Skip to content

Update claims mapping policy instructions in documentation #1750

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update claims mapping policy instructions in documentation #1750

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions docs/identity-platform/custom-extension-tokenissuancestart-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,9 +214,9 @@ The **jwt.ms** test application uses the implicit flow. Enable implicit flow in
A claims mapping policy is used to select which attributes returned from the custom authentication extension are mapped into the token. To allow tokens to be augmented, you must explicitly enable the application registration to accept mapped claims:

1. In your *My Test application* registration, under **Manage**, select **Manifest**.
1. In the manifest, locate the `acceptMappedClaims` attribute, and set the value to `true`.
1. Set the `requestedAccessTokenVersion` to `2`.
1. Select **Save** to save the changes.
2. In the manifest, locate the `acceptMappedClaims` attribute under `api` object, and set the value to `true`.
3. Set the `requestedAccessTokenVersion` to `2`.
4. Select **Save** to save the changes.

The following JSON snippet demonstrates how to configure these properties.

Expand All @@ -229,6 +229,9 @@ The following JSON snippet demonstrates how to configure these properties.
}
```

> [!IMPORTANT]
> Until **AAD Graph App Manifest (Deprecating Soon)** is supported, you should also set `acceptMappedClaims` and `requestedAccessTokenVersion` in root object for this manifest kind. To know more go to [App manifest](https://learn.microsoft.com/en-us/entra/identity-platform/reference-microsoft-graph-app-manifest)

> [!WARNING]
> Do not set `acceptMappedClaims` property to `true` for multitenant apps, which can allow malicious actors to create claims-mapping policies for your app. Instead [configure a custom signing key](/graph/application-saml-sso-configure-api#option-2-create-a-custom-signing-certificate).

Expand Down