Skip to content

Commit bb0aff7

Browse files
authored
Merge pull request #185192 from yoelhor/patch-232
Claims transformation improvements
2 parents 02e6350 + 5d716b2 commit bb0aff7

10 files changed

+817
-697
lines changed

articles/active-directory-b2c/boolean-transformations.md

Lines changed: 72 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -9,28 +9,29 @@ manager: CelesteDG
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 06/06/2020
12+
ms.date: 01/17/2022
1313
ms.author: kengaderdus
1414
ms.subservice: B2C
1515
---
1616

1717
# Boolean claims transformations
1818

19-
[!INCLUDE [active-directory-b2c-advanced-audience-warning](../../includes/active-directory-b2c-advanced-audience-warning.md)]
20-
21-
This article provides examples for using the boolean claims transformations of the Identity Experience Framework schema in Azure Active Directory B2C (Azure AD B2C). For more information, see [ClaimsTransformations](claimstransformations.md).
19+
This article provides examples for using the boolean claims transformations of the Identity Experience Framework schema in Azure Active Directory B2C (Azure AD B2C). For more information, see [claims transformations](claimstransformations.md).
2220

2321
## AndClaims
2422

25-
Performs an And operation of two boolean inputClaims and sets the outputClaim with result of the operation.
23+
Computes an `And` operation of two boolean input claims, and sets the output claim with result of the operation.
2624

27-
| Item | TransformationClaimType | Data Type | Notes |
25+
| Element | TransformationClaimType | Data Type | Notes |
2826
|-------| ------------------------ | ---------- | ----- |
29-
| InputClaim | inputClaim1 | boolean | The first ClaimType to evaluate. |
30-
| InputClaim | inputClaim2 | boolean | The second ClaimType to evaluate. |
31-
|OutputClaim | outputClaim | boolean | The ClaimTypes that will be produced after this claims transformation has been invoked (true or false). |
27+
| InputClaim | inputClaim1 | boolean | The first claim to evaluate. |
28+
| InputClaim | inputClaim2 | boolean | The second claim to evaluate. |
29+
|OutputClaim | outputClaim | boolean | The claim that will be produced after this claims transformation has been invoked (true or false). |
30+
3231

33-
The following claims transformation demonstrates how to And two boolean ClaimTypes: `isEmailNotExist`, and `isSocialAccount`. The output claim `presentEmailSelfAsserted` is set to `true` if the value of both input claims are `true`. In an orchestration step, you can use a precondition to preset a self-asserted page, only if a social account email is empty.
32+
### Example of AndClaims
33+
34+
The following claims transformation demonstrates how to `And` two boolean claims: `isEmailNotExist`, and `isSocialAccount`. The output claim `presentEmailSelfAsserted` is set to `true` if the values of both input claims are `true`.
3435

3536
```xml
3637
<ClaimsTransformation Id="CheckWhetherEmailBePresented" TransformationMethod="AndClaims">
@@ -44,29 +45,29 @@ The following claims transformation demonstrates how to And two boolean ClaimTyp
4445
</ClaimsTransformation>
4546
```
4647

47-
### Example of AndClaims
48-
4948
- Input claims:
50-
- **inputClaim1**: true
51-
- **inputClaim2**: false
49+
- **inputClaim1**: true
50+
- **inputClaim2**: false
5251
- Output claims:
53-
- **outputClaim**: false
52+
- **outputClaim**: false
5453

5554

5655
## AssertBooleanClaimIsEqualToValue
5756

5857
Checks that boolean values of two claims are equal, and throws an exception if they are not.
5958

60-
| Item | TransformationClaimType | Data Type | Notes |
59+
| Element | TransformationClaimType | Data Type | Notes |
6160
| ---- | ------------------------ | ---------- | ----- |
62-
| inputClaim | inputClaim | boolean | The ClaimType to be asserted. |
61+
| inputClaim | inputClaim | boolean | The claim to be checked. |
6362
| InputParameter |valueToCompareTo | boolean | The value to compare (true or false). |
6463

