Search code examples
azure-ad-b2csaml-2.0azure-ad-b2c-custom-policyclaims

Mapping SAML Attribute containing True or False to Claim with Boolean Data Type

I am attempting to define an attribute that will be returned by a SAML 2.0 Identity Provider to AAD B2C and handled in a custom policy.

The goal is that the SAML attribute defines a boolean value and that AAD B2C is able to perform logic based on the value of the claim.

The SAML Attribute represents True or False as per the below:

<saml:Attribute Name="http://schemas.custom/claim/booleanexample" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
    <saml:AttributeValue>True</saml:AttributeValue>
</saml:Attribute>

When attempting to map this SAML Attribute to a claim defined within the Custom Policy ClaimsSchema with a data type of boolean, an error is thrown.

Message in App Insights:

The data type 'String' of claim with id 'http://schemas.custom/claim/booleanexample' does not match the Data Type 'Boolean' of claimType with id 'BooleanExample' specified in the policy.

<ClaimType Id="BooleanExample">
  <DataType>boolean</DataType>
</ClaimType>

I cannot see any mechanism to explicitly define a type for the attribute within SAML (it appears that AttributeValue should be of type xs:any).

I have attempted passing the usual values including 0/1, True/False, true/false with no luck.

Is it really required to handle this with a String claim, and then populate a Boolean claim using a Claims Transformation?

Solution

  • It appears that the claim must be mapped as a string, inspected using a CompareClaimToValue claims transformation that sets a boolean claim with the result of the comparison.

    <ClaimsTransformation Id="CreateBooleanClaimFromString" TransformationMethod="CompareClaimToValue">
    <InputClaims>
      <InputClaim ClaimTypeReferenceId="samlBooleanClaimAsString" TransformationClaimType="inputClaim1" />
    </InputClaims>
    <InputParameters>
      <InputParameter Id="compareTo" DataType="string" Value="true" />
      <InputParameter Id="operator" DataType="string" Value="equal" />
      <InputParameter Id="ignoreCase" DataType="string" Value="false" />
    </InputParameters>
    <OutputClaims>
      <OutputClaim ClaimTypeReferenceId="samlBooleanClaimAsBoolean" TransformationClaimType="outputClaim" />
    </OutputClaims>
</ClaimsTransformation>