Trust Framework Extensions

TrustFrameworkExtensions.xml

<?xml version="1.0" encoding="utf-8" ?>
<TrustFrameworkPolicy 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
  xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" 
  PolicySchemaVersion="0.3.0.0" 
  TenantId="TENANT.onmicrosoft.com" 
  PolicyId="B2C_1A_TrustFrameworkExtensions" 
  PublicPolicyUri="http://TENANT.onmicrosoft.com/B2C_1A_TrustFrameworkExtensions">
  
  <BasePolicy>
    <TenantId>TENANT.onmicrosoft.com</TenantId>
    <PolicyId>B2C_1A_TrustFrameworkBase</PolicyId>
  </BasePolicy>
  <BuildingBlocks>
    <ClaimsSchema>
      <ClaimType Id="extension_objectId">
        <DisplayName>App Object Id</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_organisationId">
        <DisplayName>Organisation Id</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_businessName">
        <DisplayName>Business Name</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_isOrganisationOwner">
        <DisplayName>Is Organisation Owner</DisplayName>
        <DataType>boolean</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_isImpersonating">
        <DisplayName>Is the user impersonating</DisplayName>
        <DataType>boolean</DataType>
      </ClaimType>
      <ClaimType Id="extension_platformRegion">
        <DisplayName>Platform Region</DisplayName>
        <DataType>int</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_allowedCustomers">
        <DisplayName>Allowed Customers</DisplayName>
        <DataType>stringCollection</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_restrictedCustomers">
        <DisplayName>Restricted Customers</DisplayName>
        <DataType>stringCollection</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_primaryBrmOf">
        <DisplayName>Primary BRM Of</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_appRole">
        <DisplayName>App Role</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="extension_orgRole">
        <DisplayName>Org Role</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>

      <ClaimType Id="unique_name">
        <DisplayName>Unique Name</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
      <ClaimType Id="aadUPN">
        <DisplayName>aadUPN</DisplayName>
        <DataType>string</DataType>
        <!-- <DefaultPartnerClaimTypes>
          <Protocol Name="" PartnerClaimType="" />
        </DefaultPartnerClaimTypes> -->
      </ClaimType>
    </ClaimsSchema>
  </BuildingBlocks>

  <ClaimsProviders>
    <ClaimsProvider>
      <DisplayName>REST API</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="REST-GetProfile">
          <DisplayName>Get App Specific claims</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">https://my_app.com/controller/claims</Item>
            <Item Key="AuthenticationType">None</Item>
            <!-- REMOVE the following line in production environments -->
            <Item Key="AllowInsecureAuthInProduction">true</Item>
          </Metadata>
          <InputClaims>
            <!-- Claims sent to your REST API -->
            <InputClaim ClaimTypeReferenceId="objectId" />
            <InputClaim ClaimTypeReferenceId="email" />
            <InputClaim ClaimTypeReferenceId="sub" />
            <InputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
            <InputClaim ClaimTypeReferenceId="userPrincipalName" />
            <InputClaim ClaimTypeReferenceId="displayName" />
            <InputClaim ClaimTypeReferenceId="otherMails" />
            <InputClaim ClaimTypeReferenceId="upnUserName" />
            <InputClaim ClaimTypeReferenceId="alternativeSecurityId" />
            <InputClaim ClaimTypeReferenceId="signInName" />

            <InputClaim ClaimTypeReferenceId="identityProvider" />
            <InputClaim ClaimTypeReferenceId="authenticationSource" />

