Azure / Azure/azure-functions-host
How to get access to the id token after client-directed sign-in
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
#### Is your question related to a specific version? If so, please specify:
v4 Out-of-process (isolated)
#### What language does your question apply to? (e.g. C#, JavaScript, Java, All)
C#
#### Question
I'm running a function app with EasyAuth enabled and set up to use B2C AD as an OpenID provider. In case of server-directed sign-in after the user has completed the authentication, I check `X-MS-CLIENT-PRINCIPAL` header and get access to the token containing claims collection, including B2C userId and emails. But when using client-directed sign-in flow the same header contains a different set of claims (actually there is only sid that is somehow related to the user). It looks like the token in the second case is based on `X-ZUMO-AUTH` header, but not on the id_token I had provided earlier during the authentication flow.
I found previously there was a similar issue #4212. There was mentioned a feature that properly filled in the ClaimsPrincipal disregarding which flow (client-directed or server-directed) had been selected. However, the same [comment ](https://github.com/Azure/azure-functions-host/issues/4212#issuecomment-480378690) mentions the feature was rolled back somewhen in 2019.
The actual question is: is there a way to get access to the client id token and its claims from the functions app code after the client completed the client-directed sign-in?
The token I get from the header in case of client-directed sing-in:
```
{
"auth_typ": "AuthenticationTypes.Federation",
"claims": [
{
"typ": "stable_sid",
"val": "sid:2bb0133b***"
},
{
"typ": "http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/nameidentifier",
"val": "sid:2bb0133b***
},
{
"typ": "http:\/\/schemas.microsoft.com\/identity\/claims\/identityprovider",
"val": "b2c_ropc"
},
{
"typ": "ver",
"val": "3"
},
{
"typ": "nbf",
"val": "1667839027"
},
{
"typ": "exp",
"val": "1667842627"
},
{
"typ": "iat",
"val": "1667839027"
},
{
"typ": "iss",
"val": "https:\/\/***.com\/"
},
{
"typ": "aud",
"val": "https:\/\/***.com\/"
}
],
"name_typ": "http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/name",
"role_typ": "http:\/\/schemas.microsoft.com\/ws\/2008\/06\/identity\/claims\/role"
}
```
Contributor guide
Assessment
This issue has not been assessed yet.