Skip to content

Commit 257b619

Browse files
mmacymmacy
committed
JSON code block formatting
1 parent 5654897 commit 257b619

File tree

1 file changed

+97
-79
lines changed

1 file changed

+97
-79
lines changed

‎articles/active-directory/develop/active-directory-optional-claims.md

Lines changed: 97 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -101,16 +101,17 @@ Some optional claims can be configured to change the way the claim is returned.
101101
#### Additional properties example
102102

103103
```json
104-
"optionalClaims":
105-
{
106-
"idToken": [
107-
{
108-
"name": "upn",
109-
"essential": false,
110-
"additionalProperties": [ "include_externally_authenticated_upn"]
111-
}
112-
]
113-
}
104+
"optionalClaims": {
105+
"idToken": [
106+
{
107+
"name": "upn",
108+
"essential": false,
109+
"additionalProperties": [
110+
"include_externally_authenticated_upn"
111+
]
112+
}
113+
]
114+
}
114115
```
115116

116117
This OptionalClaims object causes the ID token returned to the client to include a upn claim with the additional home tenant and resource tenant information. The `upn` claim is only changed in the token if the user is a guest in the tenant (that uses a different IDP for authentication).
@@ -145,32 +146,31 @@ You can configure optional claims for your application through the UI or applica
145146
The following application manifest entry adds the auth_time, ipaddr, and upn optional claims to ID, access, and SAML tokens.
146147

147148
```json
148-
"optionalClaims":
149-
{
150-
"idToken": [
151-
{
152-
"name": "auth_time",
153-
"essential": false
154-
}
155-
],
156-
"accessToken": [
157-
{
158-
"name": "ipaddr",
159-
"essential": false
160-
}
161-
],
162-
"saml2Token": [
163-
{
164-
"name": "upn",
165-
"essential": false
166-
},
167-
{
168-
"name": "extension_ab603c56068041afb2f6832e2a17e237_skypeId",
169-
"source": "user",
170-
"essential": false
171-
}
172-
]
173-
}
149+
"optionalClaims": {
150+
"idToken": [
151+
{
152+
"name": "auth_time",
153+
"essential": false
154+
}
155+
],
156+
"accessToken": [
157+
{
158+
"name": "ipaddr",
159+
"essential": false
160+
}
161+
],
162+
"saml2Token": [
163+
{
164+
"name": "upn",
165+
"essential": false
166+
},
167+
{
168+
"name": "extension_ab603c56068041afb2f6832e2a17e237_skypeId",
169+
"source": "user",
170+
"essential": false
171+
}
172+
]
173+
}
174174
```
175175

176176
2. When finished, select **Save**. Now the specified optional claims will be included in the tokens for your application.
@@ -259,7 +259,7 @@ This section covers the configuration options under optional claims for changing
259259
For example:
260260

261261
```json
262-
"groupMembershipClaims": "SecurityGroup"
262+
"groupMembershipClaims": "SecurityGroup"
263263
```
264264

265265
By default Group ObjectIDs will be emitted in the group claim value. To modify the claim value to contain on premises group attributes, or to change the claim type to role, use OptionalClaims configuration as follows:
@@ -278,12 +278,12 @@ This section covers the configuration options under optional claims for changing
278278
For each relevant token type, modify the groups claim to use the OptionalClaims section in the manifest. The OptionalClaims schema is as follows:
279279

280280
```json
281-
{
282-
"name": "groups",
283-
"source": null,
284-
"essential": false,
285-
"additionalProperties": []
286-
}
281+
{
282+
"name": "groups",
283+
"source": null,
284+
"essential": false,
285+
"additionalProperties": []
286+
}
287287
```
288288

289289
| Optional claims schema | Value |
@@ -311,12 +311,16 @@ This section covers the configuration options under optional claims for changing
311311
**Application manifest entry:**
312312

313313
```json
314-
"optionalClaims": {
315-
"accessToken": [{
316-
"name": "groups",
317-
"additionalProperties": ["dns_domain_and_sam_account_name"]
318-
}]
319-
}
314+
"optionalClaims": {
315+
"accessToken": [
316+
{
317+
"name": "groups",
318+
"additionalProperties": [
319+
"dns_domain_and_sam_account_name"
320+
]
321+
}
322+
]
323+
}
320324
```
321325

322326
2) Emit group names to be returned in netbiosDomain\sAMAccountName format as the roles claim in SAML and OIDC ID Tokens
@@ -328,15 +332,26 @@ This section covers the configuration options under optional claims for changing
328332
**Application manifest entry:**
329333

330334
```json
331-
"optionalClaims": {
332-
"saml2Token": [{
333-
"name": "groups",
334-
"additionalProperties": ["netbios_name_and_sam_account_name", "emit_as_roles"]
335-
}],
336-
"idToken": [{
337-
"name": "groups",
338-
"additionalProperties": ["netbios_name_and_sam_account_name", "emit_as_roles"]
339-
}]
335+
"optionalClaims": {
336+
"saml2Token": [
337+
{
338+
"name": "groups",
339+
"additionalProperties": [
340+
"netbios_name_and_sam_account_name",
341+
"emit_as_roles"
342+
]
343+
}
344+
],
345+
"idToken": [
346+
{
347+
"name": "groups",
348+
"additionalProperties": [
349+
"netbios_name_and_sam_account_name",
350+
"emit_as_roles"
351+
]
352+
}
353+
]
354+
}
340355
```
341356

342357
## Optional claims example
@@ -390,27 +405,30 @@ In the example below, you will use the **Token configuration** UI and **Manifest
390405
1. You can directly edit the manifest using this editor. The manifest follows the schema for the [Application entity](https://docs.microsoft.com/azure/active-directory/develop/reference-app-manifest), and automatically formats the manifest once saved. New elements will be added to the `OptionalClaims` property.
391406

392407
```json
393-
"optionalClaims": {
394-
"idToken": [
395-
{
396-
"name": "upn",
397-
"essential": false,
398-
"additionalProperties": [ "include_externally_authenticated_upn"]
399-
}
400-
],
401-
"accessToken": [
402-
{
403-
"name": "auth_time",
404-
"essential": false
405-
}
406-
],
407-
"saml2Token": [
408-
{
409-
"name": "extension_ab603c56068041afb2f6832e2a17e237_skypeId",
410-
"source": "user",
411-
"essential": true
412-
}
413-
]
408+
"optionalClaims": {
409+
"idToken": [
410+
{
411+
"name": "upn",
412+
"essential": false,
413+
"additionalProperties": [
414+
"include_externally_authenticated_upn"
415+
]
416+
}
417+
],
418+
"accessToken": [
419+
{
420+
"name": "auth_time",
421+
"essential": false
422+
}
423+
],
424+
"saml2Token": [
425+
{
426+
"name": "extension_ab603c56068041afb2f6832e2a17e237_skypeId",
427+
"source": "user",
428+
"essential": true
429+
}
430+
]
431+
}
414432
```
415433

416434
1. When you're finished updating the manifest, select **Save** to save the manifest.

0 commit comments

Comments
 (0)