Troubleshoot your custom claims provider API

1. For local development and testing purposes, open local.settings.json and replace the code with the following JSON:

   {
     "IsEncrypted": false,
     "Values": {
       "AzureWebJobsStorage": "",
       "AzureWebJobsSecretStorageType": "files",
       "FUNCTIONS_WORKER_RUNTIME": "dotnet",
       "AuthenticationEvents__BypassTokenValidation" : false
     }
   }
   

   Note

   If you used the Microsoft.Azure.WebJobs.Extensions.AuthenticationEvents NuGet package, be sure to set "AuthenticationEvents__BypassTokenValidation" : true for local testing purposes.

2. Using your preferred API testing tool, create a new HTTP request and set the HTTP method to POST.

3. Use the following JSON body that imitates the request Microsoft Entra ID sends to your REST API.

   {
       "type": "microsoft.graph.authenticationEvent.tokenIssuanceStart",
       "source": "/tenants/aaaabbbb-0000-cccc-1111-dddd2222eeee/applications/00001111-aaaa-2222-bbbb-3333cccc4444",
       "data": {
           "@odata.type": "microsoft.graph.onTokenIssuanceStartCalloutData",
           "tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
           "authenticationEventListenerId": "11112222-bbbb-3333-cccc-4444dddd5555",
           "customAuthenticationExtensionId": "22223333-cccc-4444-dddd-5555eeee6666",
           "authenticationContext": {
               "correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd",
               "client": {
                   "ip": "127.0.0.1",
                   "locale": "en-us",
                   "market": "en-us"
               },
               "protocol": "OAUTH2.0",
               "clientServicePrincipal": {
                   "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
                   "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
                   "appDisplayName": "My Test application",
                   "displayName": "My Test application"
               },
               "resourceServicePrincipal": {
                   "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
                   "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
                   "appDisplayName": "My Test application",
                   "displayName": "My Test application"
               },
               "user": {
                   "companyName": "Casey Jensen",
                   "createdDateTime": "2023-08-16T00:00:00Z",
                   "displayName": "Casey Jensen",
                   "givenName": "Casey",
                   "id": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
                   "mail": "[email protected]",
                   "onPremisesSamAccountName": "Casey Jensen",
                   "onPremisesSecurityIdentifier": "<Enter Security Identifier>",
                   "onPremisesUserPrincipalName": "Casey Jensen",
                   "preferredLanguage": "en-us",
                   "surname": "Jensen",
                   "userPrincipalName": "[email protected]",
                   "userType": "Member"
               }
           }
       }
   }
   

   Tip

   If you're using an access token obtained from Microsoft Entra ID, select Authorization and then select Bearer token, then paste the access token you received from Microsoft Entra ID.

4. Select Send, and you should receive a JSON response similar to the following:

   {
       "data": {
           "@odata.type": "microsoft.graph.onTokenIssuanceStartResponseData",
           "actions": [
               {
                   "@odata.type": "microsoft.graph.tokenIssuanceStart.provideClaimsForToken",
                   "claims": {
                       "customClaim1": "customClaimValue1",
                       "customClaim2": [
                           "customClaimString1",
                           "customClaimString2" 
                       ]
                   }
               }
   
           ]
       }
   }
   

After you acquire an access token, pass it the HTTP Authorization header. To obtain an access token, follow these steps:

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

2. Browse to Identity > Applications > Application registrations.

3. Select the Azure Functions authentication events API app registration, previously configured in configure a custom claim provider for a token issuance event.

4. Copy the application ID.

5. If you haven't created an app secret, follow these steps:

   1. Select Certificates & secrets > Client secrets > New client secret.
   2. Add a description for your client secret.
   3. Select an expiration for the secret or specify a custom lifetime.
   4. Select Add.
   5. Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.

6. From the menu, select Expose an API and copy the value of the Application ID URI. For example, api://contoso.azurewebsites.net/00001111-aaaa-2222-bbbb-3333cccc4444.

7. Open your preferred API testing tool and create a new HTTP query.

8. Change the HTTP method to POST.

9. Enter the following URL. Replace the {tenantID} with your tenant ID.

   https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token
   

10. Under the Body, select form-data and add the following keys:

    Key	Value
    grant_type	client_credentials
    client_id	The Client ID of your application.
    client_secret	The Client Secret of your application.
    scope	The Application ID URI of your application, then add .default. For example, api://contoso.azurewebsites.net/00001111-aaaa-2222-bbbb-3333cccc4444/.default

11. Run the HTTP query and copy the access_token into the https://jwt.ms web app.

12. Compare the iss with the issuer name you configured in your API.

13. Compare the aud with the client ID you configured in your API.