6564
The **AssertBooleanClaimIsEqualToValue** claims transformation is always executed from a [validation technical profile](validation-technical-profile.md) that is called by a [self-asserted technical profile](self-asserted-technical-profile.md). The **UserMessageIfClaimsTransformationBooleanValueIsNotEqual** self-asserted technical profile metadata controls the error message that the technical profile presents to the user. The error messages can be [localized](localization-string-ids.md#claims-transformations-error-messages).
6665

6766
![AssertStringClaimsAreEqual execution](./media/boolean-transformations/assert-execution.png)
6867

69-
The following claims transformation demonstrates how to check the value of a boolean ClaimType with a `true` value. If the value of the `accountEnabled` ClaimType is false, an error message is thrown.
68+
### Example of AssertBooleanClaimIsEqualToValue
69+
70+
The following claims transformation demonstrates how to check the value of a boolean claim with a `true` value. If the value of the `accountEnabled` claim is false, an error message is thrown.
7071

7172
```xml
7273
<ClaimsTransformation Id="AssertAccountEnabledIsTrue" TransformationMethod="AssertBooleanClaimIsEqualToValue">
@@ -79,49 +80,59 @@ The following claims transformation demonstrates how to check the value of a boo
7980
</ClaimsTransformation>
8081
```
8182

83+
- Input claims:
84+
- **inputClaim**: false
85+
- **valueToCompareTo**: true
86+
- Result: Error thrown
87+
88+
### Calling the AssertBooleanClaimIsEqualToValue claims transformation
8289

83-
The `login-NonInteractive` validation technical profile calls the `AssertAccountEnabledIsTrue` claims transformation.
90+
The following `Example-AssertBoolean` validation technical profile calls the `AssertAccountEnabledIsTrue` claims transformation.
8491

8592
```xml
86-
<TechnicalProfile Id="login-NonInteractive">
87-
...
93+
<TechnicalProfile Id="Example-AssertBoolean">
94+
<DisplayName>Unit test</DisplayName>
95+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
96+
<OutputClaims>
97+
<OutputClaim ClaimTypeReferenceId="ComparisonResult" DefaultValue="false" />
98+
</OutputClaims>
8899
<OutputClaimsTransformations>
89100
<OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" />
90101
</OutputClaimsTransformations>
102+
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
91103
</TechnicalProfile>
92104
```
93105

94-
The self-asserted technical profile calls the validation **login-NonInteractive** technical profile.
106+
The self-asserted technical profile calls the validation `Example-AssertBoolean` technical profile.
95107

96108
```xml
97-
<TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email">
109+
<TechnicalProfile Id="SelfAsserted-AssertDateTimeIsGreaterThan">
110+
<DisplayName>Example</DisplayName>
111+
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
98112
<Metadata>
113+
<Item Key="ContentDefinitionReferenceId">api.selfasserted</Item>
99114
<Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual">Custom error message if account is disabled.</Item>
100115
</Metadata>
116+
...
101117
<ValidationTechnicalProfiles>
102-
<ValidationTechnicalProfile ReferenceId="login-NonInteractive" />
118+
<ValidationTechnicalProfile ReferenceId="Example-AssertBoolean" />
103119
</ValidationTechnicalProfiles>
104120
</TechnicalProfile>
105121
```
106122

107-
### Example of AssertBooleanClaimIsEqualToValue
108-
109-
- Input claims:
110-
- **inputClaim**: false
111-
- **valueToCompareTo**: true
112-
- Result: Error thrown
113-
114123
## CompareBooleanClaimToValue
115124

116125
Checks that boolean value of a claim is equal to `true` or `false`, and return the result of the compression.
117126

118-
| Item | TransformationClaimType | Data Type | Notes |
127+
| Element | TransformationClaimType | Data Type | Notes |
119128
| ---- | ------------------------ | ---------- | ----- |
120-
| InputClaim | inputClaim | boolean | The ClaimType to be asserted. |
129+
| InputClaim | inputClaim | boolean | The claim to be compared. |
121130
| InputParameter |valueToCompareTo | boolean | The value to compare (true or false). |
122-
| OutputClaim | compareResult | boolean | The ClaimType that is produced after this ClaimsTransformation has been invoked. |
131+
| OutputClaim | compareResult | boolean | The claim that is produced after this claims transformation has been invoked. |
132+
133+
### Example of CompareBooleanClaimToValue
123134

