I currently use Azure B2C custom policy and I am looking into the new Entra External ID product as a replacement. In custom policy, I am able to use the claims returned by an external OIDC IdP for different things. Consider the custom policy snippet below, which is an OutputClaim within the ClaimsProvider for an external OIDC IdP:
<OutputClaim ClaimTypeReferenceId="authzGroups" PartnerClaimType="groups" />
As examples:
- I can use the value of the groups claim passed in the token issued by the external OIDC IdP in my authzGroups claim defined in custom policy. I can later pass authGroups as an OutputClaim to the RelyingParty (the application).
- By combining the use of claims transformations with OrchestrationStep Preconditions, I can show the user an error page instead of issuing a token (with SendClaims) if the value returned in groups does not match a predefined collection of groupIDs.
How can I achieve manipulating claims from the external OIDC IdP in a similar manner when using Entra External ID?
Currently, there is no generic OIDC IDP in B2C.
You can only use Entra ID or a MSA account, but these are guest accounts.
You can also use Facebook or Google.
A generic OIDC IDP is on the roadmap and may have some kind of mapping feature?
EEID does not support custom policies.