Skip to content

Commit 8d018b9

Browse files
authored
Update saml-technical-profile.md
Fixing ICM issue #181654783
1 parent 58ad855 commit 8d018b9

File tree

1 file changed

+27
-3
lines changed

1 file changed

+27
-3
lines changed

articles/active-directory-b2c/saml-technical-profile.md

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 02/13/2020
12+
ms.date: 02/30/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -86,11 +86,35 @@ The **Name** attribute of the Protocol element needs to be set to `SAML2`.
8686

8787
The **OutputClaims** element contains a list of claims returned by the SAML identity provider under the `AttributeStatement` section. You may need to map the name of the claim defined in your policy to the name defined in the identity provider. You can also include claims that aren't returned by the identity provider as long as you set the `DefaultValue` attribute.
8888

89-
To read the SAML assertion **NamedId** in **Subject** as a normalized claim, set the claim **PartnerClaimType** to `assertionSubjectName`. Make sure the **NameId** is the first value in assertion XML. When you define more than one assertion, Azure AD B2C picks the subject value from the last assertion.
89+
### Subject name output claim
90+
91+
To read the SAML assertion **NamedId** in the **Subject** as a normalized claim, set the claim **PartnerClaimType** to value of the `SPNameQualifier` property. If the `SPNameQualifier`property is not presented, set the claim **PartnerClaimType** to value of the `NameQualifier` property.
92+
93+
94+
SAML assertion:
95+
96+
```XML
97+
<saml:Subject>
98+
<saml:NameID SPNameQualifier="http://your-idp.com/your-unique-identifier" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">[email protected]</saml:NameID>
99+
<SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
100+
<SubjectConfirmationData InResponseTo="_cd37c3f2-6875-4308-a9db-ce2cf187f4d1" NotOnOrAfter="2020-02-15T16:23:23.137Z" Recipient="https://your-tenant.b2clogin.com/your-tenant.onmicrosoft.com/B2C_1A_TrustFrameworkBase/samlp/sso/assertionconsumer" />
101+
</SubjectConfirmation>
102+
</saml:SubjectConfirmation>
103+
</saml:Subject>
104+
```
105+
106+
Output claim:
107+
108+
```XML
109+
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="http://your-idp.com/your-unique-identifier" />
110+
```
111+
112+
If both `SPNameQualifier` or `NameQualifier` are not presented in the SAML assertion, set the claim **PartnerClaimType** to `assertionSubjectName`. Make sure the **NameId** is the first value in assertion XML. When you define more than one assertion, Azure AD B2C picks the subject value from the last assertion.
113+
90114

91115
The **OutputClaimsTransformations** element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
92116

93-
The following example shows the claims returned by the Facebook identity provider:
117+
The following example shows the claims returned by a SAML identity provider:
94118

95119
- The **issuerUserId** claim is mapped to the **assertionSubjectName** claim.
96120
- The **first_name** claim is mapped to the **givenName** claim.

0 commit comments

Comments
 (0)