Search code examples
bearer-tokenazure-authenticationazure-ad-b2cclaims-authentication

Missing new user flag in token claim: Azure B2C

We created Sign Up and Sign In userflow for our B2C application to authenticate users.

To identify the user selected option i.e, sign up or sign in, we added "User is new" application claim to our user flow:

enter image description here

But when we generate the token, we cannot see "newUser" flag in it's claims.

enter image description here

"iss": "https://ourb2ctenant.b2clogin.com/0006565e-bfe8-45ee-a405-cede36487a6d/v2.0/",
"exp": 1666757889,
"nbf": 1666754289,
"aud": "3df6735e-2c7c-436d-a9f2-058d213d125a",
"tfp": "B2C_1_SUSI",
"azpacr": "1",
"sub": "92769eb0-14f3-40f8-bef8-75fef429214c".
"oid": "92769eb0-14f3-40f8-bef8-75fef429214c",
"tid": "0006565e-bfe8-45ee-a405-cede36487a6d",
"ver": "2.0",
"azp": "3df6735e-2c7c-436d-a9f2-058d213d125a".
"iat": 1666754289

Are we missing something?

Solution

  • You need to use interactive method like authorization code flow and include openid scope to get new user token claim.

    I tried to reproduce the same in my environment and got the below results:

    I have one Azure AD B2C application that has supported account type as below:

    enter image description here

    Now I created one Sign up and sign in user flow with same parameters as you and ran the user flow like below:

    enter image description here

    When I ran the user flow, I got the login screen like below:

    enter image description here

    Now I selected Sign up now to sign in as a new user and got below screen where I filled details like this:

    enter image description here

    When I selected Create, it took me to the redirect URI with code in address bar like below:

    enter image description here

    To generate access token, I used authorization code flow with parameters like below:

    POST https://b2ctenant.b2clogin.com/b2ctenant.onmicrosoft.com/B2C_1_SUSI/oauth2/v2.0/token

grant_type:authorization_code
client_id:appid
client_secret:secret
scope:openid 
code: use the code that you got in above step
redirect_uri:https://jwt.ms

    Response:

    enter image description here

    When I decoded the above token, I got newUser claim as true as below:

    enter image description here