Azure-docs: Where is the mapping between the claim type URI and the JWT identifier?

[msfcolombo]

I need to diagnose an issue where the code is reading claims by URI (i.e. http://schemas.microsoft.com/identity/claims/objectidentifier), but the parsed JWT token shows only the short identifier (oid).

For instance, what is the short name for claim http://schemas.microsoft.com/ws/2008/06/identity/claims/confirmationkey ?

Ideally, the list here should provide the mapping. But if there is query I can do on my tenant to find this, please specify.

Thanks

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 195c79a3-ccc5-8c6a-233e-95e344a9b4df
• Version Independent ID: 401c7557-5817-bbd3-5bd8-8c97ef5a28cc
• Content: Customize claims emitted in tokens for a specific app in an Azure AD tenant (Public Preview)
• Content Source: articles/active-directory/develop/active-directory-claims-mapping.md
• Service: active-directory
• GitHub Login: @rwike77
• Microsoft Alias: ryanwi

[SnehaAgrawal-MSFT]

@msfcolombo Thanks for the question! We are investigating and will update you shortly.

[ManojReddy-MSFT]

@msfcolombo The following doc has a list of the all the JWT identifiers sent in the payload of Azure AD token.

Let me know if this is the list you are looking for?

[msfcolombo]

That one shows only short names. I need the mapping between the claim spec URI (http://schemas/etc) and the short name.

[ManojReddy-MSFT]

@msfcolombo The claim spec URI format is not used in JWT. It is used only in SAML and can be customized for any custom claims you need.

There is no actual list which has this information.

[ManojReddy-MSFT]

@msfcolombo We have not heard from you in a while. We will now proceed to close this thread. If you have further questions, please tag me in the comments and I will gladly continue the conversation.

[msfcolombo]

@ManojReddy-MSFT Some mappings are displayed in this document:

This table lists the claim types as they appear in the ID token. In ASP.NET Core, the OpenID Connect middleware converts some of the claim types when it populates the Claims collection for the user principal:

oid > http://schemas.microsoft.com/identity/claims/objectidentifier
tid > http://schemas.microsoft.com/identity/claims/tenantid
unique_name > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
upn > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn

Yet is not clear if that is a complete or partial list. Also, the mentioned "OpenID Connect middleware" is a lousy definition for software component. I think if we can find that software component, we can get the full mapping.

[colgreen]

For the record, the full list of mappings are defined in ClaimTypeMapping.cs in the System.IdentityModel.Tokens.Jwt assembly/package:

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/src/System.IdentityModel.Tokens.Jwt/ClaimTypeMapping.cs

[msfcolombo]

Thanks @colgreen! That's exactly what I was looking for!