            <InputClaim ClaimTypeReferenceId="aadUPN" />
            <InputClaim ClaimTypeReferenceId="unique_name" />
            <!-- <InputClaim ClaimTypeReferenceId="userLanguage" PartnerClaimType="lang" DefaultValue="{Culture:LCID}" AlwaysUseDefaultValue="true" /> -->
          </InputClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="extension_isOrganisationOwner" /> 
            <OutputClaim ClaimTypeReferenceId="extension_isImpersonating" />
            <OutputClaim ClaimTypeReferenceId="extension_appRole" />
            <!-- Claims parsed from your REST API -->
            <OutputClaim ClaimTypeReferenceId="extension_organisationId" />
            <OutputClaim ClaimTypeReferenceId="extension_platformRegion" />
            <OutputClaim ClaimTypeReferenceId="extension_bjectId" />
            <OutputClaim ClaimTypeReferenceId="extension_businessName" />
            <OutputClaim ClaimTypeReferenceId="extension_orgRole" />
            <OutputClaim ClaimTypeReferenceId="extension_allowedCustomers" />
            <OutputClaim ClaimTypeReferenceId="extension_restrictedCustomers" />
          </OutputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
    <ClaimsProvider>
      <DisplayName>Local Account SignIn</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="login-NonInteractive">
          <Metadata>
            <Item Key="client_id">client_id</Item>
            <Item Key="IdTokenAudience">resource_id</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="client_id" DefaultValue="client_id" />
            <InputClaim ClaimTypeReferenceId="resource_id" PartnerClaimType="resource" DefaultValue="resource_id" />
          </InputClaims>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>

    <ClaimsProvider>
      <Domain>common</Domain>
      <DisplayName>Common AAD</DisplayName>
      <TechnicalProfiles>
        <TechnicalProfile Id="Common-AAD">
          <DisplayName>Work Account</DisplayName>
          <Description>Login with your Work Account</Description>
          <Protocol Name="OpenIdConnect"/>
          <Metadata>
            <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
            <!-- Update the Client ID below to the Application ID -->
            <Item Key="client_id">client_id</Item>
            <Item Key="response_types">code</Item>
            <Item Key="scope">openid email profile</Item>
            <Item Key="response_mode">form_post</Item>
            <Item Key="HttpBinding">POST</Item>
            <Item Key="UsePolicyInRedirectUri">false</Item>
            <Item Key="DiscoverMetadataByTokenIssuer">true</Item>
            <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/</Item>
          </Metadata>
          <CryptographicKeys>
            <Key Id="client_secret" StorageReferenceId="B2C_1A_AADAppSecret"/>
          </CryptographicKeys>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid"/>
            <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
            <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
            <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
            <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
            <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
            <OutputClaim ClaimTypeReferenceId="unique_name"/>
            <OutputClaim ClaimTypeReferenceId="aadUPN" PartnerClaimType="unique_name"/>
          </OutputClaims>
          <OutputClaimsTransformations>
            <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
            <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
            <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
            <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
          </OutputClaimsTransformations>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin"/>
        </TechnicalProfile>
      </TechnicalProfiles>
    </ClaimsProvider>
  </ClaimsProviders>

  <UserJourneys>
	  <UserJourney Id="SignUpOrSignInMulti">
      <OrchestrationSteps>
      
        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <ClaimsProviderSelection TargetClaimsExchangeId="AzureADExchange" />
            <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- Check if the user has selected to sign in using one of the social providers -->
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AzureADExchange" TechnicalProfileReferenceId="Common-AAD" />
            <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- For social IDP authentication, attempt to find the user account in the directory. -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>localAccountAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). 
          This can only happen when authentication happened using a social IDP. If local account was created or authentication done
          using ESTS in step 2, then an user account must exist in the directory by this time. -->
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent 
          in the token. -->
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>socialIdpAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect 
             from the user. So, in that case, create the user in the directory if one does not already exist 
             (verified using objectId which would be set from the last step if account was created in the directory. -->
        <OrchestrationStep Order="6" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
          </ClaimsExchanges>
        </OrchestrationStep>

        <OrchestrationStep Order="7" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="RESTGetProfile" TechnicalProfileReferenceId="REST-GetProfile" />
          </ClaimsExchanges>
        </OrchestrationStep>
 
        <OrchestrationStep Order="8" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
 
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>
	</UserJourneys>

</TrustFrameworkPolicy>