Azure-docs: Azure AD B2C with Azure AD Multi Tenant custom policies

[mvput]

I want to add Azure AD as IdP to the Azure AD B2C using custom policies. I have used the following setup guide. https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-setup-commonaad-custom.

The local sign-in functionallity works fine. When I want to sign-in with an Azure AD account I get the following error (traced using Application Insights).

A Claim of ClaimType with id \"UserId\" was not found, which is required by the ClaimsTransformationImpl of Type \"Microsoft.Cpim.Data.Transformations.CreateAlternativeSecurityIdTransformation\" for TransformationMethod \"CreateAlternativeSecurityId\" referenced by the ClaimsTransformation with id \"CreateAlternativeSecurityId\" in policy

The claim provider looks as following.

 <ClaimsProvider>
  <Domain>commonaad</Domain>
  <DisplayName>Common AAD</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="Common-AAD">
      <DisplayName>Multi-Tenant AAD</DisplayName>
      <Protocol Name="OpenIdConnect" />
      <Metadata>
        <!-- Update the Client ID below to the Application ID -->
        <Item Key="client_id"></Item>
        <Item Key="UsePolicyInRedirectUri">0</Item>
        <Item Key="METADATA">https://login.microsoftonline.com/common/.well-known/openid-configuration</Item>
        <Item Key="response_types">code</Item>
        <Item Key="scope">openid</Item>
        <Item Key="response_mode">form_post</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="DiscoverMetadataByTokenIssuer">true</Item>

        <!-- The key below allows you to specify each of the Azure AD tenants that can be used to sign in. Update the GUIDs below for each tenant. -->
        <!-- <Item Key="ValidTokenIssuerPrefixes">https://sts.windows.net</Item> -->

        <!-- The commented key below specifies that users from any tenant can sign-in. Uncomment if you would like anyone with an Azure AD account to be able to sign in. -->
        <Item Key="ValidTokenIssuerPrefixes">https://sts.windows.net/</Item>
      </Metadata>
      <CryptographicKeys>
        <!-- Make sure to update the reference ID of the client secret below you just created (B2C_1A_AADAppSecret) -->
        <Key Id="client_secret" StorageReferenceId="B2C_1A_AADAppSecret" />
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
        <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
        <OutputClaim ClaimTypeReferenceId="email" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 171f21f0-1c8c-42f9-dbb8-2da1ebc70892
• Version Independent ID: fe1d0a08-231e-5094-2406-1b548cb1174e
• Content: Set up sign-in for a multi-tenant Azure AD identity provider using custom policies in Azure Active Directory B2C
• Content Source: articles/active-directory-b2c/active-directory-b2c-setup-commonaad-custom.md
• Service: active-directory
• GitHub Login: @davidmu1
• Microsoft Alias: davidmu

[BryanTrach-MSFT]

@mvput Thanks for the feedback! We are currently investigating and will update you shortly.

[MarileeTurscak-MSFT]

Your is missing the UserId claim. This is because either the entry which has a ClaimTypeReferenceId="UserId" is missing or it's mapped to a value that's missing.

Please see the related thread. https://stackoverflow.com/questions/45553943/azure-active-directory-custom-policy-error

[MarileeTurscak-MSFT]

We will now proceed to close this thread. If you have further questions please reach out to me on MSDN and I will gladly continue the discussion there and help troubleshoot. (I monitor it on the hour.) https://social.msdn.microsoft.com/Forums/en-US/home?forum=WindowsAzureAD