Custom Authentication Extension Not Appearing in User Flow Dropdown (TokenIssuanceStart)

@Jyotishree Moharana hello. are you saying that the OnTokenIssuanceStart event is automatically triggered every time for each of my user flows without e even selecting it for that user flow??? because i havent assigned the authentication extension OnTokenIssuanceStart to my user flow yet. im just wondering on how to assign it properly.

OnTokenIssuanceStart is triggered only after the user has completed all of the authentication challenges and when the token is about to be issued. This is triggered automatically when the token is about to be issued and the token will then contain a default set of claims. If there are some additional custom claims that you want to add to the token you can then configure the extension for the token issuance event.
To configure extension for this event you'll need to create a REST API and then configure claims provider.
Custom-extension-tokenissuancestart-setup-RESTAPI
Custom-extension-tokenissuance-configure-claim-provider

The dropdown inside User Flow will contain only those extensions which were defined for the corresponding event being selected in User Flow.

@Jyotishree Moharana i already have created a TokenIssuanceStart extension. i have an azure function project deployed as a function in my function app. i am using that function url as the endpoint url in the tokenissuance extension. now, i just wanted to know what claims were included in the token by default, and also, would groups and role (app roles, etc) claims be automatically included in the token by editing the app manifest of the app registration being used for api authentication by the tokenissuance extension? if so what needs to be edited in that manifest exactly so that app registratioon will include the group and role claims in the token automatically?

One final question i have is for azure ad b2c. right now ive been talking about entra external id, but when it comes to azure ad b2c, what is the way to emit group/app roles in the token, would my custom policy have to handle that?

Default claims in the token would be below:

sub: The unique identifier for the user.

iat: The time the token was issued.

exp: The expiration time of the token.

aud: The audience for the token.

iss: The issuer of the token.

preferred_username: The username or the email address of the user.

oid: The Object ID of the user in Azure AD.

upn: The User Principal Name.

acr: The authentication context class reference, indicating the level of authentication.

The group claim also does get included in the token by default given the number of groups is less than 200, if it exceeds 200 then by default Entra ID will not include group claims directly in the token because it could potentially be too large.

To include group and role claims in the token, you can add the below in the manifest.

"groupMembershipClaims": "All" // Options: None, All, SecurityGroup

"appRoles": [

{

  "allowedMemberTypes": [

    "User"

  ],

  "displayName": "Admin",

  "id": "guid-unique-id-here",

  "isEnabled": true,

  "description": "Administrator role",

  "value": "Admin"

}

]

Do make sure that the app roles are properly defined under API permissions in the App Registration and the user has the appropriate role assigned.

Incase of Azure AD B2C, adding group and role claims is required to be taken care via custom policy. You can modify the TrustFrameworkExtensions.xml file to include group claims. You may use the <OutputClaim> element to extract group information and add it to the issued token.

<OutputClaim ClaimTypeReferenceId="groups" />

<OutputClaim ClaimTypeReferenceId="roles" />

Hello Ray,

Following up to check if the information provided was useful. If you have any further questions or queries, do let us know.