124-
The following claims transformation demonstrates how to check the value of a boolean ClaimType with a `true` value. If the value of the `IsAgeOver21Years` ClaimType is equal to `true`, the claims transformation returns `true`, otherwise `false`.
135+
The following claims transformation demonstrates how to check the value of a boolean claim with a `true` value. If the value of the `IsAgeOver21Years` claim is equal to `true`, the claims transformation returns `true`, otherwise `false`.
125136

126137
```xml
127138
<ClaimsTransformation Id="AssertAccountEnabled" TransformationMethod="CompareBooleanClaimToValue">
@@ -137,25 +148,25 @@ The following claims transformation demonstrates how to check the value of a boo
137148
</ClaimsTransformation>
138149
```
139150

140-
### Example of CompareBooleanClaimToValue
141-
142151
- Input claims:
143-
- **inputClaim**: false
152+
- **inputClaim**: false
144153
- Input parameters:
145-
- **valueToCompareTo**: true
154+
- **valueToCompareTo**: true
146155
- Output claims:
147-
- **compareResult**: false
156+
- **compareResult**: false
148157

149158
## NotClaims
150159

151-
Performs a Not operation of the boolean inputClaim and sets the outputClaim with result of the operation.
160+
Computes a `Not` operation of the boolean input claim and sets the output claim with result of the operation.
152161

153-
| Item | TransformationClaimType | Data Type | Notes |
162+
| Element | TransformationClaimType | Data Type | Notes |
154163
| ---- | ----------------------- | --------- | ----- |
155164
| InputClaim | inputClaim | boolean | The claim to be operated. |
156-
| OutputClaim | outputClaim | boolean | The ClaimTypes that are produced after this ClaimsTransformation has been invoked (true or false). |
165+
| OutputClaim | outputClaim | boolean | The claim that is produced after this claims transformation has been invoked (true or false). |
166+
167+
### Example of NotClaims
157168

158-
Use this claim transformation to perform logical negation on a claim.
169+
The following claims transformation demonstrates how to perform logical negation on a claim.
159170

160171
```xml
161172
<ClaimsTransformation Id="CheckWhetherEmailBePresented" TransformationMethod="NotClaims">
@@ -168,24 +179,24 @@ Use this claim transformation to perform logical negation on a claim.
168179
</ClaimsTransformation>
169180
```
170181

171-
### Example of NotClaims
172-
173182
- Input claims:
174-
- **inputClaim**: false
183+
- **inputClaim**: false
175184
- Output claims:
176-
- **outputClaim**: true
185+
- **outputClaim**: true
177186

178187
## OrClaims
179188

180-
Computes an Or of two boolean inputClaims and sets the outputClaim with result of the operation.
189+
Computes an `Or` of two boolean claims and sets the output claim with result of the operation.
181190

182-
| Item | TransformationClaimType | Data Type | Notes |
191+
| Element | TransformationClaimType | Data Type | Notes |
183192
| ---- | ----------------------- | --------- | ----- |
184-
| InputClaim | inputClaim1 | boolean | The first ClaimType to evaluate. |
185-
| InputClaim | inputClaim2 | boolean | The second ClaimType to evaluate. |
186-
| OutputClaim | outputClaim | boolean | The ClaimTypes that will be produced after this ClaimsTransformation has been invoked (true or false). |
193+
| InputClaim | inputClaim1 | boolean | The first claim to evaluate. |
194+
| InputClaim | inputClaim2 | boolean | The second claim to evaluate. |
195+
| OutputClaim | outputClaim | boolean | The claim that will be produced after this claims transformation has been invoked (true or false). |
196+
197+
### Example of OrClaims
187198

188-
The following claims transformation demonstrates how to `Or` two boolean ClaimTypes. In the orchestration step, you can use a precondition to preset a self-asserted page, if the value of one of the claims is `true`.
199+
The following claims transformation demonstrates how to `Or` two boolean claims.
189200

190201
```xml
191202
<ClaimsTransformation Id="CheckWhetherEmailBePresented" TransformationMethod="OrClaims">
@@ -199,10 +210,12 @@ The following claims transformation demonstrates how to `Or` two boolean ClaimTy
199210
</ClaimsTransformation>
200211
```
201212

