Sign-up policy - Set user attributes through code

Question

I want to programatically set user attributes for the sign up policy. I saw a previous question (Pass parameters to Sign-up policy) asked over a year ago and it was not pos

Answer 1

This can be implemented using a custom policy.

A working sample of passing an input claim from a relying party application to a custom policy (e.g. an invitation flow as a sign-up policy) is here.

In the WingTipGamesWebApplication project, the InvitationController controller class has two action methods, Create and Redeem.

The Create action method sends a signed redemption link to the email address for the invited user. This redemption link contains this email address.

The Redeem action method handles the redemption link. It passes the email address, as the verified_email claim in a JWT that is signed with the client secret of the Wingtip Games application (see the CreateSelfIssuedToken method in the Startup class in the WingTipGamesWebApplication project), from the redemption link to the Invitation policy.

The Invitation policy can be found at here.

The Invitation policy declares the verified_email claim as an input claim:

  
  
    JWT
      
        
    
    
      
    
  

The extension_verifiedEmail claim type, which is declared as a read-only field (so that it can't be modified by the end user), is mapped to the verified_email input claim:

  
    
      Verified Email
      string
      
        
        
        
      
      Readonly
    
  

The Invitation user journey can be found in here.

The second orchestration step of the Invitation user journey executes the LocalAccount-Registration-VerifiedEmail technical profile:

  
    ...
    
      
        ...
        
      
    
  

The LocalAccount-Registration-VerifiedEmail technical profile copies from the extension_verifiedEmail claim to the email claim and then displays the sign-up form with the verified email address (the extension_verifiedEmail claim):

  WingTip Account
  
  
    api.localaccount.registration
    IpAddress
    Create
  
  
    
  
  
    
  
  
    
  
  
    
    
    
    
    
    
    
    
    
    
  
  
    
  
  

This LocalAccount-Registration-VerifiedEmail technical profile references the AzureActiveDirectoryStore-WriteUserByEmail-ThrowIfExists validation technical profile that saves the local account with the verified email address (the email claim):

  
    Write
    true
  
  false