jwt - 将 on_premise_sam_account 属性添加到 Azure 广告的 JWT 声明

Question

我一直试图在我的 id token 中返回 onpremisessamaccountname，我似乎无法获得语法或尝试以下正确的东西:

"optionalClaims": {
    "idToken": [
        {
            "name": "onprem_sam_account_name",
            "source": "user",
            "essential": true,
            "additionalProperties": []
        }
    ],

"optionalClaims": {
    "idToken": [
        {
            "name": "onprem_sam_account_name",
            "source": "user.onpremsamaccountname",
            "essential": true,
            "additionalProperties": []      }
    ],

    "optionalClaims": {
    "idToken": [
        {
            "name": "onprem_sam_account_name",
            "source": "user.onprem_sam_account_name",
            "essential": true,
            "additionalProperties": []      }
    ],

Answer 1

onprem_sam_account_name 是 Azure AD 中限制声明集的一部分。您不能将其添加为 token 中的可选声明。

引用:https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping#table-1-json-web-token-jwt-restricted-claim-set