Azure / Azure/azure-functions-host

How to get access to the id token after client-directed sign-in

Open
#8,897 1 comment 0 reactions 1 assignee Claimed by @kshyju View on GitHub
Needs: Triage (Functions)
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

#### Is your question related to a specific version? If so, please specify:
v4 Out-of-process (isolated)
#### What language does your question apply to? (e.g. C#, JavaScript, Java, All)
C#
#### Question
I'm running a function app with EasyAuth enabled and set up to use B2C AD as an OpenID provider. In case of server-directed sign-in after the user has completed the authentication, I check `X-MS-CLIENT-PRINCIPAL` header and get access to the token containing claims collection, including B2C userId and emails. But when using client-directed sign-in flow the same header contains a different set of claims (actually there is only sid that is somehow related to the user). It looks like the token in the second case is based on `X-ZUMO-AUTH` header, but not on the id_token I had provided earlier during the authentication flow.

I found previously there was a similar issue #4212. There was mentioned a feature that properly filled in the ClaimsPrincipal disregarding which flow (client-directed or server-directed) had been selected. However, the same [comment ](https://github.com/Azure/azure-functions-host/issues/4212#issuecomment-480378690) mentions the feature was rolled back somewhen in 2019.

The actual question is: is there a way to get access to the client id token and its claims from the functions app code after the client completed the client-directed sign-in?

The token I get from the header in case of client-directed sing-in:

```
{

"auth_typ": "AuthenticationTypes.Federation",
"claims": [
{
"typ": "stable_sid",
"val": "sid:2bb0133b***"
},
{
"typ": "http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/nameidentifier",
"val": "sid:2bb0133b***
},
{
"typ": "http:\/\/schemas.microsoft.com\/identity\/claims\/identityprovider",
"val": "b2c_ropc"
},
{
"typ": "ver",
"val": "3"
},
{
"typ": "nbf",
"val": "1667839027"
},
{
"typ": "exp",
"val": "1667842627"
},
{
"typ": "iat",
"val": "1667839027"
},
{
"typ": "iss",
"val": "https:\/\/***.com\/"
},
{
"typ": "aud",
"val": "https:\/\/***.com\/"
}
],
"name_typ": "http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/name",
"role_typ": "http:\/\/schemas.microsoft.com\/ws\/2008\/06\/identity\/claims\/role"
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.