202-
### Example of OrClaims
203-
204213
- Input claims:
205-
- **inputClaim1**: true
206-
- **inputClaim2**: false
214+
- **inputClaim1**: true
215+
- **inputClaim2**: false
207216
- Output claims:
208-
- **outputClaim**: true
217+
- **outputClaim**: true
218+
219+
## Next steps
220+
221+
- Find more [claims transformation samples](https://github.com/azure-ad-b2c/unit-tests/tree/main/claims-transformation) on the Azure AD B2C community GitHub repo

articles/active-directory-b2c/claims-transformation-technical-profile.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
---
2-
title: Define a Claims transformation technical profile
2+
title: Define a claims transformation technical profile
33
titleSuffix: Azure AD B2C
4-
description: Define a Claims transformation technical profile in a custom policy in Azure Active Directory B2C.
4+
description: Define a claims transformation technical profile in a custom policy in Azure Active Directory B2C.
55
services: active-directory-b2c
66
author: kengaderdus
77
manager: CelesteDG
88

99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: reference
12-
ms.date: 02/13/2020
12+
ms.date: 01/17/2022
1313
ms.author: kengaderdus
1414
ms.subservice: B2C
1515
---
@@ -35,7 +35,7 @@ The following example shows a claims transformation technical profile:
3535

3636
## Output claims
3737

38-
The **OutputClaims** element is mandatory. You should provide at least one output claim returned by the technical profile. The following example shows how to set default values in the output claims:
38+
The **OutputClaims** element is mandatory. Provide at least one output claim returned by the technical profile. The following example shows how to set default values in the output claims:
3939

4040
```xml
4141
<OutputClaims>
@@ -78,7 +78,7 @@ TransformationClaimType="collection" />
7878
</TechnicalProfile>
7979
```
8080

81-
The claims transformation technical profile enables you to execute a claims transformation from any user journey's orchestration step. In the following example, the orchestration step calls one of the unlink technical profiles, such as **UnLink-Facebook-OAUTH**. This technical profile calls the claims transformation technical profile **RemoveAlternativeSecurityIdByIdentityProvider**, which generates a new **AlternativeSecurityIds2** claim that contains the list of user social identities, while removing the Facebook identity from the collections.
81+
The claims transformation technical profile enables you to execute a claims transformation from any user journey's orchestration step. In the following example, the orchestration step calls one of the unlink technical profiles, such as **UnLink-Facebook-OAUTH**. This technical profile calls the output claims transformation **RemoveAlternativeSecurityIdByIdentityProvider**, which generates a new **AlternativeSecurityIds2** claim. The output claim contains the list of user's social identities, while removing the Facebook identity from the collections.
8282

8383
```xml
8484
<UserJourney Id="AccountUnLink">
@@ -100,7 +100,8 @@ The claims transformation technical profile enables you to execute a claims tran
100100

101101
| Attribute | Required | Description |
102102
| --------- | -------- | ----------- |
103-
| IncludeClaimResolvingInClaimsHandling  | No | For input and output claims, specifies whether [claims resolution](claim-resolver-overview.md) is included in the technical profile. Possible values: `true`, or `false` (default). If you want to use a claims resolver in the technical profile, set this to `true`. |
103+
| IncludeClaimResolvingInClaimsHandling | No | For input and output claims, specifies whether [claims resolution](claim-resolver-overview.md) is included in the technical profile. Possible values: `true`, or `false` (default). If you want to use a claims resolver in the technical profile, set this metadata to `true`. |
104+
| ContentDefinitionReferenceId | No | The identifier of the [content definition](contentdefinitions.md) associated with this technical profile. The content definition metadata is required for [FormatLocalizedString](string-transformations.md#formatlocalizedstring), [GetLocalizedStringsTransformation](string-transformations.md#getlocalizedstringstransformation), and [GetMappedValueFromLocalizedCollection](string-transformations.md#getmappedvaluefromlocalizedcollection) claims transformations.|
104105

105106
## Use a validation technical profile
106107

0 commit comments

Comments
 (0)