReferenceId="ms_refresh_token" DefaultValue="" />
</OutputClaims>
Then under the relevant RelyingParty node following OutputClaims node is added (some child nodes are removed for clarity):
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="ms_access_token" PartnerClaimType="ms_idp_access_token"/>
<OutputClaim ClaimTypeReferenceId="ms_refresh_token" PartnerClaimType="ms_idp_refresh_token"/>
</OutputClaims>
According to documentation there is no claim resolver for refresh_token.
Any suggestion to get this work?

Answer 1

I think that the only way you could do this would be via a custom api, that uses a password flow to authenticate the user. You can then return the refresh_token, access_token etc back from the API. I've not been able to figure any other way to do this.

Answer 2

Finally I was able to get this resolved by the help from a Microsoft employee in MS forum.
As of now, Azure AD B2C doesn't support this with OIDC providers. Therefore we have to enable Microsoft as an OAuth2 Identity Provider, instead of OIDC. For that we have to define a ClaimProvider like this:
<ClaimsProviders>
<ClaimsProvider>
<Domain>live.com</Domain>
<DisplayName>Microsoft Account</DisplayName>
<TechnicalProfiles>
<TechnicalProfile Id="MSA-OAuth">
<DisplayName>Microsoft Account</DisplayName>
<Protocol Name="OAuth2"/>
<OutputTokenFormat>JWT</OutputTokenFormat>
<Metadata>
<Item Key="AccessTokenEndpoint">https://login.live.com/oauth20_token.srf</Item>
<Item Key="authorization_endpoint">https://login.live.com/oauth20_authorize.srf</Item>
<Item Key="ClaimsEndpoint">https://graph.microsoft.com/v1.0/me</Item>
<Item Key="ClaimsEndpointAccessTokenName">access_token</Item>
<Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item>
<Item Key="client_id"><!-- your client id --></Item>
<Item Key="HttpBinding">POST</Item>
<Item Key="scope">openid profile email offline_access files.read</Item>
<Item Key="UsePolicyInRedirectUri">0</Item>
</Metadata>
<CryptographicKeys>
<Key Id="client_secret" StorageReferenceId="B2C_1A_SampathAdCustomPolicyAppKey"/>
</CryptographicKeys>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="live.com" />
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="id"/>
<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
<OutputClaim ClaimTypeReferenceId="email" />
<OutputClaim ClaimTypeReferenceId="ms_access_token" PartnerClaimType="{oauth2:access_token}"/>
<OutputClaim ClaimTypeReferenceId="ms_refresh_token" PartnerClaimType="{oauth2:refresh_token}"/>
</OutputClaims>
<OutputClaimsTransformations>
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
</OutputClaimsTransformations>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
</TechnicalProfile>
</TechnicalProfiles>
</ClaimsProvider>

Answer 3

Note that the {oauth2:refresh_token} claims resolver returns a JSON string such as:
{
"r": "<refresh_token>",
"d": "live.com"
}
You can read the r property from this JSON string as follows.
Create a GetClaimFromJson claims transformation:
<ClaimsTransformation Id="GetRefreshTokenFromRefreshTokenResult" TransformationMethod="GetClaimFromJson">
<InputClaims>
<InputClaim ClaimTypeReferenceId="ms_refresh_token" TransformationClaimType="inputJson" />
</InputClaims>
<InputParameters>
<InputParameter Id="claimToExtract" DataType="string" Value="r" />
</InputParameters>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="ms_refresh_token" TransformationClaimType="extractedClaim" />
</OutputClaims>
</ClaimsTransformation>
Invoke this claims transformation from the MSA-OAuth technical profile as an output claims transformation:
<OutputClaimsTransformations>
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
<OutputClaimsTransformation ReferenceId="GetRefreshTokenFromRefreshTokenResult" />
</OutputClaimsTransformations>